CISA Unveils Election Security Plan for 2026 Midterms

The US Cybersecurity and Infrastructure Agency (CISA) has released a comprehensive Election Infrastructure Security Plan designed to safeguard the integrity of the upcoming November 2026 midterm elections. Published on September 24, the document serves as a critical resource for federal, state, and local entities tasked with protecting the electoral process from both cyber intrusions and physical threats. The agency emphasizes that election infrastructure remains a high-value target for malicious actors seeking to manipulate voting outcomes or exfiltrate sensitive data.

This infrastructure encompasses a wide array of components, ranging from physical assets like polling places and vote tabulation centers to digital systems such as voter registration databases and reporting networks. By integrating these elements, the plan aims to create a unified defense strategy. “By leveraging collaborative partnerships, robust cyber defenses, and ongoing threat intelligence, the plan ensures that all stakeholders are prepared to address evolving risks. Continued vigilance, adaptability, and transparency will be essential as we work together to protect the foundations of our Constitutional Republic and maintain public trust in our elections,” CISA wrote in the Plan.

Funding Concerns and Political Pressure

Despite the publication of this new guidance, the agency’s operational capacity faces scrutiny following reported budget reductions by the Trump administration in 2025. These cuts allegedly impacted CISA’s ability to secure critical election infrastructure, including the termination of federal funding for the Election Infrastructure Information Sharing and Analysis Center (EI-ISAC). Although the EI-ISAC was not explicitly mentioned in the newly released security plan, its absence has sparked political backlash. On September 3, 2026, Senator Alex Padilla and Representative Joe Morelle issued an open letter demanding the immediate restoration of funding to the EI-ISAC ahead of the midterms.

Primary Cyber Threat Vectors

The report identifies several key areas where election officials must focus their defensive efforts. A significant concern is the exploitation of vulnerabilities within enterprise networks. Because election infrastructure is often connected to broader corporate networks, attackers can use known exploits to gain initial access and move laterally through systems. State, local, tribal, and territorial (SLTT) election offices frequently face challenges in maintaining basic cybersecurity hygiene due to outdated certification regimes and inconsistent transparency from vendors. To counter this, CISA urges stakeholders to harmonize patch management with certification requirements, allowing for real-time updates without compromising system approval. Additionally, the agency advocates for the use of paper ballots to facilitate manual verification of electronic results.

Voter Registration Databases (VRDBs) represent another critical vulnerability. Over the past decade, threat actors have successfully breached VRDBs in at least 20 states. To mitigate this risk, officials are advised to implement multifactor authentication (MFA) for all access points, particularly using phishing-resistant methods for privileged accounts. Continuous network monitoring and anomaly detection are also recommended to identify unauthorized access attempts quickly, while comprehensive logging helps detect and reverse any illicit modifications to database records.

Managing Insider Risks

The reliance on a large temporary workforce during election cycles introduces unique insider threats. Seasonal poll workers, contractors, and vendors may not undergo the same rigorous vetting processes as permanent staff, increasing the potential for both intentional sabotage and unintentional errors. Malicious insiders might attempt to alter voter registration data or ballot definitions, while others may inadvertently introduce malware through phishing attacks or removable media. To address these risks, CISA recommends adhering to established bipartisan practices, such as requiring two-person teams for ballot handling, allowing independent observers during counting, and maintaining strict chain-of-custody procedures.

Voluntary Security Services

To assist in these efforts, CISA highlights a suite of no-cost, voluntary cybersecurity services available to election officials and private-sector partners. These resources are designed to enhance defensive capabilities without imposing additional financial burdens on already strained budgets.