This article is based on a Microsoft blog post originally published on blogs.microsoft.com in June 2020, covering a partnership between Microsoft and the Center for Internet Security (CIS).
Background: Why Election Security Monitoring Matters
Election infrastructure — including voter registration systems, voter information portals, and back-office administrative networks — represents a high-value target for foreign adversaries and cybercriminals. For years, the Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency (CISA) has worked alongside state and local governments and the non-profit Center for Internet Security (CIS) to monitor the security of election-related data and detect threats before they can cause damage.
What Is Albert Network Monitoring?
Albert is a network security monitoring system developed and operated by CIS. It works by examining internet traffic and connection attempts on networks owned and managed by election officials. Albert sensors are designed to surface both basic and advanced network threats, including:
- Attempted intrusions by foreign state-sponsored actors
- Attacks by cybercriminals targeting election infrastructure
- Malicious traffic patterns and anomalous connection attempts
Data collected by Albert sensors is forwarded in near-real-time to the CIS Security Operations Center (SOC), which is staffed around the clock by expert cybersecurity analysts. This continuous monitoring gives election officials timely alerts so they can respond quickly to potential threats.
The Problem: Albert and Cloud Computing Were Not Compatible
Despite the effectiveness of the Albert monitoring system, a significant gap existed: Albert sensors were not compatible with major cloud computing platforms such as Microsoft Azure. This forced election officials into a difficult trade-off. They could either:
- Migrate workloads to the cloud and gain scalability, cost savings, and built-in cloud security capabilities — but lose Albert’s specialized election-security monitoring; or
- Keep data on local, on-premises servers and retain Albert monitoring — but forgo the operational and security advantages of modern cloud infrastructure.
For resource-constrained county and state election offices, this was a meaningful barrier to modernization.
The Solution: Microsoft Azure Becomes Albert-Compatible
In June 2020, Microsoft and CIS announced a partnership to resolve this compatibility gap. Through collaborative engineering work between Microsoft’s Azure Global engineering team and CIS’s engineering team — in partnership with Microsoft’s Defending Democracy Program — Microsoft Azure became compatible with Albert network monitoring sensors for the first time.
This integration means election officials can now host election-related workloads on Microsoft Azure while still receiving the real-time network security monitoring and threat alerting that Albert provides. They no longer have to choose between cloud capabilities and specialized election security oversight.
Pilot Program: Starting With Florida Counties
The initial rollout of this capability began as a pilot with 14 county Supervisors of Elections in Florida. The pilot was intended to validate the integration in a real-world election environment before broader availability. According to the announcement, Microsoft and CIS planned to extend the capability to additional states and jurisdictions across the United States following the pilot phase.
What This Means for Election Officials and DevOps Teams
For DevOps and infrastructure teams supporting election offices, this integration changes the architectural calculus in several practical ways:
- Cloud migration is no longer a security downgrade: Moving voter registration or election management systems to Azure no longer means losing specialized network threat monitoring.
- Centralized SOC visibility extends to cloud workloads: The CIS SOC can monitor cloud-hosted election infrastructure the same way it monitors on-premises networks, maintaining consistent analyst coverage.
- Operational benefits of cloud are preserved: Teams can take advantage of Azure’s elasticity, managed services, compliance certifications, and built-in DDoS protection alongside Albert’s election-specific monitoring.
- Reduced operational burden on local IT staff: Smaller county election offices with limited IT resources can offload infrastructure management to cloud providers without sacrificing federally-supported security monitoring.
Broader Context: Securing Election Infrastructure
This partnership is one component of a larger ecosystem of efforts to harden U.S. election infrastructure. CISA, the Election Assistance Commission, state election offices, and technology vendors have all been increasing investment in election cybersecurity since at least 2016. Making cloud platforms compatible with established monitoring tools like Albert represents a pragmatic approach — extending proven security controls into modern infrastructure rather than requiring election offices to choose between security and modernity.
The announcement noted that Microsoft intended to share further details in subsequent months about additional work to help secure the 2020 elections and future elections in the United States and internationally.
Key Takeaways
- CIS’s Albert Network Monitoring system provides near-real-time threat detection for election infrastructure, feeding into a 24/7 staffed SOC.
- Prior to this partnership, Albert sensors were incompatible with cloud platforms, forcing election offices to choose between cloud benefits and Albert monitoring.
- Microsoft Azure is now compatible with Albert, eliminating that trade-off for the first time.
- The capability launched as a pilot with 14 Florida county election offices in June 2020, with plans for broader U.S. availability.
- The integration was produced by joint engineering work between Microsoft’s Azure Global team, CIS, and Microsoft’s Defending Democracy Program.