I read the document last night albeit not word for word and a few things popped out at me as I have read hundreds of risk assessments. The vulnerability assessments are pretty basic. Not bad but not great either. Just enough redaction to make you believe there is sensitive information. 50 pages of Russia, Russia, russia but no dedicated sections for China, China, China. I have never seen an official assessment with news articles. At most would be links of credible security references for context. News and opinion articles may be found in more marketing type work or security awareness material for end user security training. I believe much of the pen testing and vulnerability analysis is true, although they appear to be mostly samples. One item was in Michigan I believe where anti-virus definitions had not been updated in over 5 years. This is typically a symptom of a much bigger problem and cannot be chalked up to “I didn’t know” especially when there is CISA remediation assistance available to help IT-elections staff. In a nutshell: Your laptop is more secure than the US elections critical infrastructure The really good stuff is missing from this report. The report does not outline a scope or methodology per se and looks to be a nicely cut and pasted organization of various sources (of course it is) and hurts the credibility of its analysis