Cybersecurity — Election Security Glossary

Election infrastructure — the systems, networks, and processes that support voter registration, ballot production, and vote counting — was formally designated critical infrastructure by the U.S. Department of Homeland Security in 2017. That designation brought election security into the same federal framework as power grids and water systems, and with it came an expanded vocabulary. The terminology of cybersecurity now sits alongside the established language of election administration, and officials, journalists, and researchers must navigate both. The defining characteristic of election cybersecurity is that the primary threat is not financial loss but loss of integrity. Confidentiality matters — voter registration data is sensitive — but the most significant risk is the possibility that data or systems are altered without detection. An election system that produces incorrect results because of a software vulnerability, a malware infection, or a supply chain compromise undermines public confidence in ways that have no direct analogue in commercial cybersecurity. This shapes how security controls are prioritized. Encryption protects the integrity and confidentiality of data in transit and at rest. Multi-factor authentication prevents unauthorized access to election management systems even when passwords are compromised. Penetration testing identifies vulnerabilities before adversaries do. These are not theoretical measures: CISA advisories and post-election after-action reports consistently document phishing campaigns targeting election officials, ransomware incidents affecting county government networks, and reconnaissance activity against voter registration systems. Incident response planning is equally central. Commercial organizations can often absorb a security incident and recover over days or weeks. Election officials do not have that flexibility: elections run on fixed legal deadlines, and a security incident on election day requires a response plan that has been tested, refined, and communicated in advance. The incident response vocabulary — indicators, containment, remediation, communication protocols — is operational knowledge for election security teams, not abstract theory. Supply chain security has emerged as a particular concern for election systems, which incorporate hardware and software components from multiple vendors. A compromise introduced at any point in a supply chain — a backdoored firmware update, a malicious component in voting machine hardware — can propagate to the final product in ways that are difficult to detect through standard testing. The terms in this category reflect that expanded attack surface: from advanced persistent threats sponsored by nation-states to commodity malware deployed by opportunistic criminals.