Big Story: How States and Counties Manage Election Cybersecurity
Key Takeaways
Election cybersecurity covers voter registration databases, ballot processing equipment, employee accounts, and the networks that connect local election offices to statewide systems.
Limiting system access, conducting regular phishing training, and maintaining backup procedures can reduce security risks and help election offices continue operating during disruptions.
Statewide cybersecurity standards and shared technical resources can help counties with limited staff and budgets maintain consistent security practices.
Election security involves several interconnected systems that support voter registration, ballot processing, election administration, and results reporting. A disruption to any of these systems can delay operations, interrupt voter services, or prevent election workers from accessing essential information. State and local election offices must therefore manage cybersecurity risks year-round, including periods when elections aren't taking place.
Multnomah County, Oregon, illustrates how technology has changed election administration. The county, which had approximately 592,000 registered voters in October 2026, uses high-speed mail sorters to scan returned ballot envelopes and capture signature images. Automatic signature verification processes some of these signatures, while election workers review the rest. These systems improve processing efficiency but also increase the importance of reliable network access.
The county identifies phishing as a significant cybersecurity concern because a compromised network could disrupt access to the statewide voter registration system. Its central IT department provides cybersecurity training and conducts phishing exercises throughout the year. The elections office also limits email access among temporary workers. Although it employs between 100 and 200 on-call election workers, only about 2% have email access. Restricted accounts allow employees to use necessary applications without accessing unrelated county systems.
Election offices must also prepare for unavoidable disruptions. Paper poll books can replace electronic systems when necessary, while provisional ballots allow voting to continue when registration information is temporarily unavailable. Election officials can report results manually on election night, and paper ballot records support audits, recounts, and verification. These procedures help maintain essential election functions during technical failures or cybersecurity incidents.
Cybersecurity responsibilities also differ across states. In Ohio, the Secretary of State's Office oversees election administration across 88 counties and can establish binding cybersecurity requirements. The state mandates phishing training and maintains a cyber defense team with four regional liaisons, each responsible for 22 counties. The team aims to respond to major cybersecurity incidents within an hour.
These arrangements matter especially for smaller jurisdictions with limited cybersecurity expertise and funding. Shared resources, statewide standards, and coordinated incident response can help counties address common vulnerabilities. Effective election security depends on maintaining reliable systems, controlling access, preparing operational backups, and ensuring that local election offices have the support needed to manage cybersecurity risks consistently.
Free Cybersecurity Assessments and Exercises for State and Local Governments
Fractional Source and Sourcewell Ventures are expanding their cybersecurity pilot to state and local governments, offering free assessments and exercises to help agencies prepare for cyber incidents.
QUICK HIT NEWS
An EY survey of 200 state and local government decision-makers found that 69% have fully implemented AI or are in the process, and 96% of those reported at least one documented benefit. Nearly every respondent had a documented modernization roadmap, and two-thirds reported a positive return on modernization over the past two years. Funding remains the main concern, with 88% worried about dedicated funding for modernization and 89% for AI.
New Mexicoʼs Office of Broadband Access and Expansion is developing a Minimum Digital Living Standard to measure the devices, internet access, and digital skills residents need. The office is taking public comments on the criteria framework until December 9 and expects results and a draft by January 2027. Nearly 23% of New Mexicans lack a desktop or laptop computer, and 42% of households struggle to afford necessities. The standard follows a model first developed in the United Kingdom by the Good Things Foundation and the University of Liverpool.
About 32% of Vermontʼs cities and towns, 78 of 247, have registered a .gov domain, according to a federal registry. Moving to .gov is voluntary in Vermont, while New York requires towns with 1,500 or more residents to keep official .gov websites. Vermontʼs State and Local Cybersecurity Grant Program covers domain registration, website and email migration, and multifactor authentication on a first-come basis while funding lasts. The federal grant spending window closes on November 30.
Veridian at County Farm, a neighborhood in Ann Arbor, Michigan, will become the state's first residential development to operate as a virtual power plant under a two-year pilot approved by the Michigan Public Service Commission. Nearly 100 homes have been built with interconnected Sonnen battery storage, along with rooftop solar, geothermal heat pumps, and electric appliances. DTE Energy will integrate Sonnenʼs software into its grid operating system. The pilot will test whether the neighborhood can avoid substation upgrades, draw almost no grid power at peak times, and disconnect from the grid during outages.
FOR THE COMMUTE
Every cyber threat canʼt be a top priority (The Federal Drive)
In this episode, Greg Touhill, Director of the CERT Division at Carnegie Mellon University's Software Engineering Institute, discusses a new framework for prioritizing cybersecurity research. The framework identifies seven areas that researchers believe require sustained attention because of their potential impact on future national security missions. Touhill explains how cybersecurity leaders can use the framework to evaluate competing challenges and allocate limited research funding, resources, and expertise. The discussion focuses on establishing long-term research priorities when organizations face more cybersecurity threats than they can realistically address at once.
RESOURCES & EVENTS
📅 Making AI Safe for CJIS, HIPAA, and Mission-Critical Data (Virtual - November 10, 2026)
This webinar will examine whether AI tools can meet compliance requirements for criminal justice, health, and other sensitive data. Gerard Gallant of 2G Advisory and Ryan Reynolds of Amazon Web Services will discuss how agencies, cloud providers, and application vendors divide responsibility, along with encryption, access controls, data residency, and human oversight. Moderator Morgan Wright of the Center for Digital Government will guide a discussion on vetting AI providers and detecting unsanctioned AI use before sensitive data is exposed. Details →
📅 Streamlining Government Services (Virtual - November 12, 2026)
Government Technology will host a webinar examining how AI and intelligent document processing can improve public assistance application reviews in state and local government. Speakers Erin Martin, Product Manager at Hyland, and Ryan Kyre, Senior Solution Engineer at Hyland, will demonstrate how agencies can extract information from submitted documents, identify missing evidence, and coordinate application reviews using AI agents. The session will also cover how staff can verify decisions against program guidance, protect sensitive information, and prepare records for public disclosure. Curt Wood, Senior Fellow at the Center for Digital Government, will moderate the discussion. Details →
📊 Report Spotlight: Building a Connected 911 Workflow (AWS)
This paper examines how disconnected systems in 911 centers cause information loss as a call moves from call taker to dispatcher to responder. Each handoff requires staff to summarize, re-enter, or relay details, adding delays and room for error. The paper describes how cloud infrastructure and AI tools can transcribe and translate calls in real time, update incident details as they develop, and keep the original record attached through investigation and closure. It recommends phased modernization that starts with a specific operational problem, includes frontline staff in planning, and builds redundancy across regions, so systems keep working when a component fails.
INSIGHT OF THE WEEK
About one-third of states passed major housing reforms in 2026, and seven of them enacted their first, according to a Pew Charitable Trusts review. North Carolina removed parking mandates across most of the state and now allows apartment buildings up to 60 feet tall on commercial land in certain large cities. Kansas allows homes up to 2,500 square feet on lots as small as 3,000 square feet, and Idaho gave cities two to three business days to act on electrical, plumbing, and HVAC permits. Five states cleared the way for religious groups or nonprofits to build housing on land they own, and New York limited environmental review for most housing in developed areas.
