International Foundation for Electoral Systems EMB itself with technical assistance as required, and requires the EMB to identify which election data management technology or technologies should be HEAT-tested. The HEAT process focuses primarily on electronic systems or platforms related to election processes that include any forms of automation or digitalization, such as voter registration, voter identification, voting and vote count, and results transmission and tabulation. Depending on how advanced the management system is, it can also include candidate registration, the ballot design (in complex elections such as local elections) and ballot printing. One or more of these can be tested, as relevant and applicable to the country in question, and the HEAT process is being specifically designed to target these systems and processes. However, depending on the EMB’s mandate and specific circumstances of the country in question, there may be other relevant data management systems or platforms that an EMB may wish to test, such as political party registration databases, campaign finance databases and reports, systems for redistricting of constituencies and precincts and polling station allocation, procurement and inventory databases, personnel and financial databases, website and social media platforms, and case management systems used in complaints adjudication. Apart from identification of assets that need protection, the EMBs should be in a position to evaluate the likelihood of any looming cybersecurity threats, be it DDoS attacks and insider attacks, spearphishing or an exploit through malware. Listing all possible threats and including an assessment of how imminent the danger is helps to prepare for further steps in the HEAT process. Collect After identifying the specific election data management technology to be HEAT-tested, the relevant EMB staff should collect and collate all relevant information for the HEAT team. This includes laws, rules, procedures, manuals, and training material, formalized strategic policies if any, on the one hand, and the technical information such as system design (schematics), data security policies, set-up and configuration scripts, program source code, and other relevant material, on the other. It will be important to collect all relevant laws and rules so the HEAT team can identify provisions in the legal framework that may be used to challenge election technology and data management processes later in the election process, to ensure adequate regulations and policies are in place to govern the use of the data management technology, to ensure roles and responsibilities are clarified, especially between EMBs and technology vendors, and to identify contingency measures. The relevant laws and rules will include the Constitution, national electoral laws, EMB regulations, any other relevant national laws or rules on data management, data protection, or cybersecurity, laws and rules on civil procedure and evidence, and relevant national case law, where applicable. In addition to these legal materials, the EMB should collect all relevant policies, procedures, strategies, operational plans, guidance documents manuals and training materials used in the electoral process that are relevant in whole or in part to the election technology being tested. During the collection phase, the EMB will also conduct a system-mapping exercise to visualize components of the system being HEAT-tested, as well as linkages and information flow between institutions and individuals. System mapping is a tool within the larger research method of systems 30