Election Security Guide: Protecting Voting Systems, Voter Data and Results

Elections run on a small, seasonal and heavily scrutinised technology estate, and a single weak account or unpatched server can undermine public confidence even when no vote is changed. This guide covers the security of election infrastructure as defined by CISA and NIST: voter registration systems, electronic pollbooks, voting and tabulation equipment, election management systems, results reporting and the people and suppliers around them. It is written for IT and security staff in election offices, the local and central government teams that support them, and suppliers who build or host election technology. It is deliberately non-partisan: the aim is accurate, auditable and available elections, whoever wins. It builds on the Public Sector Identity Security Guide and does not repeat it.

Key takeaways

• Protect confidence as well as systems. Most realistic attacks target availability (results websites, voter lookup), registration data or public trust, not the ballot count itself.
• Paper plus audit is the core integrity control. A voter-verifiable paper record and a post-election audit make tabulation errors and tampering detectable, which is the principle behind software independence in VVSG 2.0.
• Identity is the most common way in. Election offices are small, staff are seasonal and suppliers have remote access, so phishing-resistant MFA and tight supplier access matter more than exotic controls.
• Work to the election calendar. Freeze changes, test and exercise before key dates, and keep patching and audits on a cycle that never lands in the voting window.
• Know the support landscape. In the US, federal support changed in 2025, so offices should confirm which services they still receive and plan alternatives rather than assume.

What counts as election infrastructure

CISA describes election infrastructure as voter registration databases and associated IT systems, IT systems used to manage elections (counting, auditing, results display, post-election reporting and certification), voting systems, storage facilities for election equipment, and polling places including early voting locations. DHS placed election systems in the Government Facilities critical infrastructure sector in January 2017. NIST's Election Infrastructure Profile (NIST VTS 200-1) uses a similar scope and adds electronic pollbooks, central-count optical scanners, audit software and ballot drop boxes, while excluding political campaigns.

The practical consequence is that "election security" spans very different systems with very different exposure:

The threat picture

Threats to elections come from foreign states seeking influence, hacktivists seeking visibility, criminals seeking ransom, and insiders. The techniques are mostly ordinary. Mapped to MITRE ATT&CK:

Information operations sit alongside these. CISA public service announcements for the 2022 midterms warned that foreign actors were likely to use information manipulation tactics and that malicious cyber activity against election infrastructure was unlikely to disrupt or prevent voting. Claims of compromise can still damage trust. A minor outage, amplified falsely, can do more harm than the outage itself. See the Disinformation and Brand Impersonation Guide. State actor context is in the Russia State Cyber Operations Guide and the Iran State Cyber Operations Guide.

Voting system standards and integrity by design

In the US, the Election Assistance Commission (EAC) adopted the Voluntary Voting System Guidelines 2.0 (VVSG 2.0) on 10 February 2021. The EAC accredited the first Voting System Test Laboratory (VSTL) to test against VVSG 2.0 in November 2022 and both labs were accredited by December 2022. VVSG 2.0 is voluntary at federal level; many states require federal certification or use it in their own certification, so check your state's rules.

The EAC's summary of major updates lists the security changes that matter for operators:

• Software independence: an undetected change or error in software cannot cause an undetectable change in the election outcome. In practice this means a voter-verifiable paper record that can be audited.
• Network isolation: voting systems must be air-gapped from other networks, and wireless technologies are not allowed.
• Multi-factor authentication: listed among the new cybersecurity requirements.
• System integrity and data protection: protections for software, configuration and election data.
• Physical security and auditability: physical protections are part of the cybersecurity requirements, and auditability is strengthened.
• Interoperability: common data formats with fully specified implementations, which helps independent audit tools.
• Penetration testing: addressed in the testing manuals.

Operators inherit only what they configure. A certified system loses much of its assurance if it is connected to a county network for convenience, if removable media moves freely between the EMS and office PCs, or if the installed build does not match the certified one. Verify software and firmware hashes against the certified release before each election and record the result.

Identity and access in the election office

Election offices combine permanent staff, seasonal workers, volunteers, contractors and supplier engineers, often within a county IT estate they do not control. The access model should reflect that:

• Phishing-resistant MFA for staff: FIDO2 security keys or passkeys for email, the registration system, EMS administration and remote access. NIST's profile only calls for authentication matched to risk (CSF 1.1 PR.AC-7), so this is a decision to make deliberately. See the Phishing-Resistant MFA Guide.
• Separate roles: distinct accounts for ballot definition, tabulation, results export and system administration, with no shared logins on tabulators or the EMS.
• Two-person rules: for opening sealed equipment, handling memory devices and exporting results, recorded in a log both people sign.
• Seasonal joiners and leavers: time-bound accounts for poll workers and temporary staff that expire automatically after certification.
• Supplier access: named accounts only, enabled per session, recorded, and never left standing between elections. Put these terms in the contract. See the Third-Party Risk Management Guide.
• Machine credentials: service accounts and API keys that link the registration system to motor vehicle, court or other agency feeds are non-human identities. Inventory them, vault their secrets and rotate them on a schedule outside the voting window.
• Emergency access: a documented break-glass account for the registration system with alerting on every use. See the Break-Glass Account Guide.

Insider risk deserves its own plan because a small number of people have high-impact access. CISA publishes an Election Infrastructure Insider Threat Mitigation Guide for election stakeholders. See the Insider Threat Programme Guide.

Availability: results sites, lookup tools and denial of service

Public-facing services see their peak load at exactly the moment attackers want attention. CISA's guide "No Downtime in Elections: A Guide to Mitigating Risks of Denial-of-Service" is aimed at helping officials assess DoS impact, coordinate with service providers and include DoS scenarios in incident response plans. Practical steps:

• Upstream protection: put the results site, polling place lookup and voter registration status pages behind a DDoS mitigation service or content delivery network, confirmed with a load test before the election.
• Static fallback: publish results as static files that can be served from a CDN or a secondary host, rather than a database-driven application.
• Alternative channels: agree in advance how results and polling information will be published if the website is down (press feeds, official social accounts, partner sites), and tell the public where the authoritative source is.
• Provider coordination: have contact details and escalation paths for your ISP, hosting and DDoS provider in the incident plan.

See the DDoS Protection Guide and the DDoS Response Playbook.

Audits, testing and chain of custody

NIST VTS 200-1 lists "Conduct Audits" as a distinct mission objective and groups audit activity into security audits, tabulation audits (hand count, risk-limiting and ballot comparison audits) and quality audits (logic and accuracy testing, ballot content checks, public tests and parallel tests). The EAC notes there is no national auditing standard in the US, and states use procedural, traditional fixed-percentage, risk-limiting and tiered approaches.

For custody records, see the Chain of Custody Form Template.

Implementing an election security programme

1. Inventory and scope (12 months out): list every system, device, account, supplier connection and data flow, using the component table above. Mark which are isolated and which are networked.
2. Close the basics (9 to 12 months out): patch internet-facing systems, enforce MFA, remove standing supplier access, separate election systems from general office IT, and confirm immutable or offline backups of registration data.
3. Assess against a profile (6 to 9 months out): run a gap assessment against NIST VTS 200-1 or, in the UK, the NCSC Defending Democracy guidance, and prioritise mission objectives 1 to 4 (voting period, system preparation, registration, election preparation).
4. Exercise (3 to 6 months out): run tabletop exercises on ransomware in the registration system, a results-site outage and a false claim of compromise. Include communications staff and legal counsel. See the Cyber Incident Exercises Beyond Tabletop Guide.
5. Freeze and test (final 6 weeks): apply a change freeze, complete logic and accuracy testing and hash verification, load-test public sites and confirm fallback channels.
6. Operate (voting period): staff a monitoring and response rota, keep supplier contacts on call, and log every exception.
7. Audit and wrap up: complete post-election audits, disable temporary accounts, revoke supplier sessions, store equipment under custody and run a lessons-learned review.

Rollback: every change in the run-up must have a tested rollback. If a patch or configuration change breaks a pollbook or tabulator during testing, revert to the certified baseline rather than debug in the voting window. Paper pollbook lists and emergency paper ballots are the operational rollback for device failure.

Decision guidance: small and large jurisdictions

In the US, support arrangements changed in 2025. A Wisconsin Elections Commission memo of 19 March 2025 reports that DHS announced on 19 February 2025 the end of federal funding for election-related activities, including EI-ISAC services, and that federal funding for EI-ISAC and MS-ISAC was cut on 6 March 2025, while CIS said services such as Albert sensors, Malicious Domain Blocking and Response, EDR, the Nationwide Cybersecurity Review and SOC operations continued while it sought other funding. CIS now offers election threat intelligence through MS-ISAC membership. Confirm your current entitlements directly with each provider. Status checked 27 October 2026. The CIS EI-ISAC page now describes EI-ISAC access as part of MS-ISAC membership, so check current membership terms and any federal grant funding directly with CIS.

Detection and measurement

Monitor the systems that change least and matter most:

• Registration system: bulk record changes, changes outside office hours, new administrator accounts, and sign-ins from unexpected locations or supplier accounts.
• EMS and tabulators: application and audit logs exported after each phase, any USB or media insertion outside the procedure, and failed authentication on the console.
• Public sites: traffic baselines, content integrity monitoring for unexpected page changes, and certificate or DNS changes.
• Email: lookalike domains of the election office, and reported phishing volume in the run-up.

Metrics that show the programme works:

• Percentage of staff and supplier accounts using phishing-resistant MFA.
• Days to patch critical vulnerabilities on internet-facing systems, measured against your policy.
• Percentage of devices with a recorded logic and accuracy test and hash verification before the election.
• Standing supplier remote access sessions outside approved windows (target: zero).
• Time to restore the voter registration system from backup, measured in an exercise.
• Custody exceptions per election and how quickly each was resolved.

Framework mapping

NIST VTS 200-1 was written against CSF 1.1, so its subcategory IDs (for example PR.AC-7 and PR.DS-6) differ from the CSF 2.0 IDs above.

Common failure patterns

• Unpatched internet-facing servers: the UK Electoral Commission attack, set out in the ICO's reprimand of 30 July 2024, began in August 2021 through known vulnerabilities in a Microsoft Exchange Server for which patches had been released in April and May 2021. Attackers had access until October 2022 and the electoral register data of about 40 million people was exposed. See the Microsoft Exchange Server Security Guide.
• Weak password practice: the same ICO reprimand found many accounts still used passwords identical or similar to those first issued by the service desk. The remediation included MFA for all users. See the Password Policy Guide (NIST-aligned).
• Convenience connections: a tabulator or EMS connected to the office network for updates or file transfer breaks the isolation the certification assumed.
• Standing supplier access: remote support accounts left enabled between elections, shared between engineers, or without logging.
• No plan for the narrative: a short outage of the results site is handled technically but not publicly, leaving room for false claims of manipulation.
• Audits treated as paperwork: custody logs and logic and accuracy records that are incomplete or unsigned, so they cannot support confidence when results are challenged.

Practitioner checklist

• Maintain an inventory of every election system, device, account, supplier connection and data feed.
• Enforce phishing-resistant MFA for administrators and suppliers, and MFA for all staff.
• Patch internet-facing systems to policy timelines and complete patching before the change freeze.
• Keep voting and tabulation systems isolated, control removable media and verify builds by hash.
• Put public results and lookup sites behind DDoS mitigation with a static fallback and alternative channels.
• Protect and test backups of the voter registration database, including a timed restore.
• Run logic and accuracy tests, chain of custody and post-election audits with complete, signed records.
• Exercise ransomware, outage and false-claim scenarios with communications and legal staff.
• Confirm which external support services you receive this cycle and document alternatives.

Standards and references

• NIST: VTS 200-1 Cybersecurity Framework Election Infrastructure Profile
• U.S. Election Assistance Commission: Voluntary Voting System Guidelines 2.0
• CISA: Election Security
• NCSC: Defending Democracy
• U.S. Election Assistance Commission: Election Audits Across the United States
• Center for Internet Security: EI-ISAC
• ICO: ICO reprimands the Electoral Commission after cyber attack compromises servers
• NIST: SP 800-53 Rev. 5

Related NHI Mgmt Group resources: Public Sector Identity Security Guide · Cybersecurity for Local Government Guide · Phishing-Resistant MFA Guide · DDoS Protection Guide · Insider Threat Programme Guide