Case Study
Modernizing Election Systems Against Evolving Threats
Arcova helped a county election office improve cybersecurity by assessing risks, testing defenses, and implementing targeted fixes, resulting in stronger cyber maturity, reduced vulnerabilities, and enhanced election system resilience.
Project Information
Services
NIST CSF Assessment, External Penetration Test and Remediation and Support
Areas of Expertise
Governance, Risk, Compliance, Offensive Testing and Technical Implementation
Sector
Public Sector
The Challenge
Protecting election systems against evolving threats
County Supervisors of Elections face mounting cybersecurity challenges as threats continue to evolve. Ransomware, phishing, and supply chain attacks increasingly target voter registration systems and backend infrastructure, while outdated technology and limited budgets hinder modernization efforts.
Ensuring secure elections requires balancing open access with strict cybersecurity controls, coordination with state and federal partners, and continuous staff training. With elections designated as critical infrastructure, supervisors must proactively address vulnerabilities, strengthen incident response capabilities, and defend against both domestic and foreign cyber actors seeking to undermine electoral integrity and public confidence.
The Solution
Stronger defenses for trusted elections
Arcova conducted a comprehensive assessment using the NIST Cybersecurity Framework (CSF) and performed an external penetration test to evaluate the county’s cyber maturity and identify exploitable vulnerabilities.
The assessment provided a structured review of existing policies, controls, and overall risk posture, while the penetration test revealed potential exposure to external threats. Findings were prioritized and mapped to NIST CSF functions to guide risk-based remediation efforts. Arcova then supported the implementation of targeted corrective actions, including patch management, firewall hardening, and policy enhancements, which helped to close gaps and reduce the risk of compromise.
Ongoing advisory services ensured that improvements were sustainable and aligned with the county’s long-term cybersecurity objectives.
Impact & Key Results
Following the NIST CSF assessment and external penetration test, the county achieved measurable improvements in cybersecurity posture. Maturity scores increased from 2.1 to 3.2, reflecting a shift from partial to risk-informed practices.
The external attack surface was significantly reduced, with open ports and exposed services being closed. Critical and high-risk vulnerabilities identified during testing decreased through prioritized remediation. Patch compliance reached 100% for internet-facing systems. Phishing susceptibility among staff dropped from 21% to 11%.
Overall, the county’s cyber risk decreased, supported by strengthened governance, policy enhancements and technical implementations.
Cyber Maturity Improved
NIST CSF maturity score increased from 2.1 to 3.2, reflecting a shift to risk-informed practices.
Attack Surface Reduced
Open ports and exposed services were closed, significantly limiting external threat exposure.
Vulnerability Remediation
Critical and high-risk vulnerabilities identified during testing were addressed through prioritized actions.
Patch Compliance Achieved
Internet-facing systems reached 100% patch compliance.
Phishing Risk Lowered
Staff phishing susceptibility dropped from 21% to 11% following awareness and training efforts.
Sustainable Improvements
Governance, policy, and technical controls were strengthened to support long-term risk reduction.
What’s New
Our Enterprise Advisory and Management Consulting capabilities span cybersecurity, AI, and adjacent domains with comprehensive services that extend beyond conventional boundaries.
Blog
NERC CIP-002-8 Implications
Transmission owners should begin assessing potential TOCC applicability before the 2028 deadline.
News
Combating Burnout in the Business Continuity Profession
Strategies to prevent burnout while building resilience for others.
News
What Does Day Four Cost? Rethinking How Organizations Measure Resilience
Recovery objectives matter. Knowing the cost of disruption matters more.
News
AI Data Center Development Faces Grid & Community Tests
Why resilient AI data centers require integrated planning across power, security, operations, and community impact.
What’s Next?
Whether you’re modernizing security operations, strengthening resilience, or preparing for AI adoption, we’re here to meet you where you are and help you move forward with confidence.