New York Codes, Rules and Regulations
Title 9 - EXECUTIVE DEPARTMENT
Subtitle V - State Board of Elections
Part 6220 - Cyber Security Requirements for Boards of Elections
Section 6220.3 - Cyber Security Program Requirements
Universal Citation: 9 NY Comp Codes Rules and Regs ยง 6220.3
Current through Register Vol. 46, No. 12, March 20, 2024
(a) A cyber security program shall have the following elements:
(1) Data Classification
(i) Each Board of Elections shall conduct a
data classification exercise to: identify Board of Elections data assets and
information systems; determine the criticality of data assets and information
systems; determine the order and scope of data assets required to be backed up
based on the criticality derived from the data classification exercise; and
determine the priority to restore data based on the criticality derived from
the data classification exercise.
(ii) Each Board of Elections shall conduct
such data classification exercise for each new information system that creates,
modifies, stores, or transmits election data.
(iii) The data classification exercise must
be initiated in the first year of this regulation and must be completed no
later than August 1st prior to the general election
each year; however, if a new information system is created subsequent to August
1st, but prior to election day, a new data
classification exercise must be conducted as soon as practicable.
(2) Asset Inventory
(i) Each Board of Elections shall maintain an
asset inventory of all devices and software that access, store, process, and
transmit election data. At a minimum, the Board shall review said inventory for
accuracy on a monthly basis.
(ii)
At a minimum, the inventory shall include: network address(es), machine
name(s), purpose of each device, whether the device is portable, and an asset
owner responsible for each device. Mobile devices that handle election data
must be included whether or not they connect to the Board of Elections network.
(iii) Each Board of Elections
shall deploy a network-based asset discovery tool to build an initial asset
inventory of Board of Elections systems, both hardware and software. The
network-based asset discovery tool must be run on a monthly basis to discover
new assets on the Board of Elections network segment and update the asset
inventory. Any non-approved or unknown devices or software should be
documented, investigated, and removed.
(3) Patch Management
(i) Each Board of Elections shall ensure all
information systems and electronic equipment, other than voting systems, that
access, store, process, and transmit election data are up-to-date through the
use of a monthly patching program. This includes every network-connected
device, including but not limited to desktops, laptops, tablets, servers,
virtual machines, network equipment (routers, switches, firewalls, wireless
access points, etc.), mobile devices, printers, storage area networks, and
Voice Over-IP telephones.
(ii) Each
Board of Elections shall implement automated patch management and software
update tools for operating systems and applications identified in the asset
inventory.
(iii) Any software
products that cannot be automatically patched should be reviewed on a monthly
basis and updated manually.
(iv)
Each Board of Elections shall implement an evaluation process for available
patches and accelerate its deployment where they are critical in
nature.
(v) When checking for
updates, the version should be validated to ensure it is still supported by the
vendor. If not, the technology must be updated following vendor best practices.
Any technology that cannot be updated or patched must be documented and
communicated to the State Board of Elections when certifying the cyber security
program.
(vi) No system that
requires State Board certification or approval for use, such as voting systems,
shall be updated without express written approval of the State Board.
(4) Vulnerability scanning
(i) Each Board of Elections shall run
vulnerability scans and, where practicable, authenticated vulnerability
scanning tools, against all information systems and electronic equipment that
accesses, stores, processes, and transmits election data on the network. At a
minimum, such vulnerability scanning tools shall comply with the following:
(1) the scanning interval must occur on a
continuous basis, but not less than a bi-weekly basis.
(2) reports must deliver a prioritized list
based on criticality.
(3) the scans
must assess code-based vulnerabilities, configuration-based vulnerabilities,
and web application vulnerabilities.
(4) The network border must undergo a
vulnerability scan on at least a bi-weekly basis.
(ii) Each Board of Elections shall undergo an
annual penetration test of its network(s) to identify vulnerabilities in the
environment. Verified vulnerabilities must be added to existing Remediation
Plans.
(5) Backups of
Election Data
(i) At a minimum, to ensure
recovery of information systems and data, Boards of Elections shall, at weekly
intervals, perform a full backup Election Data.
(ii) Each Board of Elections shall store at
least one full backup, rotated weekly, at an off-site location. This backup
shall be stored securely and offline (not connected to a network).
(iii) Each Board of Elections utilize a
separate service account for backups that is prevented from interactive logon
of workstations and servers.
(iv)
Each Board of Elections shall attest to the proper configuration of backup
accounts and services in its annual compliance certification to the State Board
pursuant to section 6220.2(b) of this regulation.
(6) Restoration of Data
(i) Each Board of Elections shall test, at
least once ninety days prior to each primary and general election, the
restoration of critical data and information systems from its backup and verify
that the restored data and information systems are useful, accessible, and
fully functional to meet operational requirements.
(ii) Each Board of Elections shall attest to
completion of the restoration tests in its annual compliance certification to
the State Board pursuant to section 6220.2(b) of this regulation.
(iii) If such tests are unsuccessful, results
shall be reported to the Secure Elections Center no later than two weeks from
the date of the test.
(7) Network Segmentation
(i) Each Board of Elections shall establish
its own network segment(s), segregating data communications from other
interconnected networks, by establishing separate Virtual Local Area Networks
(VLANs) and, if feasible, physical network segmentation.
(ii) Each Board of Elections network traffic
must be restricted following the principle of least privilege (e.g. network
traffic shall be restricted solely for legitimate election administration
purposes) implemented through access control lists and updated documentation
must be maintained.
(iii) Each
Board of Elections shall only allow elections-related VLANs to communicate with
information systems unrelated to elections on an as-needed basis.
(iv) Any communications to information
systems unrelated to elections must be documented and submitted annually when
certifying the cyber security program pursuant to section 6220.2(b) of this
regulation.
(v) Other network
traffic, such as wireless communications or public terminals, shall be
segmented or explicitly denied.
(vi) Security features on any network
appliance, cloud service, or security software that blocks or prevents malware
and malicious network traffic shall be enabled.
(vii) Each Board of Elections shall use
dedicated servers or electronic devices for elections-related tasks, such as
but not limited to voter registration, election management systems, and
election night reporting.
(viii)
For dedicated servers or electronic devices for elections-related tasks, only
software necessary and relevant to carry out said tasks shall be
installed.
(ix) Dedicated servers
or specialized electronic devices for elections-related tasks, such as poll
pads, shall not be used for general purpose computing, such as word processing
or browsing the internet.
(x)
Technical controls shall be implemented to prevent internet browsing from
dedicated servers or specialized electronic devices intended for
elections-related tasks.
(xi) Each
Board of Elections shall use secure protocols for all remote connections on the
Board of Elections network segment(s).
(xii) Each Board of Elections shall use
encryption to protect elections data both in transit and at rest where
practicable.
(xiii) Each Board of
Elections shall disable Server Message Block (SMB) Protocol version 1
communications on the Board of Elections network segment.
(xiv) Each Board of Elections shall disable
all Server Message Block (SMB) Protocol communications at the private/public
network boundary.
(xv) Each Board
of Elections shall disable macros, programs common in office documents, on
Board of Elections workstations unless there is an explicit need.
(xvi) Any macros enabled on a Board of
Elections workstation must be documented and submitted annually when certifying
the cyber security program pursuant to section 6220.2(b) of this
regulation.
(xvii) Any Windows
system that supports PowerShell must be updated to a current supported version
and must enable module, script block, and transcript logging or have PowerShell
disabled from running.
(xviii) Each
Board of Elections must compare their expected network traffic with the rules
from their network boundary firewalls to ensure that the rules are acting as
intended and align with industry best practices on an annual basis.
(xix) Each Board of Elections must establish
and document the configuration of a "Baseline Image" for user workstations and
dedicated servers on their network(s), including but not limited to: voter
registration systems, desktops, and laptops. The documentation should be
updated, along with the image, on regular intervals but no less than quarterly.
Any exceptions to the Baseline Image must be documented and submitted annually
when certifying the cyber security program.
(8) Remote Access
(i) Each Board of Elections shall follow best
practices for remote access to its network segment(s), which shall include, but
is not limited to:
(1) the use of
bi-directional authentication to establish trust between the sender and
receiver.
(2) the use of secure
protocols for all remote connections to the systems and applications of the
board of elections network segment, such as transport layer security (TLS) or
Internet protocol security (IPSEC).
(9) Logging
(i) Each Board of Elections shall enable,
retain, and secure logs from network devices and network-connected servers,
desktops, and laptops that access, store, modify, and transmit election
data.
(ii) Such log data must be
forwarded to a centralized log management server that is separated from the
current network for retention of a minimum of ninety-two days.
(10) Incident Response
(i) Each Board of Elections shall ensure that
a written incident response plan is maintained and designed to promptly respond
to any cyber security incident materially affecting the confidentiality,
integrity or availability of the Board's information systems or the continuing
functionality of any aspect of the Board's operations.
(ii) At a minimum, the incident response plan
must address: the internal processes for responding to a cyber security
incident; the goals of the incident response plan; the definition of clear
roles, responsibilities and levels of decisionmaking authority; and external
and internal communications and information sharing.
(iii) Each Board of Elections shall update
its incident response contacts list and shall notify the State Board upon any
changes and, at a minimum, shall submit a copy of the incident response contact
list to the State Board bi-annually, but no later than ninety days prior to the
primary and general election.
(iv)
Each Board of Elections shall must report to the State Board of Elections,
through the cyber incident reporting procedure, all cyber security incidents or
any disruptions which impact or have the potential to impact election
operations. Cyber security incidents includes, but is not limited to:
(I) any unauthorized entry or attempt to gain
unauthorized access to storage facilities, polling sites, early vote centers,
and/or offices of the county Board of Elections (regardless of whether on
private or public property that is used by the county Board of Elections);
(II) incidences of phishing,
including spear-phishing, which seemingly target the county Board of Elections;
(III) attempts to access, alter,
or destroy the county Board of Elections critical information systems or
public-facing websites;
(IV)
attempts to hack, phish, or compromise professional e-mail accounts and the
county Board of Elections social media accounts;
(V) attempts to interfere with votes sent
through the U.S. Postal Service; or
(VI) instances of any unexplained disruption
at a polling place or training locations for Election Inspectors and other poll
workers, including early voting locations, which block or inhibit voter
participation. Disruptions may include social media posts or robocalls or texts
reporting closed or changed polling places, or physical incidents at polling
places, including distribution of false information; disinformation efforts to
alter voter participation (including via US postal mail, social media, or other
electronic or physical Means); impacts to critical infrastructure that limit
access to polling places or information from elections officials, such as
power, natural gas, water, internet, telephone (including cellular), and
transportation (including traffic controls and roads) outages.
(v) Each Board of Elections shall
allow on-site visits for incident handling and response by the State Board of
Elections and its employees and/or designees.
(11) Continuity of Operations
(i) Each Board of Elections shall create or
update and maintain a continuity of operations plan to recover from incidents
and ensures that the Board of Elections is able to perform essential functions
under a broad range of circumstances
(ii) The continuity of operations plan must
address recovery, contingency processes, communication plans, and processes for
operational data availability.
(iii) Each Board of Elections shall submit a
copy of the continuity of operations plan to the State Board annually pursuant
to section 6220.2(b) of this regulation.
(12) Credential Management and Access
(i) Each Board of Elections shall ensure that
a Complex Password Management Policy is implemented on all information
technology systems and assets in use by the Board and, at minimum, all
passwords shall be changed on a regular basis but no less than
annually.
(ii) Passwords or Pass
Phrases must be at least fourteen characters in length, must support special
characters, and must be changed at least once every year. When passwords are
used as part of multi-factor authentication, a minimum of eight characters in
length shall be used. Information systems that do not support these password
settings must be documented and submitted annually when certifying the cyber
security program pursuant to section 6220.2(b) of this regulation.
(iii) Default passwords must be changed and
may not be used on any device or software for elections-related
tasks.
(iv) Access to Board of
Elections systems and devices must utilize unique and individually accountable
credentials. Use of logins such as anonymous, guest, etc. or sharing of
credentials among multiple users is not allowed. Information systems that do
not support the use of unique credentials must be documented and submitted
annually when certifying the cyber security program pursuant to section
6220.2(b) of this regulation.
(v)
Each Board of Elections shall review all users who have data entry access or
change privileges, based on the principle of least privilege, and shall review
such access whenever an employee's status changes and users who are no longer
employed by the Board of Elections shall have their accounts
disabled.
(vi) Each Board of
Elections shall conduct periodic reviews of all user accounts who have access
to Board of Elections information systems at least annually.
(13) Multi-factor Authentication
(i) Each Board of Elections shall implement
multi-factor authentication for administrative access to information systems
that store, process, and grant access to election data, including domain
administrative access. Multi-factor authentication may be employed through a
variety of methods, including smart cards, certificates, one-time password
(OTP) tokens, biometrics, or similar authentication methods.
(ii) Each Board of Elections shall implement
multi-factor authentication on remote access to county Board of Elections
assets.
(iii) Each Board of
Elections shall implement multi-factor authentication for all user accounts
that have access to election data or systems that create, modify, transmit, or
store election data.
(iv) Any
information system that manages election data in the aforementioned manner and
does not support multi-factor authentication shall be documented and reported
when certifying the cyber security program.
(14) Email and Web Protections
(i) Each Board of Elections shall ensure all
incoming emails are scanned for malicious attachments and links prior to
delivery and shall quarantine emails as necessary.
(ii) Each Board of Elections shall implement
transport layer security (TLS) to secure web and email communications and
ensure any certificates used do not expire.
(iii) Each Board of Elections shall implement
a mechanism, through an automated service, to protect Domain Naming System
(DNS) queries from connecting to malicious domains.
(iv) Each Board of Elections shall implement
a web application firewall to protect its web applications and web sites from
malicious traffic.
(v) Each Board
of Elections shall utilize .GOV domains for email communications and web
traffic to the extent practicable.
(vi) Starting no later than August 1, 2024,
the Board of Elections shall implement domain-based message authentication,
reporting, and conformance (DMARC) for email.
(15) Third Party Risk Management
(i) Each Board of Elections shall address
technology procurement risk through an appropriate risk assessment prior to the
adoption of new technologies or managed services.
(ii) Each Board of Elections shall follow a
Secure System Development Life Cycle in the development of all Board of
Elections applications and systems, including applications and systems
developed for the Board by outside entities.
(16) Continuous Monitoring and Reporting
(i) In order to maintain awareness of
elections assets and any malicious activity, the Board of Elections shall
maintain an Intrusion Detection System (IDS) or Intrusion Prevention System
(IPS) on network-connected election systems.
(ii) Each Board of Elections shall maintain
up-to-date contacts for alerts generated by such system.
(17) Removable Media
(i) Any information system which utilizes
removable media and handles Election Data, shall sanitize, scan for viruses and
malware, encrypt, and physically secure the device pursuant to guidance
provided by the State Board.
(ii)
Any information system that does not have a documented business requirement for
using removable media shall have its ability to access removable media
disabled.
(18) Security
Awareness Training
(i) All employees of a
Board of Elections that access and use any Board of Elections systems,
including but not limited to email and voter registration systems, shall
successfully complete a cyber security awareness training program and must
attest to successful completion annually.
(ii) Each Board of Elections shall conduct a
phishing assessment of employees of the Board of Elections at least once
annually and shall report the results to the State Board of
Elections.
(iii) Each Board of
Elections shall participate in tabletop exercises hosted by the State Board of
Elections, including Commissioners, Deputy Commissioners, and significant staff
as selected by Commissioners of Boards of Elections.
(19) Elections Infrastructure Information
Sharing and Analysis Center
(i) Each Board of
Elections shall be responsible for acquiring and maintaining membership in the
Center for Internet Security's Elections Infrastructure Information Sharing and
Analysis Center ("EI-ISAC").
Disclaimer: These regulations may not be the most recent version. New York may have more current or accurate information. We make no warranties or guarantees about the accuracy, completeness, or adequacy of the information contained on this site or the information linked to on the state site. Please check official sources.
This site is protected by reCAPTCHA and the Google
Privacy Policy and
Terms of Service apply.
