Cybersecurity in Elections: Developing a Holistic Exposure and Adaptation Testing (HEAT) Process for Election Management Bodies thinking that visualizes linkages among key actors. Often individual and institutional connections, or lack thereof, can impact the election process. The links that the EMB holds with any other authority within the country, other independent agencies or government agencies dealing with data protection, should be clearly identified at this stage. The cybersecurity community is unified in saying that sharing of cybersecurity information is critical for adequate protection and resilience, and the election process is not an exception to this. What is exceptional about elections, however, is that the independence of the EMB must be maintained, regardless of any collaborative efforts. System mapping can shine a light on otherwise hard-to-identify incentive structures, interactive effects and leverage points for identifying and addressing vulnerabilities in the electoral process. Without a consideration of the system design (a system map) and the underlying cybersecurity assumption, it is very difficult to recognize the existence of all the specific vulnerabilities. A system map is a visual depiction of the components of a system at a point in time, while an actor map is a type of system map that focuses on relationships and interconnections between various actors involved in a system. These maps help show how the parts of and people within a system are connected, identify weak connections or gaps, bring out ideas for intervention points in the system, and help identify ways of determining whether these changes have occurred. The HEAT team will provide instructions and templates, or can directly guide the EMB through this process. The resulting map will form part of the HEAT team’s exposure process in step three. Expose Step three requires the HEAT team to collectively analyze the relevant EMB materials and systems map and expose vulnerabilities within the five different types of exposure – technological, human, political, legal and procedural. Because the process looks holistically at these five different types of exposure, the HEAT team should generally consist of a technology expert, legal expert, and election operations expert. Step one of the HEAT process should feed into the identification of the HEAT team, in terms of the specific technology or technologies being tested. The core question will be: who is qualified to help test and assess the election technology and the framework or context in which it is deployed? Once identified, during this part of the process the HEAT team will identify and record vulnerabilities that the EMB faces in using the specific technology being tested, categorized under the five types of exposure, and will list preliminary options for mitigating or managing vulnerabilities.103 In addition, the HEAT team should look at certain external elements that can significantly impact the election process, especially in terms of possible negative influence or disinformation campaigns against the EMB or other election stakeholders, and will examine existing EMB communication strategies. 103 Over time, IFES will develop a global database of vulnerabilities and recommendations as the HEAT process in utilized with local partners. This can serve as a reference tool for EMBs and technical assistance providers. 31