The 2016 cyberattacks on US electoral systems caused DHS to designate them critical infrastructure. But the federal role is limited. States, counties and system vendors bear principal responsibility for ensuring that votes are cast and counted confidentially with integrity. What lessons have been learned and progress made? What more needs to be done to secure this most fundamental political right?