Votercare Elect: self-assessed against NIST election security guidelines
Why we're publishing this
One of Votercare Elect's core design principles is transparency: every security claim is documented, sourced, and independently verifiable. We apply the same standard to our compliance posture.
Rather than wait until we can claim formal certifications, we think it is more useful — and more honest — to publish a structured self-assessment now, against named, credible external benchmarks, so that potential customers, scrutineers, and critics can see exactly where we stand.
Two frameworks: VVSG 2.0 and the NIST CSF Election Infrastructure Profile
We assessed against two major references:
- VVSG 2.0 — Voluntary Voting System Guidelines, US Election Assistance Commission
- NIST Cybersecurity Framework Election Infrastructure Profile — NIST VTS 200-1, published January 2024
These look similar from the outside but are structurally very different — and the difference matters.
VVSG 2.0: an important scope finding
VVSG 2.0 is frequently cited as the gold standard for voting system security. It is — for a specific category of system that Votercare Elect is not, by design.
VVSG 2.0 was written for physical, polling-place voting equipment: optical scanners, ballot marking devices, tabulators. The standard is explicit:
"VVSG 2.0 does not permit devices or components using external network connections to be part of the voting system."
"The VVSG requirements apply to devices used to mark ballots inside a polling place or vote center. They do not apply to remote ballot marking devices and applications."
VVSG 2.0 formal certification is not achievable for Votercare Elect — not because of any shortcoming, but because any internet-connected system is precisely the category the standard was written to exclude. This is worth stating plainly: any online voting provider claiming VVSG 2.0 certification should be questioned closely, because the standard's own text makes this combination impossible.
What we can do — and have done — is assess against VVSG 2.0's underlying principles, which remain a legitimate general benchmark for voting-system quality even where formal certification does not apply.
Where Votercare Elect is strong against VVSG 2.0 principles:
Transparency (Principle 3). Votercare Elect publishes its design documentation, threat model, and adversary table. The open-source-plus-published-design approach directly satisfies "the public can understand and verify operations of the voting system throughout the entirety of the election" — and arguably exceeds most closed commercial competitors in this respect. None of the major UK electronic ballot providers publish comparable design or threat documentation.
Voter Privacy (Principle 6). "Voters can mark, verify, and cast their ballot privately and independently." The anonymous-credential and nullifier architecture means voters prove eligibility without revealing identity to the system. No name, email, or phone number is required or retained.
Ballot Secrecy (Principle 10). "Must not contain nor produce records that can associate voter identity with choices." The nullifier scheme achieves this structurally: the link between identity and ballot is never created, not merely procedurally restricted.
Auditability (Principle 9). VVSG 2.0 explicitly favours "end-to-end verifiable systems" and "software independence." Votercare Elect's Benaloh-challenge-plus-published-tally-proof architecture is a direct match — any voter, observer, or journalist can verify independently that the tally is correct.
Data Protection (Principle 13). "All cryptographic algorithms are public, well-vetted, and standardized." Semaphore (PSE, Ethereum Foundation) and ElectionGuard (Enhanced-Voting fork of Microsoft Research) both satisfy this directly — a genuine citable strength against competitors using proprietary or undocumented methods.
The substantive gap: accessibility
The most significant gap this assessment identified is accessibility (Principles 5, 7, and 8). VVSG 2.0 treats accessibility as core, not supplementary — requiring WCAG 2.0 Level AA conformance, support for assistive technology (screen readers, alternative input methods), and usability testing specifically involving voters with disabilities.
This has not yet been addressed in Votercare Elect's design or implementation. We are treating it as a concrete roadmap item, not a footnote, and will commission a WCAG 2.1/2.2 Level AA audit before any formal customer deployments of Votercare Elect.
NIST CSF Election Infrastructure Profile: the more applicable framework
The NIST Cybersecurity Framework Election Infrastructure Profile (NIST VTS 200-1) is a risk management framework, not an equipment certification. Unlike VVSG 2.0, nothing in its structure excludes internet-based systems — the Profile's own stated purpose includes "to perform a self-assessment comparison of current risk management and security practices." This is the right framework to use, and we describe our assessment as exactly what it is: a self-assessment, not a certification.
We scoped our assessment to Mission Objective 1 (vote capture, submission, aggregation, tabulation, and results certification) — the Profile's own highest-priority objective, and the one that directly corresponds to what Votercare Elect does.
Where we assessed as well-aligned:
Access Control (PR.AC): Strong design alignment. Identity proofing to IAL3-equivalent, maker-checker credential issuance (no single operator can issue fraudulently), MFA planned via Cyber Essentials work, and credential revocation with per-election cutoff dates all map directly to PR.AC-1 (identities managed and audited) and PR.AC-6 (identities proofed and bound to credentials).
Data Security (PR.DS): Strong alignment. Data-in-transit and at-rest protection is built into the cryptographic design throughout — Semaphore proofs, ElectionGuard encryption, and published tally proofs. PR.DS-6 (integrity checking of software/firmware) maps to the reproducible-builds requirement in our design documentation.
Risk Assessment (ID.RA): Well met. Our published threat model (adversary table A1–A17, available on the Trust page) directly and rigorously satisfies this category — it documents assets, vulnerabilities, and threat actors in structured, auditable form.
Gaps from the CSF EIP assessment:
Awareness and Training (PR.AT): Not yet addressed. No formal security training process exists for operators — this becomes relevant as soon as anyone beyond the founding team has system access and will be documented before any external deployments.
Governance (ID.GV): Partially met. Strong design-level governance exists (documented principles, threat model, sortition-based trustee governance), but no formal written cybersecurity policy document has been produced separately from the technical design docs.
Formal asset inventory (ID.AM): The components and data flows exist in the design documentation but have not been produced as a discrete, auditable inventory artifact.
Incident recovery plan (RC.RP): Technical resilience is designed in (paper ballot override, geographic redundancy), but no single documented recovery process exists distinct from the technical design. Worth writing up explicitly before any live election deployment.
What "self-assessed" means — and what it doesn't
This is a self-assessment conducted against named, published frameworks. It is not a third-party audit, and it is not a certification. The Profile document itself describes this as a legitimate use: "to perform a self-assessment comparison of current risk management and security practices."
We describe it as exactly that. The value is in the transparency: by publishing our assessment openly, with honest gaps named, it can be reviewed, challenged, and updated as the product matures. We will re-run this assessment once Votercare Poll's MVP is live and verified in production — several "well-aligned in design" findings need to be confirmed against a running system, not just a design document.
What comes next
Our near-term compliance roadmap:
- UK Cyber Essentials — core controls (patch management, MFA, access control, malware protection) planned and being implemented
- Accessibility audit — WCAG 2.1/2.2 Level AA assessment; the highest-priority gap identified by this exercise
- Formal operator training process — to be documented before any external customer deployments
- ISO 27001 — longer-term target, once Cyber Essentials and formal governance documentation are in place
The full source material — design decisions document, threat model, and adversary table — is available on our Trust page.