Election officials should use strong identity verification, pre registration, and clear eligibility controls so remote voting remains limited to approved voters. A good design balances accessibility with fraud resistance by verifying a government identity, checking biometrics, and issuing the ballot only after authentication passes. That approach reduces impersonation risk while keeping the voter journey practical for rural and diaspora populations.
How to balance access control with voter usability
Remote voting works best when officials treat identity proofing and ballot issuance as separate steps. The goal is not to create the strongest possible gate at every stage, but to make the approval decision dependable while keeping the voter journey short, understandable, and recoverable when a legitimate voter hits an edge case. That means designing for low-friction verification, not low assurance.
Officials usually need a layered approach: verify the voter against registration records, use a strong second factor where the channel allows it, and reserve the final ballot release until the voter has passed the required checks. That sequence reduces impersonation while avoiding a single brittle control that blocks eligible voters who have poor connectivity, older devices, or limited digital fluency.
Accessibility matters because remote voting is often used by rural, overseas, military, or otherwise distributed voters who cannot tolerate a long authentication journey. The best design therefore gives voters a clear path, predictable retries, and a fallback for legitimate exceptions, while still preserving an audit trail for every ballot-issuance decision.
Where identity proofing is too strict, the system can push legitimate voters into abandonment or manual workarounds. Where it is too weak, the system can admit impersonation, duplicate registrations, or ballot harvesting. The practical sweet spot is a process that asks for enough evidence to establish eligibility, but no more than is needed to support that decision with confidence.
What controls make remote voting defensible
Strong remote voting designs usually combine three control layers: eligibility validation, authentication, and issuance control. Eligibility validation checks that the person is on the approved voter roll and entitled to vote in that election. Authentication then confirms the claimant is the registered voter. Issuance control ensures the ballot is released only after both checks pass, which is the point where the process becomes materially secure.
Biometrics can improve convenience, but they should be treated as one factor in a broader assurance model rather than the only gate. They can reduce repeated friction for voters, yet they still need to sit inside a process that can handle false rejects, accessibility constraints, and dispute resolution. Officials should assume some voters will not be able to complete every automated step on the first attempt.
For remote voting, the operational question is whether the control stack can distinguish between eligible friction and actual abuse. That is where pre registration, identity verification, rate limiting, anomaly review, and exception handling all matter together. A system that only works in the lab but fails on low-bandwidth connections is not ready for public use.
NHIMG research on secrets sprawl shows why control design must also account for administrative integrity. In its Guide to the Secret Sprawl Challenge, NHIMG reports that 79% of organisations have experienced secrets leaks, with 77% causing tangible damage. That is a useful reminder that the back-end systems issuing or validating ballots need the same discipline as the voter-facing channel.
Remote voting also benefits from hardened supporting systems, not just front-end checks. Guidance on NIST SP 800-53 Rev. 5 Security and Privacy Controls is relevant because access control, auditability, and configuration management determine whether the election system can prove who was approved and why.
Risk and Threat Considerations
Remote voting creates a real tension between inclusivity and assurance. If officials make the process too permissive, impersonation, duplicate access, or ballot manipulation becomes more plausible. If they make it too rigid, eligible voters may be excluded by failed verification, poor connectivity, or inaccessible design, which is also a material election risk.
Failure mechanism: Weak identity proofing, overreliance on a single factor, or poor control of ballot issuance can let an attacker vote as someone else, while overly strict verification can suppress legitimate votes through false rejects and support failures.
Impact: The result is either fraud exposure or disenfranchisement, and both outcomes damage trust in the election even if the underlying technical system is functioning as designed.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST CSF 2.0, NIST SP 800-63 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | PR.AC — Access Control | Remote voting depends on controlling who can obtain and use a ballot. |
| GV.OC — Organizational Context | Election services must balance public access, integrity, and trust as part of governance. | |
| DE.CM — Continuous Monitoring | Monitoring is needed to spot abnormal voting patterns, failed logins, and abuse. | |
| Recommendation — Enforce access control so only eligible voters can reach ballot issuance. Define election-service outcomes so security controls preserve both integrity and accessibility. Monitor authentication and issuance events for anomalies that indicate impersonation or process failure. | ||
| NIST SP 800-63 | IAL — Identity Assurance Level | Eligibility verification and identity proofing are central to remote voter approval. |
| AAL — Authenticator Assurance Level | Authentication strength determines how well a claimed voter is bound to the approved identity. | |
| Recommendation — Set an assurance level that matches the election's fraud and usability tolerance. Use an authenticator level that resists impersonation without creating unnecessary voter friction. | ||
| CIS Controls v8 | 6 — Access Control Management | Remote voting requires tightly governed access to registration and ballot issuance functions. |
| Recommendation — Restrict ballot issuance and administrative access to approved identities and roles. | ||
Practitioner Guidance
What to verify: Test the full voter journey, not just the login step. Officials should confirm that the eligibility record, authentication step, ballot issuance event, and audit log all line up for both successful and rejected cases.
Decision rule: If a control increases voter abandonment without materially improving fraud resistance, simplify it. If a control can be bypassed without changing eligibility status, it is not carrying its weight.
What practitioners underestimate: Remote voting failures often come from exception handling, not the main path. A good election design includes recovery steps for identity mismatches, expired documents, and accessibility barriers, because those are the moments when legitimate voters are most likely to fall out of the process.
Practitioner takeaway: The right objective is not maximum verification, but verifiable eligibility with the least possible friction that still preserves trust, auditability, and a usable fallback for legitimate voters.
Related resources from NHI Mgmt Group
- How should organisations secure remote work without making security policies too hard for employees to follow?
- How should security teams secure hybrid and remote work without adding too much user friction?
- How should financial institutions secure remote onboarding without creating too much friction?
- How should security teams secure remote access without creating help desk bypasses?
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on September 19, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
