There’s a lot to like in this year’s appropriations agreements, starting with a lump sum for states to bolster critical voting infrastructure. The $425 million that Congress is providing in 2020 comes many days late and many dollars short, according to experts, who say billions were needed starting at least two years ago. But it’s still an improvement over the $380 million allocated in 2018, and the $0 allocated this past year. These funds will be doled out in grants to states, which can then decide how to use them.

The National Defense Authorization Act also includes essential measures, such as allowing state election officials to receive top-secret security clearances. The step will open the road at last to robust information-sharing between the federal and local governments. The same is true for public-private partnerships: The legislation establishes a threat analysis center at the office of the director of national intelligence responsible for coordinating between intelligence officials and technology companies to root out influence campaigns.

The legislation mandates a much-needed “whole-of-government” strategy to be devised by multiple agencies with an eye toward deterrence, technical measures to secure critical systems and more. The same agencies are required to produce a range of reports for Congress and the public, from retrospectives on past attacks to rundowns of future vulnerabilities, as well as any incursions from Russia or others the intelligence community identifies ahead of elections.

All this leaves open a question: What happens when the money is given out, the strategy devised and the reporting completed? Congress did not impose any rules to ensure states procure systems that are secure and auditable, even though a consensus exists on the most statistically effective and secure way to check that results haven’t been tampered with. Also left on the cutting-room floor, despite clearing the Senate by a voice vote, was the Deter Act, which would have triggered automatic sanctions on meddling countries.

These omissions are especially ominous in light of a signing statement from Trump that suggests his administration may object to the release of some of those reports on who is interfering and how.

Congress has made bipartisan progress on a subject that never should have been partisan in the first place. The task ahead is to replace the remaining uncertainty in this country’s election- security regime with certainty – the sort that can stand up even to a president who has little interest in acting to protect the elections of the country he leads.