Category Overview

Incident Response — Election Security Glossary

19 election security terms in the Incident Response category, with definitions sourced from NIST, CISA, EAC, and 30+ authoritative documents.

Browse all 19 terms in Incident Response

Cyber Incident

Actions taken through the use of an information system or network that result in an actual or potentially adverse effect on an information system, network, and/or the information…

Medium consensus3 sources

Computer Incident Response Team (cirt)

Group of individuals usually consisting of security analysts organized to develop, recommend, and coordinate immediate mitigation actions for containment, eradication, and…

High consensus2 sources

Computer Security Incident

event.

Low consensus2 sources

By ESG Editorial Team · Drawing on NIST, CISA, the EI-ISAC, and 25+ sources on incident response

Incident response is the practice of detecting, containing, and recovering from security events. In election administration, it covers the full spectrum: a phishing email reported by a county employee, a website defacement, a denial-of-service attack on a results-reporting portal, a ransomware deployment against a county government network, or a physical incident at a polling place.

Why this category matters for election security is that no defense is perfect. The question is not whether an incident will occur but whether, when it does, the response is fast, effective, and well-documented. Election offices that plan and rehearse their response recover faster, communicate better, and preserve public trust.

Federal guidance from CISA, the FBI, and the EAC provides the technical and procedural framework. State fusion centers and the Election Infrastructure Information Sharing and Analysis Center (EI-ISAC) support information sharing across jurisdictions. The goal is to ensure that no county, no matter how small, faces a serious incident alone.

The terminology in this category covers the lifecycle of an incident: detection, triage, containment, eradication, recovery, and post-incident review. The concepts here are practical. They describe the steps an election office takes when something goes wrong.

Key Concepts

Incident Response Plan

Documented procedures for detecting, containing, and recovering from security incidents.

Recovery Time Objective

The target time within which a system or process must be restored after a disruption.

How These Terms Relate

These concepts together describe the discipline of incident response. The terminology here draws on the broader cybersecurity incident-response literature, but with election-specific adaptations. The unifying theme is that response is a process, not an event. A good plan is documented, rehearsed, and exercised before an incident occurs. A good response is coordinated, communicated, and reviewed. The election-specific challenge is operating under fixed legal deadlines: election day is not movable, and an incident on or before it requires a response that keeps the election on schedule.