Soon the campaign will be over. You have been highly focused on getting your candidate elected, and hopefully it will lead to a victory. But, win or lose staff will soon depart, and the campaign will be on hiatus or closed down.
Before everyone decamps, digital assets need to be protected to prevent whatever remains of the campaign from being exploited and to avoid headaches for the next cycle. The following will help you close down or pause your campaign more securely:
Make sure you can access your domain next cycle by securing and storing credentials (logins and passwords) to key accounts and services: Someone on the campaign likely has admin access to the campaigns primary platform like Workspace or M365 and other core services for fundraising and data. These credentials are required to retain access and when a campaign reboots for the next election. Make sure someone who will remain around the candidate–a permanent staffer, counsel, or family member–has access to those credentials and changes account ownership as needed. Some password managers have vault options for storing passwords that need to be shared later
Delete unused accounts: Staff leave quickly when election day passes. In the course of their work, they may have created accounts on behalf of the campaign. Those accounts should be closed before they leave to avoid bad actors from taking them over and accessing sensitive data, such as personal information on donors.
Manage the digital departure of staff email: Deleting user accounts no longer in use is a critical cybersecurity function. Dormant accounts are a common attack vector for bad actors and they can wreak havoc once inside your domain. Depending on the platforms you use, there may be ways to share or automatically move files staff have created to an existing user or store in a shared drive.
Don’t let your domains expire and secure your websites: Periodic monitoring for content changes should be conducted. Additionally, be sure that campaign domains registrations remain current. We have seen many expired campaign domains taken over and exploited by others. Maintain security certificates (https). Delete users who no longer need access to the content management system. If your website does not have DDoS protection–platforms like Squarespace, Vercel and Wix have this built into their basic offerings–you should implement Cloudflare or Project Shield from Google. Delete the names and contact information of staffers on the site.
Remove access to social media: Throughout the campaign, you may have granted access to a candidate's or campaign's social media presence. This could include staff who are posting and responding and ad buying privileges for staff or digital firms. Revoke all privileges for all that are no longer needed. Update passkeys and/or change passwords on the accounts as needed as well and retain credentials for future access.
Remove campaign data from personal devices: Most campaigns are “bring your own device” (BYOD). As staffers or key volunteers leave your campaign, they may have valuable and sensitive information on those devices. Revoke any app access to prevent data leakage post-election.
Purge documents and data: Campaigns amass reams of documents and data some of which can be highly personal in nature, considered personally identifying information, or redundant. Delete all unneeded copies of files containing sensitive information or consider giving them to someone else, like an attorney for the campaign or another trusted entity, for safekeeping off of the network until the next campaign
If you want to stay up to speed on cybersecurity, subscribe to our newsletter. During the off-season, our newsletter frequency is about once per month with possibly an announcement or two in between.
If you have taken advantage of any free services from DDC, such as Cloudflare, be on the lookout for an email about how those services are maintained between campaigns.