Free tools Windows power users keep installed
One-click scans. No signup required.
Election systems are best secured through a coordinated program—not by relying on a single voting machine, security product, or audit. Election officials should protect accounts and networks, control physical access, document custody, prepare for disruptions, train staff continuously, and communicate clearly with voters. The exact controls and legal requirements depend on the jurisdiction.
What counts as an election system?
Election security covers the people, facilities, technology, information, and procedures that support election operations. That includes voter-registration data, public election websites, email, voting equipment, election offices and storage sites, staff, and physical election materials. The Cybersecurity and Infrastructure Security Agency (CISA) frames election security as protecting both physical and cyber assets.
As an Amazon Associate I earn from qualifying purchases.
This broad view matters operationally: a disruption to email, a public information site, or a facility can affect election work even if voting equipment itself is untouched. A jurisdiction should identify the systems and resources its essential functions rely on before deciding which safeguards to prioritize.
How should an election office prioritize security work?
There is no single federal ranking that fits every jurisdiction. CISA describes its Cross-Sector Cybersecurity Performance Goals as voluntary baseline practices and a prioritization aid for small and medium organizations, including information technology and operational technology practices aligned with NIST Cybersecurity Framework functions. Use that kind of baseline alongside local requirements, operational needs, staffing, and the election calendar.
#1 Best Overall
- A FIDO security key with PUF technology provides a unique, hardware-rooted trust anchor that resists tampering and cyber attacks, offering stronger security than conventional designs.
- FIDO2 Certified Protection – Enjoy phishing-resistant security with FIDO2 certification, ensuring top-tier account safety across Windows, macOS, Linux, iOS iOS, Android and more.
- Easy to use & Portable – Designed with a compact USB-C interface, Clife key fits easily on your keychain for secure access anywhere. Simply plug in and authenticate with ease.
- Universal Compatibility – Works seamlessly with hundreds of FIDO2/U2F compliant services, including popular cloud, email, and social platforms.
- Backup recommended – To ensure continuous access, register a backup Clife security key as a spare in case your primary key is lost.
| Control area | Risks addressed | Useful evidence of implementation |
|---|---|---|
| Accounts and email | Unauthorized account access and malicious messages | Account settings, access reviews, and staff procedures |
| Networks, endpoints, and software | Malware, unpatched vulnerabilities, and service disruption | System inventories, patch records, scan results, and monitoring |
| Facilities and equipment | Unauthorized physical access, theft, and tampering | Access records, key accountability, inspections, and security procedures |
| Custody, testing, and audits | Unrecorded handling or changes to election materials and equipment | Documented custody steps, test records, and audit documentation |
| Incident response and continuity | Delayed response and interruption of essential operations | Written plans, contact lists, exercises, and recovery arrangements |
| Public communications | Voter confusion and the spread of inaccurate information | Assigned communications roles, prepared channels, and incident updates |
Use the comparison to find gaps, not to treat controls as interchangeable. A written custody record, for example, addresses a different risk than endpoint monitoring. Fit the work to jurisdiction size, staff capacity, existing systems, election timing, and applicable state and local requirements; record how each control will be tested, rehearsed, audited, or reviewed.
How should accounts, email, and access be secured?
Start with identity and access because compromised accounts can expose information or provide a path into other systems. CISA’s Readiness and Resilience Checklist for Election Offices, dated September 6, 2024, recommends account safeguards that election offices can operationalize as follows:
- Enable multifactor authentication (MFA) on accounts, including accounts used by staff and administrators.
- Give every user unique credentials; prohibit credential sharing and remove default passwords.
- Require strong passwords and separate administrator accounts from ordinary user accounts. Use administrator privileges only when the task requires them.
- Use official email accounts for official work, and apply email filtering to help identify or block malicious content. CISA also recommends DMARC, an email-authentication policy that helps reduce spoofing of an organization’s domain.
- Make external-email cues visible to staff, and train employees to pause before acting on unexpected links, attachments, or requests for credentials.
Include these controls in onboarding and account-change procedures. When someone changes roles or leaves, update or remove access promptly; otherwise, the written access policy may not match who can actually reach election systems.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsRank #2
- Tamper Resistant Star Key Set Crafted with premium chrome vanadium steel, and each star tool folds neatly into the handle for quick, easy access.
- Details - The handle is engraved with size for quick identification with drilled tips to allow use.
- Portable - Keys fold compact for easy storage, Drilled tips allow use on tamper resistant security screws.
- Size:Full Size T-6, T-7, T-8, T-9, T-10, T-15 T-20, T-25, T-27 and T-30.
- And with 10 total star sizes able to match nearly all standard tamper resistant security screws on the market.
How should networks, endpoints, and software be maintained?
Inventory the hardware, software, and internet-facing services that support election work. Include systems that may not be voting equipment—such as registration services, election-night reporting, polling-place lookup, and official email—so that patching and monitoring cover operational dependencies rather than only the most visible devices.
- Maintain an inventory: Record systems and software, their owners, and their operational purpose. Review it as equipment or services change.
- Manage software and patches: Set an organization-wide process to track updates, assess vulnerabilities, prioritize remediation, and document completion or an approved exception.
- Scan for vulnerabilities: Use recurring vulnerability scanning to identify weaknesses that need review and remediation. Treat scan results as work items with owners and follow-up, not as a substitute for patch management.
- Monitor endpoints and networks: Consider endpoint detection and response and network monitoring to help identify suspicious activity. Assess DDoS protection for public-facing services where service availability is important.
CISA’s June 18, 2024 Protect Your Election Infrastructure guidance describes protective services, including some options available at no cost to eligible Election Infrastructure Information Sharing and Analysis Center members or participants. Eligibility and service terms can change, so confirm them with CISA before relying on a service. No-cost eligibility does not remove the need to decide whether a service fits the jurisdiction’s systems and operating model.
How should facilities, equipment, and election materials be protected?
Control access to sensitive rooms and equipment, establish facility security plans, and maintain accountability for keys and other access methods. Staff should know how to respond to an access concern and how essential work would continue if a facility were unavailable. CISA’s Physical Security Checklist for Election Offices, dated September 6, 2024, covers physical security planning and continuity considerations.
Rank #3
- HARDWARE 2FA AND MFA: FIDO Alliance Certified FIDO2 v2.1 with CTAP2 plus legacy U2F and CTAP1 for strong two-factor login and passwordless sign-in on services that support security keys
- BUILDING ACCESS ON ONE CARD: MIFARE DESFire EV2 4K applet with AES encryption adds office door and physical access control alongside digital authentication
- CERTIFIED SECURE ELEMENT: An NXP Common Criteria EAL6+ certified secure controller and Java Card platform protects your keys on a tamper-resistant chip
- DUAL INTERFACE SMART CARD: Contactless NFC ISO 14443 plus ISO 7816 contact reader support in an ISO 7810 ID-1 format that is passive and needs no battery
- SWISS ENGINEERED DESIGN: Built by Cryptnox as a single card for authentication and access control and backed by a 2 year warranty
For voting systems, the U.S. Election Assistance Commission (EAC) lists locks, access controls, security cameras, tamper-evident seals, pre- and post-election system testing, and audits among common security measures. These controls support a process; none alone proves that equipment or materials were never accessed or altered.
Make chain of custody a documented process
EAC chain-of-custody guidance, identified as 2021 guidance in its election-security resources, calls for written procedures to be available for public inspection before each election. Document every step in the custody process and review the process after it is completed. The written procedure should match local law and actual handling practices, so staff can follow it consistently and records can be checked afterward.
Tamper-evident seals can help document and detect access to equipment or containers when used within that process. A seal is not proof by itself that tampering did or did not occur. The appropriate seal, its application, recordkeeping, and procurement are governed by local procedures, equipment, and purchasing rules.
Rank #4
- Includes four RD-Series cut keys made to your existing key number for use with your existing RD PACLOCK system.
- Keys only – no padlocks or cylinders included.
- Your unique System Code is required to reorder these additional keys—preventing unauthorized duplication and maintaining control of your system.
- Rotating disc technology delivers high resistance to picking, debris, & is trusted in U.S. military General Field Service Padlocks meeting Federal Specification FF-P-2827A
- PACLOCK’s RD-Series brings high-security rotating disc technology to a wide range of padlock styles—securing containers, trailers, puck locks, jobsite boxes, and more with Every Lock, One Key
How should an office prepare for incidents and interruptions?
Write incident-response and continuity plans before an event. CISA’s September 6, 2024 physical-security checklist recommends planning for response and continuity; its guidance supports assigning responsibilities, identifying contacts, and defining procedures rather than improvising during a disruption.
- Assign response roles and identify who can make operational decisions.
- Keep emergency contacts current, including relevant internal and external partners.
- Define how staff will report a suspected incident, who will assess it, and how response actions will be coordinated.
- Maintain a communications playbook for updates to staff, partners, and voters during an incident.
- Identify essential election functions and plan how to sustain them if a site, system, or service becomes unavailable. Consider backup power or an alternate site when appropriate.
Exercise the plans before they are needed. Rehearsals can reveal unclear responsibilities, outdated contact details, or dependencies that a written plan does not make obvious. Update the plans when systems, staff, facilities, or procedures change.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →How can staff practices keep pace with changing threats?
Operational security (OPSEC) is not a one-time annual review. CISA’s June 2024 Guide to Operational Security for Election Officials describes OPSEC as a continuing cycle of planning, documentation, and training that adapts as threats and tactics evolve.
Best Value
- Type: Key Cabinet Management System
- Touch screen Interface
- Saves up to 250,000 audit events
- 21 robust iFobs
- Compact steel housing
Build security into recurring operational work: train staff for the responsibilities they actually have, document procedures, review changes that may affect risk, and incorporate lessons from exercises or incidents. This helps keep written rules, staff knowledge, and day-to-day practice aligned.
How should officials communicate with voters about security?
Election officials are a primary source of official information about election administration. CISA and EAC’s 2024 guide, Enhancing Election Security Through Public Communications, advises officials to plan communication rather than wait until a confusing or disruptive event forces a response.
- Decide who is responsible for approving and delivering official updates.
- Identify the audiences, formats, and timing that fit the information—for example, routine voter guidance versus an incident update.
- Coordinate with trusted partners that can help amplify accurate information.
- Prepare staff to communicate during an incident and use the communications playbook alongside response procedures.
Clear roles and planned channels make it easier to provide timely, accurate updates without guessing about who should speak or what information voters need.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
