EAC lacks analysis rigor sufficient for critical infrastructure (US)

CISA’s Cyber Risk Assessment depicts U.S. election infrastructure as a highly networked, variably secured critical infrastructure ecosystem with persistent, exploitable weaknesses, while the EAC’s election system oversight is narrowly product centric, episodic, and largely detached from those systemic cyber risk realities. Unlike other critical infrastructure systems, there are no failure modes and effects analyses performed on election systems nor is there any substantive analysis of their supply chain.