Incident Response — Election Security Glossary
19 election security terms in the Incident Response category, with definitions sourced from NIST, CISA, EAC, and 30+ authoritative documents.
Browse all 19 terms in Incident Response
Tabletop Exercise
A discussion-based exercise where personnel with roles and responsibilities in a particular IT plan meet in a classroom setting or in breakout groups to validate the content of…
Incident Response Plan
The documentation of a predetermined set of instructions or procedures to detect, respond to, and limit consequences of a malicious cyber attacks against an organization's…
Cyber Incident
Actions taken through the use of an information system or network that result in an actual or potentially adverse effect on an information system, network, and/or the information…
Incident
An occurrence that results in actual or potential jeopardy to the confidentiality, integrity, or availability of an information system or the information the system processes,…
Incident Response
See incident handling.
Indicator
An occurrence or sign that an incident may have occurred or may be in progress.
Precursor
A sign that an attacker may be preparing to cause an incident.
Security Incident
See incident. Source: NIST IR 7298 Rev 2.
Computer Incident Response Team (cirt)
Group of individuals usually consisting of security analysts organized to develop, recommend, and coordinate immediate mitigation actions for containment, eradication, and…
Computer Security Incident
event.
Hunt And Incident Response Team
A set of teams within the Cybersecurity and Infrastructure Security Agency that provides onsite incident response, free of charge, to organizations that require immediate…
Inadvertent Disclosure
Type of incident involving accidental exposure of information to an individual not authorized access.
By ESG Editorial Team · Drawing on NIST, CISA, the EI-ISAC, and 25+ sources on incident response
Incident response is the practice of detecting, containing, and recovering from security events. In election administration, it covers the full spectrum: a phishing email reported by a county employee, a website defacement, a denial-of-service attack on a results-reporting portal, a ransomware deployment against a county government network, or a physical incident at a polling place.
Why this category matters for election security is that no defense is perfect. The question is not whether an incident will occur but whether, when it does, the response is fast, effective, and well-documented. Election offices that plan and rehearse their response recover faster, communicate better, and preserve public trust.
Federal guidance from CISA, the FBI, and the EAC provides the technical and procedural framework. State fusion centers and the Election Infrastructure Information Sharing and Analysis Center (EI-ISAC) support information sharing across jurisdictions. The goal is to ensure that no county, no matter how small, faces a serious incident alone.
The terminology in this category covers the lifecycle of an incident: detection, triage, containment, eradication, recovery, and post-incident review. The concepts here are practical. They describe the steps an election office takes when something goes wrong.
How These Terms Relate
These concepts together describe the discipline of incident response. The terminology here draws on the broader cybersecurity incident-response literature, but with election-specific adaptations. The unifying theme is that response is a process, not an event. A good plan is documented, rehearsed, and exercised before an incident occurs. A good response is coordinated, communicated, and reviewed. The election-specific challenge is operating under fixed legal deadlines: election day is not movable, and an incident on or before it requires a response that keeps the election on schedule.
Related categories
1,851 terms
The technical context in which most incidents occur.
Operational Security53 terms
The day-to-day practices that reduce incident frequency and severity.
Communications53 terms
The public messaging that accompanies incident response.
Auditing46 terms
The reviews that confirm incidents are fully resolved and lessons are learned.
Can't find the right category?
Search the full glossary, or browse every term alphabetically instead.