Strengthening Cyber Defenses for Election Integrity
Arcova helped a county election office improve cybersecurity by assessing risks, testing defenses, and implementing targeted fixes, resulting in stronger cyber maturity, reduced vulnerabilities, and enhanced election system resilience.
Project Information
- Client: Supervisor of Elections
- Services: NIST CSF Assessment, External Penetration Test and Remediation and Support
- Areas of Expertise: Governance, Risk, Compliance, Offensive Testing and Technical Implementation
- Industry: County Government
Challenge
County Supervisors of Elections face mounting cybersecurity challenges as threats continue to evolve. Ransomware, phishing, and supply chain attacks increasingly target voter registration systems and backend infrastructure, while outdated technology and limited budgets hinder modernization efforts. Ensuring secure elections requires balancing open access with strict cybersecurity controls, coordination with state and federal partners, and continuous staff training. With elections designated as critical infrastructure, supervisors must proactively address vulnerabilities, strengthen incident response capabilities, and defend against both domestic and foreign cyber actors seeking to undermine electoral integrity and public confidence.
Solution
Arcova conducted a comprehensive assessment using the NIST Cybersecurity Framework (CSF) and performed an external penetration test to evaluate the county's cyber maturity and identify exploitable vulnerabilities. The assessment provided a structured review of existing policies, controls, and overall risk posture, while the penetration test revealed potential exposure to external threats. Findings were prioritized and mapped to NIST CSF functions to guide risk-based remediation efforts. Arcova then supported the implementation of targeted corrective actions, including patch management, firewall hardening, and policy enhancements, which helped to close gaps and reduce the risk of compromise. Ongoing advisory services ensured that improvements were sustainable and aligned with the county’s long-term cybersecurity objectives.
Impact
Following the NIST CSF assessment and external penetration test, the county achieved measurable improvements in cybersecurity posture. Maturity scores increased from 2.1 to 3.2, reflecting a shift from partial to risk-informed practices. The external attack surface was significantly reduced, with open ports and exposed services being closed. Critical and high-risk vulnerabilities identified during testing decreased through prioritized remediation. Patch compliance reached 100% for internet-facing systems. Phishing susceptibility among staff dropped from 21% to 11%. Overall, the county’s cyber risk decreased, supported by strengthened governance, policy enhancements and technical implementations.
Key Results
Cyber Maturity Improved
NIST CSF maturity score increased from 2.1 to 3.2, reflecting a shift to risk-informed practices.
Attack Surface Reduced
Open ports and exposed services were closed, significantly limiting external threat exposure.
Vulnerability Remediation
Critical and high-risk vulnerabilities identified during testing were addressed through prioritized actions.
Patch Compliance Achieved
Internet-facing systems reached 100% patch compliance.
Phishing Risk Lowered
Staff phishing susceptibility dropped from 21% to 11% following awareness and training efforts.
Sustainable Improvements
Governance, policy, and technical controls were strengthened to support long-term risk reduction.