Category Overview

Supply Chain — Election Security Glossary

13 election security terms in the Supply Chain category, with definitions sourced from NIST, CISA, EAC, and 30+ authoritative documents.

Browse all 13 terms in Supply Chain

Authorized Vendor

Manufacturer of information security (INFOSEC) equipment authorized to produce quantities in excess of contractual requirements for direct sale to eligible buyers.

Medium consensus2 sources

By ESG Editorial Team · Drawing on NIST, CISA, EAC, and 25+ sources on election supply chain risk management

Election supply chain is the network of vendors, components, and integrity controls that election equipment and software depends on. It includes the manufacturers of voting machines, the firms that develop election management software, the laboratories that test equipment, the vendors that supply ballot printing and design services, and the chain of custody that moves equipment from manufacturer to polling place.

Why this category matters for election security is that an election system is only as trustworthy as the weakest link in the supply chain that produces it. A compromise introduced at the manufacturing stage, a backdoor inserted in firmware before delivery, or a tampered software update can all become embedded in the equipment used on election day. Defending against these risks requires a layered approach that combines vendor vetting, supply chain transparency, integrity testing, and post-delivery verification.

Federal guidance from CISA and the EAC addresses supply chain risk in election contexts. The recent vulnerability disclosures and supply chain incidents in the broader technology sector have prompted election offices to apply more rigorous supply chain risk management practices. The terminology here covers both the threats and the controls.

The terminology in this category covers both the supply chain itself and the discipline of managing its risks. The concepts here are practical. They describe the work of ensuring that the components elections depend on are trustworthy.

Key Concepts

Supply Chain Attack

A cyberattack that compromises less-secure elements of a supply chain (hardware, firmware, or software) to ultimately target the election system using those components.

How These Terms Relate

These concepts together describe the supply chain risk landscape that election infrastructure faces. The terminology here draws on the broader supply chain security literature, but applied to the election context. The unifying theme is trust propagation. An election system can only be trusted if every component in its supply chain is itself trustworthy. The election-specific challenge is that supply chains are long, complex, and often international, making rigorous supply chain risk management a real operational discipline.