Background The 8(a) program is designed to assist small, disadvantaged businesses in competing in the American economy through business development. Over the course of the program, qualified small, disadvantaged businesses can receive business development support from SBA, such as mentoring, procurement assistance, business counseling, training, financial assistance, surety bonding, and other management and technical assistance. One of the key areas of support is eligibility for competitive and sole-source federal contracts that are set aside for 8(a) businesses, which can be an important factor of the financial development for ANC-owned firms. Oversight and monitoring of all firms participating in the 8(a) program are delegated to each of SBA’s 68 district offices nationwide. Of its 68 district offices—staff at the Alaska District Office were assigned and oversaw the majority of all participating ANC-owned firms. ANCs and ANC-owned firms have a unique status in the 8(a) program and can enter into complex business arrangements In terms of their organizational structures, ANCs can be either for-profit or not-for-profit and can own a family of for-profit subsidiary firms, including but not limited to, wholly owned holding companies that often provide administrative support to smaller sister ANC-owned firms. As a condition of the 8(a) program, participating ANC-owned firms must be for-profit. Generally, ANC-owned firms can remain in the 8(a) program for up to 9 years, provided they maintain their eligibility. During the first four “developmental” years, participating firms may be eligible for assistance in program areas including sole-source and competitive 8(a) contract support, and training in business capacity development and strategies to compete successfully for both 8(a) and non-8(a) contracts, among other things. In the last 5 years, firms prepare to transition out of the program, and are required to obtain a certain percentage of non-8(a) revenue to demonstrate their progress in developing into a viable business that is not solely reliant on the 8(a) program. SBA Has Faced Long-Standing Weaknesses in Its Oversight and Monitoring of Tribal Firms’ Compliance with 8(a) Program Requirements Across three reports on SBA’s 8(a) program, we have found persistent weaknesses in the oversight and monitoring of participating Tribal firms, in particular ANC-owned firms. Specifically, we found that SBA had (1) incomplete information and documentation on ANC-owned firms’ compliance with regulatory requirements; (2) limitations in its ability to track and share key program data needed to enforce revenue rules of Tribal firms, including ANC-owned firms; (3) insufficient staffing in its Alaska District Office to carry out necessary and critical monitoring tasks of ANC-owned firms; and (4) inadequate program guidance for clearly communicating to staff how to interpret new regulations. Incomplete information and documentation on ANC-owned firms and their compliance with regulations: We reported in 2016 that during a 2014 site visit to the Alaska District Office, we noted that incomplete information and documentation limited SBA’s oversight of the regulatory requirements specific to ANC-owned firms we examined. For example, SBA faced significant challenges in providing us with very basic information on ANC-owned firms, such as the total number of firms serviced by the agency. For example, during the course of our review, it took 3 months for SBA to provide us with a list of ANC-owned firms in the 8(a) program, and on three separate occasions SBA officials provided three separate numbers for the total number of ANC-owned firms— ranging from 226 to 636. We noted in our 2016 report that SBA’s inability to account for and make available principal information on all of the ANC- owned firms participating in the program raises concerns about the integrity of the agency’s internal controls and ability to provide effective and sustained oversight. As another example, we reported in 2016 that SBA was unable to provide seven of 30 required agency offer letters for 8(a) contracts that we requested for our review of contracts that may have been follow-on, sole- source contracts. According to the regulation, these required offer letters are critical documents that could have assisted SBA staff in understanding a contract’s acquisition history and any small business that performed this work prior to any subsequent awards. Once an applicant is admitted to the 8(a) program, it may not receive an 8(a) sole-source contract that is also a follow-on contract to an 8(a) contract that was performed “immediately previously” by another 8(a) program participant (or former participant) owned by the same ANC. We found that SBA’s inability to enforce the regulatory prohibition against follow-on, sole- source contracts was directly tied to the quality of the documentation it collected from contracting agencies. While we found that one program official in the Alaska District Office took steps during our 2016 review to ask agencies to specifically report whether contracts are follow-on, sole- source awards in offer letters, we have no evidence supporting that this practice was more broadly adopted by the program as a whole. Ultimately, we recommended and SBA agreed to enhance its internal controls and oversight of ANC-owned firms in the 8(a) program by ensuring that all ANC-owned firm files contain all relevant documents and information and providing additional guidance and training to SBA staff on the enforcement of related policies, among other things. Limitations in tracking and sharing key program data needed to enforce 8(a) revenue rules: In all three reports mentioned in this testimony, we found that SBA faced limitations in tracking information on the primary revenue generators for Tribal firms, including ANC-owned firms, to ensure that multiple firms under one parent ANC are not generating their revenue in the same primary line of business—that is, expressed as and operating under the same North American Industry Classification System (NAICS) code—which SBA’s regulation intends to limit. As discussed later in this testimony, we first identified this issue in our 2006 report, noting that SBA was not effectively tracking ANC-owned firms’ revenue data to ensure that the sister firms were not generating the majority of revenue in the same line of business. We recommended that SBA collect information on the participation of 8(a) ANC-owned firms as part of required overall 8(a) monitoring, to include tracking the primary revenue generators for ANC-owned firms and to ensure that multiple subsidiaries under one ANC are not generating their revenue in the same primary line of business. Then in our 2012 report, we found that SBA had not addressed this limitation and recommended that SBA develop a system that had the capability to track revenues from ANC-owned firms’ primary and secondary lines of business to ensure that ANC-owned firms under the same parent ANC are not generating the majority of their revenue from the same primary line of business. In our 2016 report, we found that SBA still had not developed such a system and thus was not effectively tracking and sharing the type of revenue information needed to ensure 8(a) ANC-owned firms are following the intent of 8(a) revenue rules. For example, we found that without such a system, sister ANC-owned firms owned by the same ANC could circumvent the intent of the prohibition. In particular, one sister ANC-owned firm could generate a greater portion of revenues under its secondary line of business that another sister ANC-owned firm is using as its primary line of business. Although this type of activity is not prohibited, we determined that if such activity is left untracked, a firm’s secondary line of business could effectively become its primary revenue source in the same line of business that its sister firm claims for its primary line of business without actually violating SBA’s regulation. During our 2016 review, we found 5 pairs of ANC-owned firms participating in the 8(a) program from fiscal years 2011 through 2014 that concurrently generated millions of dollars in the same line of business as their sister ANC-owned firm’s primary line of business, while generating less or no revenue under their own primary line of business. As we found then, such activity could, intentionally or not, potentially circumvent the intent of SBA’s prohibition, and as discussed later, we recommended that SBA take action to prevent ANC-owned firms from circumventing this rule. Figure 1 below illustrates one example we reported on in our 2016 report. Insufficient staffing levels in SBA’s Alaska District Office: In our 2006 report, we noted that SBA lacked adequate staffing levels in the Alaska District Office—a district office responsible for the oversight of the majority of ANC-owned firms. Our reports, and a 2008 report issued by the SBA’s Office of the Inspector General, have shown that inadequate staffing was a long-standing challenge and a consistent weakness that directly contributed to SBA’s inability to provide adequate oversight. In our 2012 report, we noted that ANC-owned firms could quickly outgrow the program. It should be noted that we recommended that SBA evaluate its staffing levels in 2006, and in our 2016 report, we found that the staffing challenges persisted. As a result, we found that SBA needed a sustained and comprehensive approach to staffing its Alaska District Office in order to conduct sufficient oversight of ANC-owned firm activities. We were told that frequent staff turnover directly contributed to the limited number of staff in the Alaska District Office with ANC firm expertise—limiting their ability to conduct effective and timely oversight of the ANC-owned firms participating in the program. An SBA official told us at the time that the optimum number of staff for the Alaska District Office was five with no more than 100 assigned 8(a) firm files each; however, that office had 1.5 staff responsible for about 200 files each. We found, based on SBA documentation and observation during our site visit to Alaska that, because of this staffing shortage, supervisory review of contract monitoring activities and annual reviews fell behind, resulting in a backlog of oversight duties related to ANC-owned firms. In 2016, we found that SBA took some short-term actions to address the issues that we identified, such as temporarily redistributing the management of ANC-owned firm files across several other district offices and within the Alaska District Office. As for long-term action, SBA officials provided us with documentation describing the program’s long-term staffing strategy, which included succession planning and managing attrition. For example, SBA planned to hire four additional BOS, and an attorney who understands ANCs. At that time, SBA began implementing its staffing strategy by hiring additional business opportunity specialists for its Alaska District Office. However, we have not evaluated whether the agency implemented the remainder of its strategy for succession planning and managing attrition. Inadequate program guidance: We reported that SBA lacked program guidance that could have assisted the Alaska District Office in improving staff’s knowledge of program rules and monitoring practices. We initially raised our concern about the need for strong guidance in 2006 given the unique status in the 8(a) program and relationships entered into by ANC- owned firms. For our 2012 report, SBA officials told us that it was in the process of updating its program guidance for the program. However, in our 2016 report, we similarly found that staff lacked sufficient guidance and training on key program regulations and internal monitoring practices, and concluded that resulting inconsistent supervisory review of ANC transactions and related documentation increased SBA’s vulnerability to compliance and fraud risks. Several months after we issued our report in 2016, SBA issued updated standard operating procedures on program rules that address the 2011 regulatory changes related to sister ANC-owned firms receiving follow-on, sole-source contracts and sister subsidiaries sharing primary NAICS codes. In addition to updating the guidance, SBA also provided training to its Alaska District Office staff on its 2011 regulations, specifically training on prohibitions against follow-on sole source contracts. SBA officials also told us in 2016 that staff in the Alaska District Office were provided training in supervisory review and other critical file management procedures, which we noted were weaknesses. SBA Has Not Yet Implemented Some Key Recommendations to Address Oversight and Monitoring Weaknesses To address the weaknesses described above, as well as others related to oversight and monitoring, our 2006, 2012, and 2016 reports contained a total of 21 recommendations to SBA. While SBA has fully implemented 15 of these recommendations, SBA has not implemented six recommendations—three of which we highlight in this statement. All six recommendations are important to enhancing SBA’s oversight of ANC-owned firms in the 8(a) program. We have not evaluated the operational effectiveness of SBA’s actions to implement the 15 recommendations, but if effectively implemented, those actions should help SBA improve its oversight and monitoring of ANC-owned firms in the 8(a) program. In response to our recommendations, SBA’s actions included providing training to its staff that emphasized regulations governing the requirement for procuring agencies to specifically state whether a contract is a follow-on contract in their offer letters, which could help reduce the award of a follow-on, sole-source contracts to sister ANC- owned firms; developing and enacting a regulation that gives SBA the authority, under certain circumstances, to change an ANC-owned firm’s primary line of business (expressed as a NAICS code) to the NAICS code that generates the greatest portion of the firm’s revenue; this action is intended to help SBA enforce rules preventing sister ANC-owned firms from operating in the same primary lines of business; and updating and providing written guidance to field staff officials on the enforcement of follow-on sole-source contract regulations. However, to date SBA has not provided us with evidence that it has implemented the three following recommendations, which if implemented as intended, could significantly improve its oversight of the 8(a) program. Absent action on these recommendations, SBA exposes the program to continued noncompliance. Tracking revenue data and other information on 8(a) ANC-owned firms: As previously discussed, SBA’s regulation prohibits ANCs from owning multiple firms that operate under the same primary line of business (expressed as a primary NAICS code). In each of our 2006, 2012, and 2016 reports we identified weaknesses in SBA’s ability to track this information in order to prevent sister ANC-owned firms from violating this rule or circumventing its intent. As a result, in 2006 we recommended that SBA track the primary revenue generators for ANC-owned firms and to ensure that multiple subsidiaries under one ANC are not generating their revenue in the same primary line of business, among other things. Similarly, in 2012 we recommended that, as SBA is developing a tracking system, it should take steps to ensure that the system tracks information on ANC-owned firms, including revenues and other information. In 2006 and 2012, SBA did not indicate whether it agreed with and intended to implement these recommendations. However, during our 2016 audit, SBA informed us that it had plans to address this issue, but could not provide any details. We therefore recommended in 2016 that SBA document this planned method for tracking revenue generated under subsidiaries’ primary and secondary lines of business. SBA agreed to implement this 2016 recommendation. As part of this recommendation, we stated that SBA’s documentation should include milestones and timelines for when and how the method will be implemented. We also recommended that SBA provide the appropriate level of access to and sharing of relevant subsidiary data across district offices, including primary and secondary lines of business and revenue data, once SBA develops a database with the capabilities of collecting and tracking these revenue data. In August 2018, SBA informed us that regulations promulgated in 2016 allow it to change an 8(a) ANC-owned firm’s primary line of business under certain circumstances if the greatest portion of the firm’s revenues evolved from one line of business to another. In our 2016 report, we concluded that the new regulations were a step in the right direction but would be difficult to implement effectively without the proper tracking and visibility of revenue data that we describe above and in our 2016 report. In 2018, SBA officials noted that they were testing an analytics tool that, they said, would allow them to track revenues for ANC-owned firms, as we recommended. SBA’s estimated completion date for the evaluation and implementation of this tool was December 31, 2018, but as of October 2019, SBA has not been able to provide documentation on whether this action has been implemented. We will continue to monitor SBA’s efforts to implement this recommendation. Criteria thresholds for contract modifications: As we reported in 2006, SBA regulation requires that when the contract execution function is delegated to the procuring agencies, these agencies must report to SBA certain 8(a) information, including contract modifications. Further, the agreements between SBA and the procuring agencies that we reviewed in 2006 require that the agencies provide SBA with copies of all 8(a) contract modifications within 15 days of the date of the contract award. However, in our 2006 report, we found that contracting officers were not consistently following these requirements. While some had notified SBA when incorporating additional services into the contract or when modifying the contract ceiling amount, others had not. Hence, we recommended that when revising relevant regulations and policies, the SBA Administrator should revisit the regulation that requires agencies to notify SBA of all contract modifications and consider establishing thresholds for notification. In 2006, SBA disagreed with this recommendation and thus had not revisited this regulatory requirement, but rather reiterated a preexisting requirement to provide all contract modifications, including administrative modifications, to SBA. We determined that this action did not fulfill our recommendation as it does not help to ensure that agencies are going to comply with the regulatory requirement. Small businesses potentially losing contracts to 8(a) ANC-owned firms: In our 2006 report, we found SBA’s oversight had fallen short in that it did not consistently determine whether other small businesses were losing contracting opportunities when large, sole-source contracts were awarded to ANC-owned firms. Further, we found cases where SBA did not take action when incumbent small businesses lost contract opportunities when ANC-owned firms were awarded a large sole-source contract. Hence, we recommended, that when revising relevant regulations and policies, the SBA Administrator should consistently determine whether other small 8(a) businesses are losing contracting opportunities when awarding contracts through the 8(a) program to ANC- owned firms. SBA did not agree with this recommendation, nor did it address the intent of this recommendation by developing a procedure to consistently perform this action. Instead, SBA reported to us that in 2009 it performed a single analysis of a limited set of procurement data from a limited period and concluded the data did not indicate that other small 8(a) firms (e.g., small businesses which are unconditionally owned and controlled by one or more socially and economically disadvantaged individuals, such black-owned and Hispanic-owned firms) were losing contracting opportunities to ANC-owned firms. We continue to believe that without a strategy for consistent monitoring of this issue, SBA is limited in determining the extent to which other small 8(a) businesses are being adversely impacted by contracts awarded to ANC-owned firms. In summary, the findings I have described in my statement today have persisted over time as SBA has struggled to articulate and execute an effective overall monitoring and oversight strategy. Implementing our remaining recommendations could help SBA address its monitoring and oversight control weaknesses in a comprehensive manner. Chairwoman Chu, Ranking Member Spano, and Members of the Subcommittee, this completes my prepared statement. I would be pleased to respond to any questions that you may have at this time. GAO Contact and Staff Acknowledgments For further information regarding this testimony, please contact Seto J. Bagdoyan, (202) 512-6722 or bagdoyans@gao.gov. In addition, contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this statement. Individuals who made key contributions to this testimony are: Latesha Love (Assistant Director), Tatiana Winger (Assistant Director), Flavio Martinez (Analyst in Charge), Carla Craddock, April VanCleef, Tracy Abdo, Marcus Corbin, Colin Fallon, Julia Kennon, Barbara Lewis, Michele Mackin, Maria McMullen, James Murphy, Anna Maria Ortiz, William Shear, and Erin Villas. This is a work of the U.S. government and is not subject to copyright protection in the United States. The published product may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately.


Background The Administration of State and Federal Elections Involves Various Roles, Responsibilities, and Processes In the United States, authority to regulate elections is shared by federal, state, and local officials. Congressional authority to regulate elections derives from various constitutional sources, depending on the type of election. In addition, Congress has passed legislation in major functional areas of the voting process, such as voter registration and prohibitions against discriminatory voting practices. However, responsibility for the administration of state and federal elections resides at the state level. States regulate various aspects of elections including, for example, registration procedures, absentee and early voting requirements, and Election Day procedures. Within each state, responsibility for managing, planning, and conducting elections is largely a local process, residing with about 10,300 local election jurisdictions nationwide. Some states have mandated statewide election administration guidelines and procedures that foster uniformity in the way their local jurisdictions conduct elections, whereas other states have guidelines that generally permit local election jurisdictions considerable autonomy and discretion in the way they run elections. The result is that elections can be administered differently across states and local jurisdictions. Unless states require otherwise, local jurisdictions generally have discretion over activities such as election officials’ training and, in most states, the selection and purchase of voting technology. Among other things, local election officials register eligible voters; educate voters on how to use voting technology; provide information on the candidates and ballot measures; recruit, train, organize, and mobilize poll workers; prepare and test voting equipment for use; and count ballots. The election process is composed of pre-election, Election Day, and post-election activities: Pre-election activities include providing opportunities for eligible individuals to register to vote, maintaining and updating the voter registration database, recruiting and training poll workers, selecting polling locations, preparing voting materials, testing equipment, qualifying candidates for office, and administering absentee and vote-by-mail voting processes. Election Day activities include opening and closing polling places, setting up voting machines and voting booths, checking in voters and verifying registration status, and providing opportunities for voters to mark and cast ballots. Post-election activities include securing equipment and ballots, transferring physical ballots or records of vote counts to a central location for counting, determining the outcome of the election, publishing unofficial results, certifying official election results, and performing recounts, if required. Election Infrastructure Relies on Various Components and Assets and Is Susceptible to Threats The election process relies on various assets—such as information technology systems, networks, equipment, and facilities. These assets can be broadly categorized as physical, cyber, and human components of the Election Infrastructure Subsector, as described in table 1. Physical, cyber, and human assets comprising the election infrastructure are susceptible to unintentional and intentional threats. As we have previously reported, unintentional, or nonadversarial, threat sources include equipment failures, software coding errors, or the accidental actions of employees (human errors). Threat sources also include natural disasters and other events that can cause failure within sectors on which the election infrastructure is dependent, such as power grid failures in the energy sector. Intentional, or adversarial, threats can involve targeted and untargeted attacks from a variety of sources, including criminal groups, hackers, disgruntled employees, foreign nations engaged in espionage and information warfare, and terrorists. These adversaries vary in terms of the capabilities of the actors, their willingness to act, and their motives, which can include seeking monetary gain or pursuing an economic, political, or military advantage. Appendix I lists general cybersecurity threat sources that can impact information technology systems that support the election infrastructure. Cyber adversaries may make use of various techniques, tactics, and practices—or exploits—to adversely affect an organization’s computers, software, or networks, or to intercept or steal valuable or sensitive information. These exploits are carried out through various conduits, including websites, email, wireless and cellular communications, internet protocols, portable media, and social media. Further, adversaries can leverage common computer software programs, such as Adobe Acrobat and Microsoft Office, to deliver a threat by embedding malware or other exploits within software files that can be activated when a user opens a file within its corresponding program. DHS and others have identified general cyber and physical threats that are applicable throughout the election process. For example, voting equipment may be susceptible to a supply chain attack in which the malicious actor may use the voting equipment vendor as a pathway to plant malware to modify or compromise ballot definition files before they reach the hands of election officials. Also, the absence of or lack of consistent physical access controls, auditable chain of custody procedures, or vendor installed countermeasures may allow malicious actors or well-placed insiders to manipulate voting equipment and ballots at any stage of the process through unauthorized physical access. In addition, there are certain physical and cyber threats that are applicable to individual assets and stages in the election process. Figure 1 provides examples of threats to various assets and stages in the election process. Additionally, DHS has analyzed and identified common cybersecurity vulnerabilities associated with enterprise networks and voter registration systems supporting election infrastructure that could apply to multiple assets at all stages of the election process. Such vulnerabilities include user susceptibility to malicious email, outdated software patches, the use of default system configurations, passwords that are weak or presented in clear text, and the use of operating systems with known weaknesses that have not been properly addressed. DHS, through CISA, Is the Lead Federal Agency for the Election Infrastructure Subsector Presidential Policy Directive 21, issued in February 2013, shifted the nation’s focus from protecting critical infrastructure against terrorism to protecting and securing critical infrastructure and increasing its resilience against all hazards, including natural disasters, terrorism, and cyber incidents. The directive identified 16 critical infrastructure sectors and outlined roles and responsibilities for protecting these sectors. Further, the directive established sector specific agencies as the federal entities responsible for providing institutional knowledge and specialized expertise to facilitate or support federal, state, and local governments, as well as private sector entities, in protecting critical infrastructure. The National Infrastructure Protection Plan, updated by DHS in December 2013, further integrates critical infrastructure protection efforts between government and private sectors, among other things. It describes a voluntary partnership model as the primary means of coordinating government and private sector efforts to protect critical infrastructure. As part of the partnership structure, the designated sector-specific agencies serve as the lead coordinators for the security programs of their respective sectors. In accordance with the National Infrastructure Protection Plan, the National Protection and Programs Directorate within DHS was designated the sector-specific agency, or lead federal agency, for the Election Infrastructure Subsector. CISA subsequently assumed the role of sector-specific agency upon its establishment as the successor to the Directorate in November 2018. As the lead agency for the Election Infrastructure Subsector, CISA is responsible for coordinating partnership activities and information sharing and is the primary federal interface with the subsector’s stakeholders with respect to security. The Election Security Initiative, part of CISA’s National Risk Management Center, is responsible for managing the agency’s election subsector partnerships. To implement the voluntary partnership model, the subsector created two complementary coordinating councils—one for governments and one for private sector partners—to facilitate partnerships to support election infrastructure. Specifically, the Election Infrastructure Subsector Government Coordinating Council, created in October 2017, enables federal, state, and local governments to share information and collaborate on best practices to mitigate and counter threats to election infrastructure. The council is composed of 27 members, which include three voting members from the federal government—specifically one from DHS and two from the Election Assistance Commission (EAC)—and 24 from state and local governments. The Federal Bureau of Investigation (FBI), EAC, and National Institute of Standards and Technology (NIST) coordinate with each other, with CISA, and with state and local governments through the Election Infrastructure Subsector Government Coordinating Council. Additionally, the Subsector Coordinating Council was chartered in February 2018 and includes private sector entities whose services, systems, products, or technology are used by or on behalf of state or local governments in administrating the U.S. election process. The Election Infrastructure Subsector Specific Plan outlines actions that CISA, as the sector-specific agency, the Government Coordinating Council, and the Subsector Coordinating Council will take to support election infrastructure. Other Federal Agencies Also Have Key Roles in the Election Infrastructure Subsector Within the Department of Justice, the FBI supports the Election Infrastructure Subsector by countering foreign influence operations and collecting and processing threat information on election infrastructure. This effort is headed by the FBI’s Foreign Influence Task Force, which integrates the agency’s cyber, counterintelligence, counterterrorism, and criminal law enforcement resources to better understand threats posed by foreign influence operations. Among other things, the task force investigates cyber operations targeting election infrastructure or public officials, and covert influence operations designed to influence public opinion and sow division through disinformation and misinformation on social media. The FBI exchanges threat information with CISA and other federal partners to help states and local jurisdictions detect and prevent operations targeting the election infrastructure. Further, the EAC supports the Election Infrastructure Subsector by carrying out its responsibilities under the Help America Vote Act. Specifically, the EAC develops voluntary voting system guidelines and oversees the testing and certification of voting systems. Under the Help America Vote Act, the EAC works through the Technical Guidelines Development Committee to establish a set of principles, guidelines, and requirements specifying how voting systems are to meet standards of functionality, accessibility, and security. The EAC has also provided states with operational grants to replace voting systems. According to the Acting Executive Director of EAC, states also used the grants to increase the security of election systems, such as voter registration systems, and apply other cybersecurity enhancements. Additionally, the EAC and CISA have collaborated to develop select initiatives—such as web-based training for election officials—to expand outreach to states and local jurisdictions. NIST supports the Election Infrastructure Subsector by conducting research to develop and provide standards, tests, guidelines, best practices, and lab accreditation assistance that EAC and states and local jurisdictions may use at their discretion. The Director of NIST chairs the Technical Guidelines Development Committee. At the request of the Committee, the Director of NIST provides technical support for the Committee to carry out its duties, such as by participating in election and constituency working groups to provide technical leadership in support of the development of voluntary voting system guidelines. NIST also helps election officials identify and prioritize opportunities to improve their cybersecurity posture. For example, it established a joint working group with the Election Infrastructure Subsector Government Coordinating Council and Subsector Coordinating Council to develop a framework of cybersecurity practices tailored to elections. In doing so, NIST works with the election community to identify the resources and outcomes needed to ensure the security of the election infrastructure. As part of this effort, it receives feedback from states and local jurisdictions, as well as from CISA, through the Election Infrastructure Subsector Government Coordinating Council. DHS Provides Services to States and Local Election Jurisdictions, and Selected Election Officials Reported Being Satisfied with DHS’s Assistance DHS, through CISA, has taken steps to assist election officials in securing election infrastructure by providing services in three areas: regional support and assistance, education and awareness, and information sharing and analysis among federal, state, and local organizations. Appendix II provides a list of the services that CISA makes available to states and local election jurisdictions. Regional support and assistance. CISA employs personnel with cyber and physical security expertise in its 10 regional offices throughout the country. According to CISA, as of November 2019, these experts included 24 cybersecurity advisors and 100 protective security advisors who perform and coordinate security assessments for the 16 critical infrastructure sectors, including the Election Infrastructure Subsector. A single advisor may be responsible for performing and coordinating assessments for an entire state or region and across multiple critical infrastructure sectors. The cybersecurity advisors and protective security advisors consult with state and local election officials and identify services that CISA can provide on a voluntary, no cost basis. For example, according to CISA Election Security Initiative officials, cybersecurity advisors and protective security advisors have promoted CISA services and assessments, such as an assessment of network security vulnerabilities and an assessment of risks associated with information and communication technology suppliers and service providers. In addition, protective security advisors have conducted physical inspections of the protections over facilities that store election-related equipment such as voting machines or poll books. Protective security advisors told us that they also provide a web-based tool that states or local jurisdictions can use to identify security gaps and preparedness across facilities. CISA officials stated that, although regional personnel promote cybersecurity and physical security services to election officials, personnel based at CISA headquarters conduct the more advanced cybersecurity assessments. For example, the Vulnerability Management Branch provides vulnerability scanning and risk and vulnerability assessments, while the Threat Hunting Branch responds to cyber incidents. In September 2019, officials from the Election Security Initiative told us that, based on the CISA Director’s guidance, the agency gives requests from election infrastructure stakeholders a higher level of priority than requests from the other sectors. The precise length of the wait for service depends on the type of service. For some services, such as vulnerability scanning, there is no wait time, according to CISA officials, because CISA can activate the service within 24 hours. Education and awareness. CISA disseminates educational materials to raise awareness of election security-related issues and services available to state and local election officials. For example, CISA provides a web- based training course to help election officials understand the principles of information technology management and has developed guidance to help states and localities adopt recommended information technology practices to improve their security posture. According to CISA, as of November 2019, 1,201 individuals had completed the online course. Further, CISA conducted two election infrastructure tabletop exercises known as “Tabletop the Vote” in August 2018 and June 2019 to help the Election Infrastructure Subsector community collaborate and identify best practices and areas for improvement in election-related cyber incident planning, identification, response, and recovery. The 2018 tabletop exercise included 44 states, the District of Columbia, 16 federal entities, the National Association of Secretaries of State, and the National Association of State Election Directors. According to CISA officials, the June 2019 exercise included 47 states, the District of Columbia, 15 federal entities, the National Association of Secretaries of State, the National Association of State Election Directors, the National Governors Association, and the National Conference of State Legislatures. CISA officials also noted that CISA personnel, including regional personnel, have presented at numerous national and state meetings of election officials, such as the Election Center’s annual conference in August 2019. In addition, as part of CISA’s Last Mile initiative, the agency collaborates with state and local election officials to create customized posters that highlight efforts to strengthen election security. The purpose of the posters is to describe the state’s or local jurisdiction’s election infrastructure assets and systems, characterize risks, and offer specific measures it should implement to mitigate those risks. Election officials can present the posters to voters, lawmakers, and their own personnel to bolster confidence in the security of their election systems. As of November 2019, CISA reported that it had delivered Last Mile posters to 19 states (including six states since the 2018 election) and 1,202 local election jurisdictions. Information sharing and analysis. CISA collects and analyzes election security-related information—such as threat indicators, incident alerts, and vulnerability data—and shares this information with election officials to help them assess cybersecurity controls, detect threats, and mitigate risks. To further this goal, CISA partnered with the Center for Internet Security and the Election Infrastructure Subsector Government Coordinating Council to create the Election Infrastructure Information Sharing and Analysis Center (EI-ISAC) in February 2018. State and local election offices can join the EI-ISAC at no cost and receive election-focused cyber defense tools and products. According to the Director of the EI-ISAC, as of November 2019, its members included 50 states, the District of Columbia, and 2,267 local jurisdictions. CISA officials stated that the EI-ISAC is the primary mechanism that CISA uses to exchange information throughout the election community. For example, the EI-ISAC produces a quarterly threat report to assist the election community in the analysis of active information security threats. From its inception through September 2019, the EI-ISAC had sent out 263 alerts to its members, including weekly, spotlight, and other emails, according to EI-ISAC officials. EI-ISAC officials added that CISA funds the EI-ISAC to, among other things, deploy an intrusion detection sensor in each state specifically for voter registration systems and other supporting infrastructure to detect malicious activity and provide network security alerts. CISA officials stated that the agency, in coordination with the EI-ISAC, analyzes data from these sensors to identify trends in threats and vulnerabilities across states and local jurisdictions. CISA also manages the National Cybersecurity and Communications Integration Center (NCCIC), which receives reports of suspected malicious cyber activity from state and local officials, analyzes attempts to infiltrate election systems, and shares information about threats and vulnerabilities through the EI-ISAC. The NCCIC has also assisted election officials in responding to incidents, upon request. According to CISA officials, in fiscal years 2018 and 2019, NCCIC’s Hunt and Incident Response Teams provided services to 10 states and 16 local election jurisdictions, such as incident response activities and proactive reviews for malicious activity at the time of service. Table 2 identifies selected services that CISA provided to states and local jurisdictions in 2018 and 2019, as of November 6, 2019. Selected Election Officials Are Generally Satisfied with DHS’s Election Security Assistance and Identified Various Benefits and Challenges State election officials with whom we spoke were generally satisfied with CISA’s support to secure their election infrastructure. Specifically, officials from seven of the eight states we contacted said that they were very satisfied with CISA’s election-related work, while officials from the eighth state said that they were somewhat satisfied. Officials from five states told us that their relationship with CISA had improved markedly since early 2017, when the elections subsector was established. For example, state officials said that CISA has made progress in this area. The Secretary of Homeland Security’s designation of elections as critical infrastructure was initially controversial among state and local officials. For example, in February 2017, the National Association of Secretaries of State voted to oppose the designation of elections as critical infrastructure, citing the states’ constitutional authority to regulate elections. In addition, CISA officials told us that a lack of trust and communication between DHS and state and local election officials hindered initial efforts to establish the Election Infrastructure Subsector. However, officials from one state told us that, despite initial reservations about DHS’s role in election security, CISA has become a good partner over time. An official from another state expressed appreciation that CISA appears to be honestly and earnestly working to gain states’ trust. Officials representing the National Association of Secretaries of State and the National Association of State Election Directors also stated that CISA had worked to improve its relationships with state election officials. According to these officials, CISA has expanded outreach efforts by attending state association meetings and conferences to present information on CISA’s resources and the threat environment and has impressed election officials with the level of detail provided by CISA’s threat reporting. An official from the Election Center, which represents local election officials, stated that CISA officials attend every cybersecurity and critical infrastructure event hosted by the center. CISA officials stated that, while it is not possible to meet individually with all of the local election jurisdictions nationwide, it can engage with multiple local election jurisdictions at one time at these association conferences. Selected State and Local Election Officials Reported Benefits from CISA’s Efforts Election officials from selected states and local jurisdictions cited various benefits from CISA’s support to election security. According to officials from six states, CISA’s involvement in election security has increased the officials’ understanding of the threat environment that the election community faces. They also said that CISA’s involvement has helped them to plan for cybersecurity threats and to prioritize their election security efforts. For example, officials from one state said that CISA recommended that the state set priorities and focus on risk assessments and network segmentation. In addition, election officials from five states spoke highly of CISA’s expertise and availability. The officials said, for example, that CISA regional and headquarters personnel were easy to get in touch with and knowledgeable about the election community. As a result, the officials said that they had better access to training opportunities and informal advice. Further, officials from each of the eight states spoke positively about the information that the officials received from the EI-ISAC. For example, state officials said that the EI-ISAC updated them regularly on election security incidents and vulnerabilities nationwide, allowing them to prepare for potential incidents. Officials also stated that the EI-ISAC presented the information in a way that was understandable to election administrators who may not have backgrounds in information technology. For example, in a monthly “spotlight” email, the EI-ISAC defines a key cybersecurity term and explains to the election officials why it should matter to them. One official told us that through membership in the EI-ISAC, the state has learned about election security best practices from other states, and other officials said that EI-ISAC allows them to maintain visibility of nationwide threats and other election security issues. Officials from one state said that their contacts through the EI-ISAC helped them to identify a point of contact at social media companies so that they could inform the companies about election-related misinformation being spread online. In addition, election officials from two states said that they have encouraged or required local election jurisdictions to enroll in the EI-ISAC. According to EI-ISAC officials, the number of local election jurisdictions enrolled in the EI-ISAC increased from 1,384 at the end of 2018 to 2,267 in November 2019, and included all three election jurisdictions that we contacted. Officials from two of the three local jurisdictions said that the EI-ISAC emails were valuable. For example, election officials from one local jurisdiction said that communication from the EI-ISAC is meaningful and targeted to bolster their election security efforts. Election officials from the other jurisdiction said that they use the EI-ISAC information to improve their continuity of operations plans. On the other hand, officials from the third local jurisdiction said that the information provided in EI- ISAC emails was too general and not specific enough to their circumstances. Election officials from five states also spoke positively of the EI-ISAC situational awareness chat rooms, which DHS hosted on its Homeland Security Information Network. These officials stated that they participated in and monitored the chat rooms on Election Day to maintain awareness of any emergent election security issues nationwide. For example, officials from one state said that the chat rooms helped them receive real time notification of issues in other states and possible solutions to those issues. In addition, as previously mentioned, one of CISA’s major efforts was the 3-day tabletop exercises held in August 2018 and June 2019, which state and local officials were able to attend remotely by video teleconference from sites around the country. Elections officials from five states said that the exercises conveyed important information and prompted thoughtful discussions among state and local officials. Election officials from four states said that the exercises helped them build relationships within their states, and election officials from three states also said the exercises helped to build relationships with federal agencies as well. In addition, officials from four states said that they conducted or were planning to conduct tabletop exercises modeled on CISA’s exercises. Election officials from three states said that CISA’s cybersecurity assistance has helped them to assure voters that elections in their states are secure or to promote election security efforts. For example, officials from one state said that, when they get questions from the public about election security, they tell voters that CISA’s assessments have shown that the state’s election systems are free of malicious code. Election officials from another state said that CISA officials’ outspokenness has created opportunities for state officials to discuss the importance of election security issues with local officials. Additionally, officials from five states told us they encourage local election officials to request election security services from CISA to increase the security posture of the local jurisdictions. Officials Cited Challenges Linked to DHS’s Election Security Efforts Even though state and local election officials provided mostly positive feedback on DHS’s election security assistance, officials also identified two challenges linked to DHS’s assistance efforts. First, officials from three states stated that it is challenging to find time to schedule election security services. For example, officials from one state said that their biggest challenge is to find time in their state’s election schedule for receiving CISA services because the state has seven to nine elections in off years (that is, years without congressional or presidential elections). Officials from another state said that they might have requested additional election services from CISA if the state had more time in its election calendar. However, none of the state officials with whom we spoke attributed this difficulty to CISA, as election calendars are outside of CISA’s control. In commenting on this challenge, CISA officials said that they have tried to accommodate states’ and local election jurisdictions’ needs, when possible. For example, CISA started offering remote penetration testing as an alternative to the risk and vulnerability assessment. The officials said that the two services are similar, but the remote penetration testing can be completed in fewer days and does not require CISA personnel to be physically present in the election offices. CISA officials told us that smaller jurisdictions sometimes prefer this option. Election officials also identified an additional challenge related to the intelligence briefings that were provided by DHS’s Office of Intelligence and Analysis for state and local officials with security clearances leading up to the 2018 elections. According to Office of Intelligence and Analysis officials, the briefings allowed state and local officials to become more informed about the national threat picture, which in turn, allowed them to adjust to the threat more effectively. Election officials from two states said that the intelligence briefings had provided helpful contextual information about cyber threats. However, election officials in two other states said that the briefings were not as useful as the election officials had hoped because the briefings only provided information that was already available publicly, and election officials from another state said that they learned about a significant election security issue possibly related to their state through news reports. For example, an election official from a different state said that the state learned about threats from the Department of Justice’s July 2018 indictment against foreign intelligence officers. CISA officials stated that they are aware of this issue and have been trying to improve the communication of intelligence information to state and local election officials. For example, at a October 2019 hearing of the House of Representatives Committee on Homeland Security, a CISA senior cybersecurity advisor testified that DHS has begun working with the Intelligence Community to rapidly declassify relevant intelligence or provide as much intelligence as possible, at the lowest classification level possible, to state and local election officials. CISA officials also told us that the agency has started working with cybersecurity intelligence firms to provide election security information to state and local officials without the need for national security clearances or travel to secure facilities. According to CISA officials, two cybersecurity intelligence firms provided webinars to election officials in September and October 2019. CISA officials said that these firms have sophisticated capabilities that they use to analyze information that is not classified. As a result, the cybersecurity intelligence firms can more easily share information with states and local election jurisdictions. CISA officials said that state and local officials will benefit from these briefings because they provide actionable threat information to election officials without requiring them to have security clearances or travel to secure facilities. CISA Has Not Finalized Its Plans to Address Key Objectives and Challenges According to DHS planning guidance, strategic-level planning provides a framework for guiding homeland security activities and generates the objectives and priorities, which influence the roles, responsibilities, and actions that are detailed in the operational-level plans. Further, subsequent operational-level plans are to identify the tasks and resources needed to execute strategic plans. Prior GAO work has shown that strategic and operations plans can help further define capabilities, including opportunities to leverage resources. Such plans can also provide a roadmap for addressing identified gaps and better position an agency and its components to work collaboratively and strategically with external partners, such as states and local jurisdictions. CISA has begun developing strategic and operations plans for assisting states and local jurisdictions in securing election infrastructure in preparation for the 2020 elections. Specifically, CISA has developed a draft strategic plan for securing election infrastructure, known as the #Protect2020 Strategic Plan. According to the draft, CISA intends for its strategic plan to be used to achieve the high-level goals and outcomes called for in the agency’s August 2019 Strategic Intent. The draft strategic plan focuses on four areas, also referred to as lines of effort: (1) protecting election infrastructure, (2) supporting political campaigns, (3) raising public awareness on foreign influence threats and building resilience, and (4) sharing intelligence and identifying threats. In addition, the draft strategic plan identifies several objectives for each line of effort. For example, it includes three objectives for the protecting election infrastructure line of effort: building stakeholder capacity to manage risks and handle adversaries, through activities such as creating incident response and communication plans and encouraging states to adopt and practice them; providing technology services to stakeholders to monitor and secure their networks, by promoting the use of CISA’s voluntary services and assessments, among other things; and facilitating information sharing between the federal government, private sector, and state and local partners by, among other things, hosting situational awareness chat rooms prior to, during, and after state and federal elections. As another example, the draft strategic plan identifies three objectives for the sharing intelligence and identifying threats line of effort: partnering with private sector firms and vendors to improve cyber threat intelligence, through activities such as developing threat indicators and warnings; cooperating across federal partners—including federal law enforcement and the Intelligence Community—by, among other things, advocating for the creation of a joint memorandum to consolidate and highlight current knowledge on election threat intelligence; and monitoring threat activity through actions such as using network monitoring capabilities to spot malicious activity and reveal key trends. In addition, CISA officials stated that the agency has begun developing a draft operations plan, known as the 2020 Election Security Operations Plan. This plan is to—in conjunction with the strategic plan—describe key organizational functions, processes, and resources employed to carry out the agency’s efforts in support of elections in 2020. CISA officials stated, as of November 2019, that the agency intended to finalize the strategic and operations plans by January 2020. However, as of January 2020, CISA’s plans were not yet complete. According to a CISA official, the plans were not finalized due to an ongoing reorganization within CISA and limited staffing resources within the Election Security Initiative. While CISA has drafted the strategic plan, the agency has not yet completed a draft of its operations plan. CISA officials have noted the importance of the operations plan to help ensure the agency is adequately prepared to support election officials in securing election infrastructure in advance of elections, which begin with presidential primaries in February 2020, as well as subsequent primaries leading up to the November 2020 general election. Further, CISA’s operations plan may not fully address the four lines of effort outlined in its strategic plan when finalized. Specifically, according to CISA officials, the operations plan is expected to identify organizational functions, processes, and resources for certain elements of two of the strategic plan’s lines of effort—protecting election infrastructure and sharing intelligence and identifying threats. However, agency officials did not identify the extent to which the operations plan would address all of the objectives from these lines of effort in the strategic plan. CISA officials also stated that the agency is unlikely to develop additional operations plans for the other two lines of effort—providing security assistance to political campaigns, and raising public awareness on foreign influence threats and building resilience. The officials stated that, given the limited amount of time remaining before election preparation activities commence, the agency decided to prioritize developing a plan for the first line of effort that addresses the primary customers of the agency’s election services. In the absence of completed strategic and operations plans, a CISA official in one region stated in October 2019 that the region is moving forward with its own strategy for assisting states and local jurisdictions because the 2020 election cycle is scheduled to start with state primary elections in the region in March 2020. The lack of finalized plans can affect CISA’s achievement of higher-level objectives that take time to accomplish, such as building stakeholder capacity and public awareness. Until CISA finalizes its strategic and operations plans for supporting elections in 2020 and ensures that the operations plan fully addresses all of the aspects of its strategic plan, CISA will not be well-positioned to execute a nationwide strategy for securing election infrastructure prior to the start of 2020 election activities. CISA Identified Challenges Related to Its Efforts to Secure Election Infrastructure, but Has Not Documented How It Intends to Address Them DHS’s National Infrastructure Protection Plan, which provides strategic direction for national, critical infrastructure protection efforts, calls for sector-specific agencies to coordinate lessons learned and corrective actions and rapidly incorporate them to improve future efforts. Further, GAO’s Standards for Internal Control calls for management to document corrective action plans to remediate internal control deficiencies in a timely manner following the reporting and evaluation of issues. CISA has identified various challenges related to its election assistance efforts; however, the agency has not yet documented plans that address them. Following the 2018 midterm elections, CISA and the RAND Corporation conducted two reviews of CISA’s efforts supporting the elections, in order to inform strategic planning and strengthen future operations. The first review, conducted by the RAND Corporation under a contract with DHS, assessed election security operations that CISA undertook from January 2017 through the November 2018 midterm elections. The review relied upon input from DHS personnel, the EI- ISAC, associations representing state election officials, and election system vendors to identify lessons learned from CISA’s activities to assist in securing election infrastructure. In the second review, CISA conducted an after action review covering its efforts to assist in securing election infrastructure from September 2018 to December 2018, based on input from personnel within DHS and its federal partners who participated in the agency’s election security operations. Both reviews identified various challenges that CISA needed to address in its planning for 2020. For example, the RAND review cited challenges related to the services and threat briefings CISA provided to states and local jurisdictions. The review noted, among other things, that CISA: lacked an approach for prioritizing its activities based on election security risks, which could limit the agency’s ability to dedicate increased attention and resources to the jurisdictions with the highest risk; did not adequately tailor services, which could have made it more difficult to meet the resource and time constraints of customers such as local election jurisdictions; and did not always provide actionable recommendations in DHS classified threat briefings or make unclassified versions of the briefings available, which may have hindered election officials’ ability to effectively communicate with information technology and other personnel in their agencies who did not have clearances. Additionally, the CISA after action report identified a number of internal operational challenges associated with its election-related efforts in 2018. For example, the report cited: a lack of understanding by CISA headquarters staff of the roles and functions of regional field staff, which led to redundant requests for information from headquarters staff to regional staff; the lack of a single agency-wide platform to maintain an awareness of election threats, which resulted in confusion among CISA personnel about which threat information was accurate and current; and the inability of CISA personnel supporting election security operations to access social media websites from situational awareness rooms, which hindered their collection and analysis of threat information. Further, both reviews cited challenges regarding CISA’s ability to manage incident information and provide Election Day incident response capabilities in the event of a compromise. For example, with regards to the 2018 election, the reviews noted: few capabilities that CISA field staff could quickly provide on Election Day, which could limit the agency’s timeliness in mitigating or responding to an incident; a lack of clarity regarding CISA’s incident response capabilities in the event of a compromise that exhausts state and local resources, which may limit knowledge about agency capabilities that are available; and a lack of outreach and situational reporting on incidents, threats, and trends on Election Day from headquarters to regional staff following the closure of the polls on the East Coast, which hindered CISA’s coordination of such information with state and local officials. While CISA identified challenges related to its prior efforts, it has not developed plans to address them. According to a CISA official, the agency does not intend to develop a separate plan addressing how it will remediate the identified challenges in the RAND report. Rather, CISA officials noted that the agency plans to address the challenges from that report in the strategic plan and operations plan that it is developing. In addition, the officials noted that CISA may address challenges through other actions that the agency expects to take, such as hiring additional staff. However, CISA’s draft strategic plan, as of November 2019, had only addressed three challenges from the RAND report—countering the threat of disinformation, clarifying how CISA is to support political campaigns, and prioritizing outreach to local jurisdictions. The extent to which the strategic plan, when finalized, will address the other outstanding challenges remains unclear. In addition, the extent to which the operations plan will document how the agency is to address challenges in the RAND report remains uncertain as the operations plan has not yet been completed. Further, CISA has not documented how the agency is to address challenges in the RAND report through other actions that it expects to take before the 2020 elections. Similarly, CISA officials stated that the agency intends to address a subset of the challenges from CISA’s after action report in its anticipated operations plan. However, the extent to which the operations plan will document how the agency is to address challenges in the after action report remains unclear, given that the operations plan has not yet been completed. Without documented plans that address prior challenges, CISA will not be well-positioned to effectively address the challenges identified in prior reviews. This includes addressing how CISA will coordinate among its personnel and provide accurate threat information and other capabilities that address the needs of the election infrastructure community in the remaining months ahead of the 2020 elections. Conclusions With primary elections beginning in February 2020 and culminating in the general election in November 2020, CISA has limited time remaining to help states and local election jurisdictions protect their election infrastructure in advance of these elections. State and local election officials that we contacted have been generally satisfied with CISA’s election security efforts. However, CISA’s unfinished planning means the agency may be limited in its ability to execute a nationwide strategy for securing election infrastructure. In particular, the #Protect2020 Strategic Plan’s higher-level objectives—such as building stakeholder capacity and public awareness—necessarily take time to accomplish. In addition, CISA has not fully assessed and documented how it will address challenges identified in prior assessments, which limits the ability of CISA to address these challenges in its current efforts. Recommendations for Executive Action We are making three recommendations to the Director of the Cybersecurity and Infrastructure Security Agency: The CISA Director should urgently finalize the strategic plan and the supporting operations plan for securing election infrastructure for the upcoming elections. (Recommendation 1) The CISA Director should ensure that the operations plan fully addresses all lines of effort in the strategic plan for securing election infrastructure for the upcoming elections. (Recommendation 2) The CISA Director should document how the agency intends to address challenges identified in its prior election assistance efforts and incorporate appropriate remedial actions into the agency’s 2020 planning. (Recommendation 3) Agency Comments and Our Evaluation DHS provided written comments on a draft of this report, which are reprinted in appendix III. In its comments, the department concurred with all three of our recommendations and identified actions that it plans to take to implement each of the recommendations. For example, the department stated that CISA intends to finalize its strategic and operations plans by February 14, 2020. The department noted that these plans are to provide a strategic overview and operational framework in support of the primaries and the general election in 2020. Further, the department stated that the operations plan, when finalized, is to address all lines of effort in the strategic plan. In addition, the department noted that both the strategic and operations plans are to further document DHS’s plans to address challenges identified during the 2017-2018 election cycle. If implemented effectively, the actions that DHS plans to take in response to the recommendations should address the weaknesses that we identified during our review. DHS and CISA officials also provided technical comments, which we incorporated, as appropriate. We are sending copies of this report to the appropriate congressional committees, the Acting Secretary of Homeland Security, the Director of the Cybersecurity and Infrastructure Security Agency, and other interested parties. In addition, the report is available at no charge on the GAO website at https://www.gao.gov. If you or your staff have any questions about this report, please contact Vijay A. D’Souza, Director, Information Technology and Cybersecurity, at (202) 512-6240 or dsouzav@gao.gov or Rebecca Gambler, Director, Homeland Security and Justice, at (202) 512-8777 or gamblerr@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made major contributions to this report are listed in appendix IV. Appendix I: Sources of Cybersecurity Threats to the Election Infrastructure The election process relies on various assets—such as information technology systems, networks, equipment, and facilities—that can be broadly categorized as physical, cyber, and human components of the Election Infrastructure Subsector. The assets and components of the election infrastructure are susceptible to a variety of unintentional, or nonadversarial, and intentional, or adversarial, threats. The table below identifies sources of cybersecurity threats to election infrastructure. Appendix II: Voluntary Services for the Election Infrastructure Subsector Provided by CISA The Department of Homeland Security, through the Cybersecurity and Infrastructure Security Agency (CISA), has taken steps to assist state and local election officials in securing election infrastructure by providing a variety of services on a voluntary, no cost basis. These services include cybersecurity assessments, detection and prevention activities, and information sharing. The table below identifies voluntary services that CISA offers to states and local election jurisdictions. Appendix IV: GAO Contact and Staff Acknowledgments GAO Contacts Staff Acknowledgments In addition to the contacts named above, Josh Leiling (Assistant Director), Tom Jessor (Assistant Director), Torrey Hardee (Analyst-in-Charge), Roger Bracy, Rebecca Eyler, Richard Hung, Amanda Miller, Heidi Nielson, Monica Perez-Nelson, Jeff Tessin, Eric Warren, and Haley Weller made significant contributions to this report.