Episode 5: The Election Assurance Maturity Model - Measuring Trust

Imagine visiting two hospitals.

Both have highly trained doctors.

Both have modern medical equipment.

Both proudly display their accreditation certificates.

At first glance, they appear equally capable.

But spend a few days inside each hospital and the differences become clear.

One hospital still relies on paper records.

Equipment inspections happen only when required.

Cybersecurity is treated as an annual audit.

Problems are fixed after they occur.

The other hospital continuously monitors medical devices.

AI assists physicians in detecting anomalies.

Supply chains are tracked in real time.

Security operations never stop.

Lessons from every incident immediately improve future procedures.

Both hospitals may technically be certified, but they are operating at very different levels of maturity.

Certification tells us whether an organization met a standard.

Maturity tells us how it thinks.

Today's episode explores the Election Assurance Maturity Model or EAMM, a roadmap for helping election infrastructure evolve from periodic certification toward continuous assurance.

So why does maturity matter? One of the challenges in cybersecurity is that success is difficult to measure.

If nothing bad happens, was your security effective? Or were you simply fortunate? Organizations often accumulate tools, firewalls, antivirus software, threat intelligence, monitoring platforms, governance and compliance reporting tools.

But adding more technology doesn't necessarily increase trust.

Instead, trust and assurance should mature through increasingly comprehensive evidence, resulting in creating confidence in election outcomes.

Think of learning to fly an airplane.

The goal isn't collecting more instruments.