This page features a nonpartisan educational series from the Center for Tech and Civic Life,  election security best-practices. We’ve designed this series with county IT professionals who may be less familiar with election administration needs in mind. Each month, CTCL contributes blog posts to the National Association of Counties’ Tech Xchange Newsletter that highlight available resources, discuss broader considerations for election security, and share practical insights. CTCL does not provide election security products or direct services. Our goal is to help educate county officials so they can better understand, assess, and pursue the best solutions for their jurisdiction’s unique needs.

As the saying goes, “there’s always something on the horizon”. This originates from the age of maritime navigation, where sailors would use the horizon as a reference point to prepare for future events, like weather or other ships. Its meaning has broadened to describe future events, things happening beyond the horizon metaphorically. Elections may seem like a one-day event to the public, but for county officials, it’s a continuous process. They are perpetually planning and preparing, much like sailors preparing for the future, always looking ahead to the next election and anticipating challenges.

To navigate and mitigate potential risks of what may come, the importance of election preparedness and community readiness cannot be overstated. Elections are high-visibility and fulfill one of the most important bedrocks of our democracy. Thus, they necessitate- and deserve – maximal proactive measures to bolster the security and resilience of infrastructure and operations. Such forward-looking measures will not only increase the likelihood of a smoothly run and secure election but also foster public trust. Examples of key proactive actions include strong organizational security leadership, collaboration, and continuity of operations planning and practice.  

Leadership

While officials cannot predict or control everything, we can control how prepared we are to execute an election and handle any incidents that come our way. This choice begins at the very top, where leadership can foster an organizational culture that prioritizes preparation, resilience, and cybersecurity in every aspect of the decision-making process. To increase the resilience of elections, county officials need to implement robust cyber and physical security leadership. 

Elections are increasingly digital, and our adversaries know that even the perception of compromise inflicts damage. To defend against this, county leadership has to assess and take ownership of the full threat landscape from cyber to physical security to information dissemination. This means they commit to making tough, proactive decisions to prevent and plan a response to potential incidents before they occur. We all know it’s not a question of “if” anymore. It’s a question of “when”. By integrating security into every decision, across the entire organization, we can champion and resource technology and policies that align with strategic goals and maximize proactive defense. For example, this may include establishing clear policies, standards, and roles and responsibilities organization-wide, such as training and awareness requirements, embedding cybersecurity into budget and system or service acquisition, supply chain management requirements, and more. If you’re interested in more information, the United Kingdom’s National Cyber Security Centre lays out numerous aspects of cyber governance nicely.

Collaboration

It doesn’t stop there, though. It’s also important to collaborate with partners, as no one stands alone. It’s important to never operate in a silo. The complexity of modern election technology demands heavily integrated operations with multiple partners, such as working hand-in-hand with local emergency responders, private-sector partners, utility providers, local universities, and more. And, the effort should go beyond just sharing alerts from trusted sources. It should be about fostering shared situational awareness, aligning response protocols and support, building up relationships before you’re in crisis mode, and gathering insight into vendor products and supply chain risks. Resilient systems are backed up by resilient teams, which means no one is resilient if they’re operating in a vacuum. For example, consider assembling a multi-disciplinary workgroup or partnerships to expand information and resource sharing, such as the Commonwealth of Pennsylvania’s approach to collaboration with the County Commissioners Association of Pennsylvania (CCAP). 

Practice like you play. 

Would you walk into a state championship game without practice? No. Tabletop exercises provide an opportunity to put your policies, procedures, and systems under stress, with the added benefit of being in a safe, no-fault environment. These exercises offer the chance to identify gaps in partnerships and resources, improve cross-functional coordination, and build muscle memory so that when an incident occurs during an election, your teams can navigate the situation brilliantly. 

Equally important, it’s a chance to identify and pre-plan communications to internal and external stakeholders, such as preparing, regularly reviewing, and revising Continuity of Operations plans. During a crisis, silence provides a message of its own – and it isn’t pretty. This can be organized and tackled from within the elections office. It can also be applied organization-wide, as various aspects of election infrastructure touch county infrastructure that isn’t just for elections. Regardless of how it’s organized, exercises provide your organization with the opportunity to identify gaps and improvements before an incident, giving you a leg up in the game.

Both the Cybersecurity & Infrastructure Security Agency (CISA) and the Center for Internet Security (CIS) offer pre-built tabletop scenarios to kick-start your exercise planning journey. The U.S. Election Assistance Commission also has a continuity planning guide to support election operations, which can be ported over to other areas, that focuses on various planning phases: preparedness, activation, alternate operations, and reconstitution. 

By fostering a security-first culture that’s focused on hardening their backbone to improve preparation and resilience, organizations can execute elections more seamlessly and prevent and mitigate incidents quickly. It isn’t just about tabulating ballots at the end of the day, it’s about protecting democracy and preserving public trust. Invest in preparation and empower your teams to rise to the moment. Build resilience like it’s mission-critical – because it is.