COMMITTEE SENSITIVE—RUSSIA INVESTIGATION ONLY
- (U) Create guidelines on cybersecurity best practices for elections and a public awareness campaign to promote election security awareness, working through EAC, NASS, and NASED, and with the advisory panel.
- (U) Develop procedures and processes to evaluate and routinely provide guidance on relevant vulnerabilities associated with voting systems in conjunction with election experts.
- (U) DHS has already created a catalog of services they can provide to states to help secure states' systems. DHS should maintain the catalog and continue to update it as it refines its understanding of what states need.
- (U) Expand capacity so wait times for services, like voluntary vulnerability assessments, are manageable and so that DHS can maintain coverage on other critical infrastructure sectors. Robbing resources from other critical infrastructure sectors will eventually create unacceptable new vulnerabilities.
- (U) Work with GSA to establish a list of approved private-sector vendors who can provide services similar to those DHS provides. States report being concerned about "vultures"—companies who show up selling dubious cyber solutions. That being said, some states will be more comfortable having a private sector entity evaluate their state systems than a federal agency.
- (U) Continue to build the resources of the newly established EI-ISAC. States have already found this information sharing service useful, and it could serve as a clearinghouse for urgent threat information. As of August 2018, the EI-ISAC had over 1,000 members with participants in all 50 states.[1]
- (U) Continue training for state and local officials, like the table-top exercise conducted in August of 2018 that brought together representatives from 44 states, localities, and the federal government to work through an election security crisis.[2] The complexity of the scenario encouraged state and local officials to identify serious gaps in their preparations for Election Day.
- 5. (U) Build a Stronger Defense, Part IV: Take Steps to Secure the Vote Itself
(U) Given Russian intentions to undermine the credibility of the election process, states should take urgent steps to replace outdated and vulnerable voting systems. When safeguarding the integrity of U.S. elections, all relevant elements of the government—including at the federal, state, and local level—need to be forward looking and work to address vulnerabilities before they are exploited.
58
COMMITTEE SENSITIVE—RUSSIA INVESTIGATION ONLY
