Evaluating System Alignment with Security Requirements

An RFP for any new election system should outline necessary cybersecurity requirements and delineate explicit criteria for evaluating whether a system meets these requirements. Developing clear evaluation criteria can help election jurisdictions better understand whether the cybersecurity requirements outlined in the RFP do, in fact, align with the system’s security needs. This is especially true for systems that utilize the internet to facilitate UOCAVA voting, given the additional protocols and risk mitigation techniques that a vendor must undertake to ensure the system is secure.

Recommendation 4: Jurisdictions should consider developing evaluation criteria to determine whether a software-based system meets the cybersecurity requirements specified in the RFP.

For smaller election jurisdictions or those without dedicated IT or cybersecurity staff, it can be difficult to determine whether a vendor meets the cybersecurity requirements delineated in an RFP. For example, an RFP may require certain encryption standards, but the election jurisdiction may not have the internal expertise to determine whether the respondent does, in fact, meet those standards.

To augment local cybersecurity expertise, election jurisdictions can use existing resources from state, federal and non-profit organizations that are designed to help jurisdictions assess the security of an election system during the procurement process. One available resource for election officials is the CIS Guide for Ensuring Security in Election Technology Procurements, which contains a section explaining what constitutes a “good” response to certain security requirements. For example, to ensure that a new election system meets necessary cybersecurity requirements, CIS recommends that jurisdictions require vendors to outline their processes for identifying and mitigating cybersecurity risks. CIS considers a “good” response to be one that identifies and describes “specific types of risks and the specific actions that were taken to mitigate them. These descriptions should be of a moderate to highly technical nature, referring to specific types of threats or attack vectors, specific port configurations, or the like. The proposer should be able to reference past experience and document their repeatable processes.” The Belfer Center’s State and Local Election Security Playbook also has a section on vendor selection and management (See page 49 of the playbook).

Jurisdictions can also use third-party assessments to provide additional insight into the security posture of the proposed system and help jurisdictions identify whether the system meets the cybersecurity requirements contained in the RFP. For example, the CIS Rapid Architecture-Based Election Verification Program (RABET-V) analyzes non-voting election systems, such as those used to facilitate UOCAVA voting. This includes electronic ballot delivery systems and voter registration databases, among others. RABET-V aims to “provide assurances of security and reliability sufficient for stakeholders to have confidence in their use in election administration.” The U.S. Election Assistance Commission has also created a similar certification program for non-voting election systems called the Election Supporting Technology Evaluation Program (ESTEP). In March 2025, North Carolina became the first state to adopt the ESTEP program’s federal electronic pollbook requirements.

Recommendation 5: Jurisdictions should use existing resources from state, federal and non-profit organizations and third-party assessments to augment local cybersecurity expertise in evaluating whether a software-based system meets the cybersecurity requirements outlined in the RFP.

Mitigating Risks Associated with Internet-Connected Election Systems

Election officials often use the internet to facilitate UOCAVA voting by permitting these voters to request ballots online and, when authorized by state law, accepting voted ballots electronically. Thirty-one states have also authorized some form of electronic ballot return for those voting outside the polling place, whether that be via email, fax or an online portal. The OVI report titled Access to and Usage of Faxing by Military and Overseas Voters provides additional insight into the history and use of faxes by UOCAVA voters.

States, however, do not have total authority over the use of the internet in elections. In some instances, federal law requires election officials to use the internet to facilitate voting. For example, the Military and Overseas Voter Empowerment Act (MOVE Act) of 2009 requires all jurisdictions to be able to transmit blank ballots to UOCAVA voters electronically. Therefore, the use of the internet in specific circumstances is inevitable.

As a result, state and local election officials should take steps to ensure that the proper safeguards are in place to mitigate any potential risks associated with using the internet to facilitate UOCAVA voting. This can, in part, be achieved by requiring vendors to outline certain risk mitigation techniques and related procedures in an RFP. These techniques include ongoing technical, procedural and operational safeguards to help secure internet-connected systems. By requiring vendors to provide this information upfront, jurisdictions can better understand and evaluate the proposed system’s overall security posture before contracting with a vendor.

For example, online portals allowing for blank ballot delivery and electronic return for UOCAVA voters may be susceptible to an attack that could result in a loss of ballot secrecy. However, vendors can mitigate this risk by conducting regular scans for vulnerabilities and misconfigurations within the system’s infrastructure. By requiring vendors to outline such techniques in an RFP, jurisdictions can ensure that the proper safeguards are in place to protect the portal from any potential risks.

Election jurisdictions can read about additional potential risks and risk mitigation strategies for similar systems in The Turnout’s paper on UOCAVA Electronic Ballot Transmission: Recommendations to Mitigate Security Risks. 

Recommendation 6: An RFP for any internet-connected system should require technology vendors to outline ongoing risk mitigation techniques and related procedures that they will undertake to ensure the system’s security.

Using Sandboxing Techniques for Emailed Ballots

When authorized by state statute, email is the most popular method of electronic ballot return used by UOCAVA voters. Jurisdictions can mitigate the potential security risks associated with receiving emailed ballots by including sandboxing capabilities as a security requirement in an RFP.

“Sandboxing” is a cybersecurity term that describes an isolated network environment that allows materials to be received and reviewed without exposing the rest of the network to potentially malicious material. States such as South Carolina and New Jersey have already sought to mitigate the potential risks of using an internet-connected system to transmit and return ballots by implementing sandboxing techniques.

The OVI article How the Adoption of Secure Email Accounts and Sandboxing Techniques Strengthen the Electronic Ballot Return Process for South Carolina’s Military and Overseas Voters details the state’s adoption of these techniques to receive ballots from UOCAVA voters. South Carolina’s success with sandboxing centers around creating secure email addresses for all election officials. These email addresses were set up by the State Election Commission and State Data Center on .gov domains and allowed election officials to access a more secure environment where electronic ballot attachments could be opened securely to identify potential malware or viruses without harming the host device or network. Additional information on the security benefits of .gov domains can be accessed here.

The New Jersey Division of Elections also used sandboxing techniques as part of their “Go Bag” program that created a mobile elections office with many of the supplies needed to continue business operations in the case of a disaster, crisis, or emergency. These “Go Bags” served as a stand-alone workstation, containing a dedicated Chromebook with a sandboxing environment for retrieving and processing UOCAVA ballots returned electronically. More information about New Jersey’s use of “Go Bags” and sandboxing techniques is provided in the OVI article Sandboxes and “Go Bags”: How New Jersey Election Officials Prepare for Crises.

Recommendation 7: Jurisdictions that allow the return of UOCAVA ballots via email should include sandboxing capabilities as a security requirement in an RFP for any new system.

Using Common Access Cards for Digital Signatures

Election jurisdictions can enhance the security of internet transmissions to and from UOCAVA voters by ensuring that any new system can accommodate the use of a U.S. Department of Defense (DOD) Common Access Card (CAC) to capture a digital signature for election-related activities. A DOD CAC is an identification card that is issued to eligible individuals who have completed an extensive background investigation, consisting of a federal background check and a favorable FBI fingerprint check. The card is used to verify the cardholder’s identity through multiple means, including multi-factor authentication.

A CAC has many uses; however, in the context of elections, it allows UOCAVA voters to securely provide a digital signature on election-related materials such as the Federal Post Card Application. This effectively eliminates the need for a voter to provide a wet, or handwritten, signature on documents returned electronically, which often poses an obstacle for UOCAVA voters stationed abroad who lack access to a printer or scanner. In doing so, CAC digital signatures significantly reduce the time needed to request and return documents electronically. These benefits, however, are limited to military voters given that military spouses or overseas citizens are not eligible to be issued a CAC.

More information about how CACs can be used to help accommodate UOCAVA voters can be found in the OVI report Recommendations from the CSG Overseas Voting Initiative Technology Working Group and Using Technology to Enhance Military and Overseas Voting Vol 1. 

Recommendation 8: In an RFP for any new election system, jurisdictions should require the system to accommodate the use of CAC digital signatures for election-related activities such as submitting an FPCA or returning a ballot electronically.

Ongoing Security Procedures

As with any other IT solution, security vulnerabilities can emerge anytime in an election system’s lifecycle. Remedying and protecting a system against these vulnerabilities requires vendors to act quickly and effectively. To do so, technology vendors should conduct ongoing security procedures, including frequent evaluation of the system’s physical and virtual security environments. Jurisdictions can ensure these procedures are in place by outlining the types of ongoing security-related support needed from the vendor in an RFP for any new system. For instance, jurisdictions can require a technology vendor to identify and describe the specific risks they will be monitoring and the ongoing procedures they will follow to mitigate these risks. This can include technical descriptions of each threat and explicit configuration and testing procedures for system functionalities that facilitate UOCAVA voting.

Recommendation 9: An RFP for any new election system should outline the types of security-related support needed from the technology vendor, including ongoing support for configuring and testing system functions that facilitate UOCAVA voting.

When procuring a new election system, election officials often face time constraints that can limit the length and scope of the bidding window and the contract negotiation process. These limitations may require election officials to contract with a vendor whose system does not meet all the functional or security requirements contained in the RFP.

For example, a state or local jurisdiction may need a new electronic ballot delivery system that is fully operational before an upcoming election and the 45-day UOCAVA ballot transmission deadline. Election officials may initiate the procurement process months before this deadline, but the contract must still be finalized in time to test and load ballot styles into the system, among other things. While submitted proposals may account for all the functional requirements, they may not meet all the RFP’s security requirements. Without sufficient time to extend the bidding window or engage in contract negotiations, the jurisdiction may be forced to procure a system that does not adhere to all security requirements delineated in the RFP.

In these circumstances, jurisdictions should not have to forgo security requirements to comply with statutorily mandated deadlines. To help prevent this, states can include language in an RFP requiring a vendor to implement the security features or protocols outlined in the solicitation as part of ongoing support provided to the jurisdiction. This can include any security requirements or protocols that were unaddressed in the vendor’s proposal, including those specific to functionalities that facilitate UOCAVA voting. Jurisdictions can also earmark contract funds for these purposes. An example of language that can be used in an RFP is provided below.

Section X. Scope of Services

X.x. Modifications and Upgrades 

X.x.x. The Contractor shall provide at no additional charge to the [jurisdiction] for the life of the maintenance contract:

1. All software modifications and upgrades that are necessary to comply with changes to local, State, and Federal election laws or Voluntary Voting System Guidelines issued by the United States Election Assistance Commission;
2. All hardware and software modifications necessary to correct defects in the system; and
3. All hardware and software modifications necessary to comply with the system security requirements contained in this solicitation under [relevant section, sub-section].

Recommendation 10: States can include language in an RFP requiring a vendor to implement security features or protocols outlined in the solicitation as part of ongoing support provided to the jurisdiction. This includes security requirements or protocols specific to functionalities that facilitate UOCAVA voting.

Conducting System Maintenance Operations

In addition to security monitoring, ongoing maintenance and patching operations are central to a technology vendor’s ongoing relationship with an election jurisdiction. Patching keeps system software up to date and remedies any identified security vulnerabilities in the system. While applying system patches and conducting software updates, the system’s functionality may be limited. As such, an RFP for any new election system should require vendors to outline their plans and timelines for conducting system maintenance to ensure these operations do not impede a jurisdiction’s ability to meet administrative deadlines.

A vendor’s maintenance plans and timelines must take UOCAVA-specific deadlines into account. Given the difficulties faced by military and overseas citizens when attempting to vote, the Uniformed and Overseas Citizens Absentee Voting Act, as amended by the MOVE Act, requires absentee ballots be sent to UOCAVA voters at least 45 days before a federal election. This requirement applies only to UOCAVA voters. Failing to meet this deadline may impede a UOCAVA voter’s ability to return their ballot in time for it to be counted and included in the final tally. Jurisdictions should ensure that system maintenance and patching operations do not interfere with this deadline.

Recommendation 11: An RFP for any new election system should require technology vendors to outline their plans and timelines for conducting system maintenance to ensure these operations do not prevent a jurisdiction from meeting administrative deadlines, including those specific to UOCAVA voters.