Cybersecurity Toolkit and Resources to Protect Elections

As the lead federal agency responsible for national election security, CISA—through the Joint Cyber Defense Collaborative (JCDC)—has compiled a toolkit of free services and tools intended to help state and local government officials, election officials, and vendors enhance the cybersecurity and cyber resilience of U.S. election infrastructure.

How To Use This Toolkit

FIRST, use the Election Security Risk Profile Tool to assess your risk. The tool, developed by CISA and the U.S. Election Assistance Commission, can help state and local election officials understand the range of risks they face and how to prioritize their mitigation efforts. With this tool, you can:

• Address areas of greatest risk.
• Ensure that technical cybersecurity assessments and services are meeting critical needs. 
• Gain a sound analytic foundation for managing election security risk with key partners at the federal, state, and local level.

SECOND, review the items below. These are the election infrastructure assets most commonly targeted byphishing, ransomware, and distributed denial-of-service (DDoS) attacks.

• Voter information: Threat actors may try to compromise or manipulate electronic poll books and voter registration databases in attempt to cause confusion or delay voting.
• Websites: Threatactors often target state and local websites with DDoS, phishing, and ransomware attacks.
• Email systems: Threat actors use phishing as the preferred vector with which to target state and local email systems.
• Networks: Threat actors commonly use vectors, such as phishing or malware, to infiltrate state and local networks that election offices rely on for regular business functions.

THIRD, review this toolkit for the tools and services that correspond to the election infrastructure asset(s) you need to secure. The services and tools are aligned with the Protect and Detect functions of the NIST Cybersecurity Framework. Protect enables outlines safeguards to ensure the delivery of critical services and Detect defines activities to identify the occurrence of a cybersecurity event.

Note: This toolkit is not comprehensive. CISA applies neutral principles and criteria to add items and maintains sole and unreviewable discretion over the determination of items included. CISA does not attest to the suitability or effectiveness of these services and tools for any particular use case. CISA does not endorse any commercial product or service. Any reference to specific commercial products, processes, or services by service mark, trademark, manufacturer, or otherwise, does not constitute or imply their endorsement, recommendation, or favoring by CISA.

Preliminary Actions to Defend Against Common Cyber Threats:

Before using the toolkit to address specific threats, take the following actions to establish your cybersecurity baseline:

1. Implement free CISA Cyber Hygiene Services Vulnerability Scanning.
2. Keep systems and software updated and prioritize remediating known exploited vulnerabilities.
3. Follow password best practices, e.g., multifactor authentication enforcement, password manager.
4. Make and secure offline backups of data.

Once you understand your risks and capability gaps, use the below resources to learn more about how you can better protect against cybersecurity threats.

Officials seeking to secure election infrastructure should carefully review each section to identify tools and services appropriate to address their primary risks.

The services and tools are aligned with the Protect and Detect functions of the NIST Cybersecurity Framework. Protect outlines safeguards to ensure the delivery of critical services and Detect defines activities to identify the occurrence of a cybersecurity event. 

Note: This toolkit is not comprehensive. CISA applies neutral principles and criteria to add items and maintains sole and unreviewable discretion over the determination of items included. CISA does not attest to the suitability or effectiveness of these services and tools for any particular use case. CISA does not endorse any commercial product or service. Any reference to specific commercial products, processes, or services by service mark, trademark, manufacturer, or otherwise, does not constitute or imply their endorsement, recommendation, or favoring by CISA.

Category 1: Phishing

Step 1: Understand Phishing Attacks

Phishing attacks use email, text messaging, social media, and/or malicious websites to solicit personal information or to trick individuals into downloading malicious software. Cyber threat actors often use elections and political events to capture attention and lure recipients into clicking a link or downloading a file that contains malicious code. Election officials are often required to open email attachments, which could contain malicious payloads, to facilitate election administration processes (e.g., absentee ballot applications).

Category 2: Ransomware

Step 1: Understand Ransomware Attacks

Ransomware is malicious software designed to deny access to computer systems or data. In a ransomware attack, the ransomware actor encrypts systems and/or data, rendering them inaccessible to owners and users. In some cases, data is also taken (exfiltrated) from the user’s computer or network.  The actor demands payment to decrypt the systems and/or data. However, paying this ransom does not guarantee the user will regain access to their systems and/or data; these assets can be permanently lost or leaked. 

For elections, a ransomware attack could leak or deny access to voter registration data, unofficial results reporting, and other sensitive information. It could also inhibit access to important election systems during critical operational periods, such as registration and candidate filing deadlines. 

Category 3: Distributed Denial of Service (DDoS) Attacks

Step 1: Understand DDoS Attacks

DDoS attacks on election infrastructure can hinder access to voting information. A DDoS attack occurs when malicious cyber actors flood a public-facing, internet-accessible server with requests, rendering the targeted server slow or inaccessible. This prevents users from accessing online resources, such as web pages and online accounts, and may disrupt an organization’s activities for a period of time, potentially hindering voters’ ability to access voting information or unofficial election results.

For more information on DDoS attacks, please see CISA’s DDoS Quick Guide. 

Additional CISA & Partner Cybersecurity Resources

In addition to this toolkit, CISA offers other election cybersecurity resources, such as guidance documents, reports, infographics, and free basic cyber hygiene tools:

• Election Infrastructure Security webpage. CISA’s primary hub for election security announcements, resources, and materials.
• Free Cybersecurity Services and Tools webpage. A general toolkit of free cybersecurity services compiled by CISA to help critical infrastructure owners and operators further advance their cybersecurity capabilities. 
• CISA Tabletop Exercises Packages. A comprehensive set of resources designed to assist stakeholders in conducting their own exercises.
• Automated Indicator Sharing. Automated Indicator Sharing is a CISA capability that enables the real-time exchange of machine-readable cyber threat indicators and defensive measures.
• Cyber Guidance for Small Businesses. CISA has compiled the top cybersecurity tasks for IT leads and their staff, including enforcing multifactor authentication for all users, keeping systems patched, and monitoring CISA’s Known Exploited Vulnerabilities (KEV) Catalog.

Enhancing the cybersecurity and cyber resilience of U.S. election infrastructure is a partnership; CISA’s election security partners offer the following free resources.

MS-ISAC and EI-ISAC Resources

The Multi-State Information Sharing and Analysis Center (MS-ISAC), and the Elections Infrastructure Information Sharing and Analysis Center (EI-ISAC) provide no-cost services to secure U.S. election infrastructure. MS-ISAC is the trusted resource for cyber threat prevention, protection, response, and recovery for U.S. State, Local, Tribal, and Territorial government entities, and the EI-ISAC supports the rapidly changing cybersecurity needs of U.S. elections offices.

Membership in the Multi-State ISAC is free and open to all state, local, tribal, and territorial government organizations.

Membership in the Elections Infrastructure ISAC is free and open to all state, local, tribal, and territorial government organizations that support U.S. elections.

• EI-ISAC Membership Registration 
• 24/7 Security Operations Center (SOC) and Cyber Incident Response Services 
• SecureSuite Membership
• MS-ISAC Malicious Code Analysis Platform (MCAP)
• MS-ISAC Real-Time Indicator Feeds 
• Albert Network Monitoring

U.S. Election Assistance Commission

• Clearinghouse Resources for Election Officials 

Global Cyber Alliance (GCA)

• The GCA Cybersecurity Toolkit for Elections 

Center for Internet Security

• Election Security Tools and Resources