[null, null, null, null, null, null, {"document_url": "https://www.belfercenter.org/publication/election-cyber-incident-communications-plan-template", "unformatted_src": "/sites/default/files/inline-images/CommsProcessCyberIncident.jpg", "src": "https://www.belfercenter.org/sites/default/files/inline-images/CommsProcessCyberIncident.jpg", "formatted_filename": "CommsProcessCyberIncident", "alt_text": "Comms process for a cyber incident"}, null, null, null, null, null, null, null]
AP Photo/David Goldman


Microphones sit on a podium following Vice President Mike Pence’s speech at an event at Dobbins Air Reserve Base in Marietta, Ga., Friday, June 9, 2017.

Election Cyber Incident Communications Plan Template


For State and Local Officials

Defending Digital Democracy Project: About Us


Election Cyber Incident Communications Plan Template [PDF]


Authors and Contributors
Executive Summary and Purpose

How to Use this Communications Plan

Cyber Crisis Communications Best Practices
Communications Coordination
Communications Response

State Election Communications Development & Approval Process
Establishing a Cyber Incident Response Team
Developing a Response Process
Activation of the Cyber Communications Response Team
Communications Process for a Cyber Incident

Key Messages for Baseline Communications
Sample State Website Message Emphasizing Cybersecurity

These interviews exposed the range of challenges election officials confront in the cyber domain. One of the most significant needs we encountered was state and local officials’ request for guidance on how to communicate in a cyber crisis, because they saw cybersecurity issues as unfamiliar territory. They asked specifically for help with developing a communications plan for a potential cyber incident in their jurisdiction.

We hope this Plan Template becomes a starting point for state and local election officials to prepare for an election cyber incident.
Finally, we would like to thank the election officials around the country for whom we wrote this guide. You are the frontline defenders of democracy. We hope this effort helps make that tremendous responsibility a little easier.

The D3P Team

Authors & Contributors

This project was made possible by dozens of people who generously volunteered their time. Special thanks are due to Siobhan Gorman, who led the project and who, in addition to Shannon Cortez, wrote this plan.

Lori Augino, Director of Elections, WA Office of the Sec. of State
Matt Chandler, Partner, Frontier Solutions
Caitlin Conley, Executive Director, D3P
Amy Cohen, Executive Director, National Association of State Election Directors
Shannon Cortez, Deputy Director of Elections, WA Office of the Secretary of State
Meredith Davis Tavera, D3P, Harvard Kennedy School
Karen Ejiofor, Staff Assistant, Belfer Center
Chris Farley, Associate, Albright Stonebridge Group
David Forsey, Policy Analyst,  National Governors Association
Siobhan Gorman, Director, Brunswick Group
Eben Kaplan, Principal Consultant, CrowdStrike
Jane Khodos, Senior Director, Communications and Content, FS-ISAC
Matthew Masterson, Commissioner, Election Assistance Commission
Jeff McLeod, Division Director for Homeland Security and Public Safety, National Governors Association
Michelle Tassinari, Director/Legal Counsel, Elections Division, Office of the Secretary of the Commonwealth of Massachusetts


The D3P team would like to especially thank Heather Adkins of Google, Yasmin Green of Jigsaw, the Hewlett Foundation, the Democracy Fund, and the Belfer Family; without whom this plan would not have been possible. Additionally, we would like to thank the following organizations and offices for sharing their time with us through conversations, simulation participation, or field visits. Your perspectives were critical in shaping our approach to this document.

Election Officials from the Following States and Jurisdictions:


A cyber incident can span a wide spectrum of malicious cyber activity, and for the elections system, it could range from theft of voter registration data to disruption or manipulation of the vote tally. Given the growing cyber threats to elections globally and in the U.S., state and local elections officials are preparing for how to respond in a "cyber incident" on all fronts, including external communications.

To prepare for possible incidents, election officials have requested guidance on how to build their own communications plan for election-related cybersecurity incidents. This document provides a template and guidance to do so.

The potential for cyberattacks on our election system is an unfortunate reality of our time, and officials should recognize, and plan for, a possible incident. There has been growing interest in using cyber means to spy on or disrupt U.S. elections, dating back at least to 2008 and culminating in the high-profile cyber incidents in 2016.

That trend has rightly caused concern for state and local election officials administering and overseeing elections for all levels of government. In future cycles, the efforts to compromise elections may extend to state and local races. Every relevant agency, as part of their overall security strategy, should incorporate a cyber crisis communication plan.

When a cyber incident occurs, elections officials should be generally prepared to manage the crisis, because they have prepared ahead of time for other types of crises, such as a natural disaster. However, there are elements of a cyber incident that require additional preparation, because a cyber crisis is different from other situations in key ways:coordinated effort to stamp it out.

The Plan Template that follows outlines key components of a communications plan that state election officials can build out and tailor to the needs of their jurisdiction. It can also be used at the local level, particularly for large counties. This Plan Template is designed to be used in concert with the State and Local Election Cybersecurity Playbook and the Election Cyber Incident Communications Coordination Guide.

The sections that follow are suggestions only and should be retained, amended, or deleted based on the needs of your jurisdiction. The pages that follow will be in a template format, including bracketed text where the name of a jurisdiction, or other jurisdiction or situation-specific details, can be filled in. The template starts with the first component of a plan: how to use this communications plan. It then outlines best practices and key communications processes. An Appendix of additional communications materials is available to elections officials upon request from the National Association of Secretaries of State, the National Association of State Election Directors, or the U.S. Election Assistance Commission.


[STATE / LOCAL JURISDICTION’S] communications plan includes guidelines and template materials to help our election officials respond to an election-related cyber incident quickly and in a coordinated fashion during the first several days of a cybersecurity incident.

While every situation is unique, this plan provides a foundation on which election officials can build an appropriate response that addresses the incident with the goal of maintaining confidence in the election system.

This plan should be owned by one organization and updated at least annually.

Key components include:


To lead confidently, election officials need to prepare, train for, and test responses ahead of time. In today’s dynamic political and data environment, every official will likely have to respond to a cyber challenge at some point. Whether preparing for a cyber incident or another type of crisis, this plan can assist the state or local election official will develop a well-thought-out plan and response. That response will be central to preserving public trust.


Set guidelines for communicating with outside parties in an incident.

Establish connections between the incident response team and communications officers.

Encourage intra-state, cross-state, or cross-country communication and collaboration.




Guidelines for Communicating with the Public

Best Practices for Countering Misinformation


Even a rumor of online election meddling can trigger a communications crisis and sow distrust in the elections system. The good news is that much can be done ahead of time to prepare for such a crisis and get everyone on the same page. We cannot stress enough how much time this will save later in trying to determine how to respond.

Maintaining a coordinated process establishes effective and efficient communications planning and response to a cyber-related incident.

The communications process outlines:


To manage a cyber incident effectively, the overall state response to the incident should integrate communications officials into the process. The following organizational structure will ensure that communications is part of the decision-making process.

Cyber Incident Response Team (CIRT) Organization

Cyber incident response should use, to the degree possible, the processes [JURISDICTION] already has to respond to other elections-related crises. It should make adjustments for the specific differences involving cyber meddling—particularly the key personnel involved and the potential for any incident to become high profile and raise questions about the integrity of the elections process as a whole.

The Chief Election Official and Director of Elections are responsible for consulting and activating [JURISDICTION’S] cyber incident response plan. You should have delegated executives who are backups and can decide whether to activate the plan. Each executive should have the necessary contact information and follow that sequence.

States may be able to suspend, delay, or postpone voting in an emergency situation, which may include a court order, legislative action, or the emergency powers of the Governor. At the local or regional level, lower courts may cancel, postpone, or extend Election Day polling place hours by issuing a court order.


This table should be updated regularly as part of the annual plan review.

Establishing a Cyber Communications Response Team (CCRT)

Your Cyber Communications Response Team will support your [Director of Communications] assigned to the CIRT. Here are the steps you can take to ensure your Cyber Communications Response Team has the right people at the table.

[JURISDICTION] should establish the following roles for responding to a state-level cyber incident:

Note: Counties should adapt accordingly for their structure. Depending on a jurisdiction’s organizational structure, you may choose not to include the Chief Election Official, Director of Elections, and Chief Information Officer on the Cyber Communications Response Team

Cyber Communications Response Team List


Activation of the Cyber Communications Response Team (CCRT)

Cyber-related incidents vary in size and severity, which makes it important to have a process to ensure the appropriate steps are calibrated to the significance of the incident. All incidents can be categorized under one of the following severity levels:

In a medium-intensity incident, [CHIEF ELECTION OFFICIAL] will need to make a judgment call about whether to activate the CCRT, but if the incident is likely to become public and raise questions about trust in the election systems, [CHIEF ELECTION OFFICIAL] should err on the side of activation. You can always deactivate if the intensity declines. Once activated, [CHIEF ELECTION OFFICIAL] along with [DIRECTOR OF ELECTIONS], will decide which level applies, based on an initial assessment. Once [CHIEF ELECTION OFFICIAL] activates the CCRT, all key response team members will be notified of the activation [INSERT STATE’S METHOD OF REACHING TEAM MEMBERS].


Using the Incident Communications Coordination Line (ICCL)

As the standing conference call line for cyber-related incidents, the ICCL can be a key coordination mechanism for communicators to share both operational data, as well as coordinate messaging and communications-related activity.

Upon  activation of the Cyber Communications Response Team, the [Communications Director] will stand up the ICCL and distribute the time and conference line to invited participants for an initial conference call. This call could include representatives from affected communities, as well as the CCRT roles listed above and any other CCRT participants or outside advisors with relevant subject-matter expertise.

The call agenda can follow a regular rhythm:

If this incident has the potential to escalate to an event that crosses state lines, please contact the Cyber Communications Response Group at the Election Infrastructure Government Coordinating Council. [INSERT CONTACT DETAILS FOR CCRG REPRESENTATIVE] More information on the CCRG can be found in the Election Cyber Incident Communications Coordination Guide.

Should there be current coordination processes that are effective in sharing and coordinating information, such as regular calls, email listservs, continue to use them—particularly prior to, or the beginning phases of, activation. However, the scope and volume of an incident may make more direct communications, such as via the ICCL or a War Room, more useful.


If a cyber crisis happens, it will demand its own communications plan. The steps below will help you assess the situation and take basic actions while you develop a more detailed communications plan. Each situation must be fully assessed on its own merits before a particular strategy is executed. The following are general guidelines:

Step 1:  Activate the CCRT and obtain a technical briefing from the CIO or technical liaison.
Step 2: Only if absolutely necessary, and in consultation with IT specialists, decide if you need to disable agency website and launch a microsite outside of the agency’s network. This will be a decision for [JURISDICTION ELECTIONS DIRECTOR/LOCAL COUNTY AUDITOR OR CLERK]. Notify key staff members. If website remains active, a message on the website may need to be posted.
Step 3: If necessary, contact law enforcement or federal authorities.
Step 4: If media are calling or showing up at the office, CCRT responds to reporters. If needed, you can issue a holding statement.
[Additional communications response materials are available to elections officials on request in the appendix to this document and can be obtained upon request from the National Association of Secretaries of State, the National Association of State Election Directors, or the U.S. Election Assistance Commission.]
Step 5: Notify key people: Chief Election Official, State Elections Director, Assistant Election Officials, Deputy Election Officials, IT Team, Communications Team, Elections Team.
Step 6: Inform entire agency of developing crisis, agency response, and agency policies that apply.
Step 7: Inform stakeholders / Legislature / Auditors.
Step 8: If you have not done so already, consider whether you need to inform the media/public about the incident. Make sure you inform the media only of confirmed facts that you are confident will not change (very few facts will fall into this category).
Step 9: Begin monitoring media coverage.
Step 10: Develop medium-term message.
Step 11: Prepare for press outreach/briefing and media schedule.
Step 12: Develop feedback loop from media monitoring or polling and incoming queries from media to determine if you need to recalibrate messages.

Note: Numbers in chart below correspond to steps outlined above Communications Coordination & Response Checklist

Elections Crisis Communications Checklist

A cyber crisis has the potential to cast a negative light on the [CHIEF ELECTION OFFICIAL] or a local county elections office—as well as to undermine faith in the elections system. If you are uncertain whether a situation could escalate into a crisis, err on the side of standing up response teams, because you can always stand down if the incident does not escalate. (Consult [JURISDICTION’S]—Continuity of Operations Plan—in crises that impact operations.)

The checklists below can be adapted to your jurisdiction’s processes. They provide guidance on actions to be taken in the lead up to, and days following, a cyber incident. Action: Once a cyber crisis becomes public

Action: Before a cyber crisis

Identify office protocol and a crisis communications team. (Should include IT).

Ensure that all stakeholders can be reached in a crisis without access to the [CHIEF ELECTION OFFICIAL] network or smart phones.

Craft communications materials that can be used in a potential cyber incident. For examples, elections officials may request sample materials from the National Association of Secretaries of State, the National Association of State Election Directors, or the U.S. Election Assistance Commission.)

Ensure that communications plans can be accessed and are regularly updated.

Action: Before a cyber crisis becomes public

Obtain technical briefing. (Assess and verify all information.)

Decide whether to activate CCRT.

If email is potentially compromised, use an outside communications channel
Consult authorities, if needed.

Meet internally in war room; set internal communication schedule.

Assess stakeholders.

Determine broad communications strategy.

Prepare holding statement.

Develop communications plan.

Draft additional communications required to execute plan, including a communications rollout plan (includes communication with media, stakeholders and employees).

Establish plan for traditional and social media monitoring.

Establish media response protocol.

Notify [CHIEF ELECTION OFFICIAL] employees, if necessary. It may be that only a small group of employees are informed initially. Communicate internally, as needed.

Action: Once a cyber crisis becomes public

Fact check: Make sure communications materials reflect current facts.

Execute rollout plan, including informing media, if appropriate.

Determine if microsite/web page is needed.

Record an office greeting for phone system, if necessary.

Maintain a record of inbound media inquiries and responses.

Begin media (social and traditional) monitoring.

Review and revise messaging, as needed, based on feedback.

General Media Inquiries Checklist

Gather basic facts:

Story topic/angle/deadline

Platform (blog, newspaper, television, radio, etc.) plus request content and images

Other potential interview subjects

Remember: Only designated spokespeople should speak or provide content.

Remember:  You have rights when you communicate with journalists, especially when asked about technical details you wouldn’t be expected to know. “Let me see what I can find out for you” is always an option for a response. This response may mean that you return to the reporter without any additional information. You are not obligated to provide details.

Remember: Reporters are under pressure from their editors and may shift the pressure to you. Do not speculate to fill gaps for them.

Notify key people:

Meet internally.

Designate key spokespeople and content providers. Assign tasks.






Other government offices


General public

SOS employees and their families (if necessary)


You need to set a baseline understanding for the public that your [JURISDICTION] is taking cybersecurity seriously, and integrating best practices throughout the elections process. Below [are a few/is one example/s] of these baseline communications. In addition to a standing website message, develop key messages for [JURISDICTION’S] cyber preparedness activities and integrate them into current web content and future public remarks by [JURISDICTION’S] elections officials.

Below is one example of baseline communications. For your state, add relevant additional communications.


Note: Counties can modify to fit their jurisdiction.

Welcome to [STATE] State Elections! We are honored to serve you, the voters of [STATE]. Our mission is to ensure accessible, fair, and accurate elections.

Our office facilitates federal, state, and local elections conducted by all [X NUMBER OF] county election departments. We maintain voting equipment and software integrity, provide training and certification for election administrators, and support the statewide voter registration database.

Through educational programs and materials, we help all eligible [STATE] residents register to vote and cast an informed ballot. This website is one of many ways we provide information about [STATE’S] unique election system, our [INSERT DETAIL ON SYSTEM THAT SETS IT APART]. It provides [STATE] voters the power of citizen legislators, and the special services available to military voters, college students, voters with disabilities, and minority language communities.

We’re proud that [STATE] is at the forefront of elections by embracing technology and innovation to better serve voters. Some of our achievements include:


[STATE] State Elections is passionate about bringing access and transparency to the elections process. I hope you register and vote in our great state!



As we head into the next election cycle, we hope that this Plan Template provides a running start for elections officials who are seeking to develop a cybersecurity communications response plan. We hope the guidance and format of this template helps officials prepare for, and manage, this emerging and evolving cyber risk to our elections process. As with all communications plans, we recommend that you regularly update your plan to account for changes in agency structures and personnel.

More information is available on the type of information communications materials should include. Election officials seeking examples of additional communications materials, can request the communications materials appendix to this document from NASS, NASED, or the EAC.


For Academic Citation: “Election Cyber Incident Communications Plan Template.” Belfer Center for Science and International Affairs, Harvard Kennedy School, February 2018. Robby Mook Matt Rhoades Eric Rosenbach


 Wikimedia CC/Muhammad Sajid Mehmood Ash Carter Talks Tech and Public Purpose on CNBC Squawk Box Wikimedia CC/Greg Goebel


