U.S. Agencies Outline Insider Threat Mitigation for 2026 Election Systems
Summary
DHS, CISA, FBI and EAC guidance for the 2026 election cycle recommends limiting and auditing access, strengthening vendor oversight and chain of custody, training staff, monitoring anomalies, and establishing procedures to assess and respond to insider threats.
Key points
- The guidance addresses risks from intentional and unintentional actions by employees, temporary staff, volunteers, vendors, and contractors with authorized access.
- It recommends least-privilege access, separate contractor accounts, restricting remote vendor access, and having at least two people present during contractor access to critical systems or data.
- Documented procedures, access logs, surveillance, and chain-of-custody records can help deter unauthorized activity and support investigations.
- Suggested safeguards include staff training, risk assessments, anomaly monitoring, audits before and after elections, multifactor authentication, patching, and network segmentation.
- For non-emergency concerns, organizations should gather and document evidence, assess behavior against an individual baseline, and consider restricting access or other interventions; emergencies warrant immediate assistance.
Article Details
- Defense Focus
- Mitigating intentional and unintentional insider threats to U.S. election systems through controlled access, accountable procedures, monitoring, and timely investigation.
- Detection Methods
- Monitor for anomalous behavior using individual behavioral baselines and human and digital review.
- Review access logs, control forms, surveillance video, and chain-of-custody records for unauthorized access, anomalies, or gaps.
- Audit election and business processes before, during, and after elections to identify control or recordkeeping gaps.
- Use risk assessments and documented investigations to evaluate concerns, changes from baseline behavior, and possible movement toward harmful acts.
- Use two-person checks, observers, logs, and checklists to verify compliance with procedures.
- Data Sources
- Physical and digital access logs
- Control forms and checklists
- Security and surveillance video
- Chain-of-custody forms and asset-transfer records
- Endpoint detection and response telemetry
- Reports from staff and the public
- Records of individual baseline behavior and documented investigation findings
- Platforms
- Endpoint detection and response software
- Defensive Actions
- Apply least privilege and limit access to systems, data, facilities, and equipment according to job requirements.
- Restrict or eliminate contractor remote access where feasible; use separate contractor accounts and election-office-managed devices.
- Require appropriate officials to be present when contractors access critical systems or data, with at least two people present.
- Use physical access controls, identifiable badges, surveillance, tamper-evident seals, and two-person or bipartisan procedures for sensitive tasks.
- Maintain and audit standard operating procedures and chain-of-custody procedures.
- Apply zero-trust access verification, multi-factor authentication, timely patching and updates, and network segmentation.
- Train and retrain staff and volunteers on systems, data, and security practices; require codes of conduct.
- Investigate concerns within legal authority; restrict or change access when appropriate and report incidents to relevant authorities.
- Prepare emergency action plans and coordinate facility walkthroughs with local law enforcement.