The U.S. Cybersecurity and Infrastructure Agency (CISA) has unveiled a comprehensive Election Infrastructure Security Plan in anticipation of the November 2026 midterm elections. This document serves as a critical resource for state, local, and federal bodies, offering guidance on mitigating both cyber and physical threats to the electoral process. CISA has underscored that election infrastructure presents an appealing target for various threat actors intent on manipulating voting systems or stealing sensitive electoral data.
Key components of the election infrastructure defined by the plan include the physical assets that support the electoral process, such as storage facilities, polling locations, and centralized vote tabulation centers. Additionally, the report encompasses the information and communications technology that supports voter registration databases, voting machines, and systems used to manage election processes and report results.
CISA emphasizes the importance of collaborative partnerships, robust cyber defenses, and ongoing threat intelligence. In a statement released on September 24, the agency declared, “By leveraging collaborative partnerships, robust cyber defenses, and ongoing threat intelligence, the plan ensures that all stakeholders are prepared to address evolving risks. Continued vigilance, adaptability, and transparency will be essential as we work together to protect the foundations of our Constitutional Republic and maintain public trust in our elections.”
In the context of national cybersecurity, the new Election Infrastructure Security Plan comes after concerns regarding previous funding cuts to CISA during the Trump administration in 2025. Reports indicate that these cuts negatively impacted CISA’s ability to secure critical electoral infrastructure. One particularly troubling development was the termination of federally funded activities supporting the Election Infrastructure Information Sharing and Analysis Center (EI-ISAC), which was not specifically mentioned in the current security plan. Advocacy for restoring this funding was evident when two Democrat legislators, Senator Alex Padilla and Representative Joe Morelle, issued an open letter demanding immediate restoration of financial support to EI-ISAC as the 2026 midterms approach.
As the agency sets the stage for securing election infrastructure, it has identified primary cyber threats expected to surface as the midterm elections draw near. The report details various vulnerabilities, including the risk of exploitation related to election infrastructure’s accessibility through general enterprise networks. This accessibility can allow malicious actors to exploit known vulnerabilities and laterally move within systems.
CISA highlights that many state, local, tribal, and territorial (SLTT) election offices grapple with fundamental cybersecurity practices and vulnerability remediation. These challenges stem from outdated certification regimes and a lack of transparency from election system vendors. The agency urges election officials to harmonize patch management and certification requirements for voting systems and related IT infrastructure, enabling real-time cybersecurity updates without interrupting system certification.
Among the recommended security measures is the adoption of paper ballots, which provide a reliable means to verify that voting systems are functioning correctly and to identify any discrepancies or errors in the electoral process.
Furthermore, the report reveals the alarming frequency with which threat actors have attempted to breach Statewide Voter Registration Databases (VRDB) across all 50 states. With confirmed incursions in at least 20 states over the past decade, CISA advises election officials to prioritize the security of data contained within these databases. It calls for the implementation of multifactor authentication for all access points to the VRDB and associated systems, advocating for phishing-resistant methods wherever possible. To effectively identify unauthorized access attempts, continuous network monitoring and anomaly detection are essential, paired with comprehensive logging and audit trails to reverse any unauthorized alterations to the databases.
The risks are not only external; insider threats are another significant concern. Election infrastructure often relies on a transient workforce, which includes volunteer poll workers and contractors who may not undergo rigorous vetting compared to permanent staff. This reliance on seasonal and volunteer personnel raises the potential for both intentional and unintentional insider risks. These could range from deliberate sabotage, such as unauthorized changes to voter registration databases and ballot definitions, to inadvertent risks like falling for phishing scams or using infected removable media.
To combat these insider threats, CISA recommends adhering to established election practices, such as conducting ballot handling in bipartisan teams, ensuring observer presence during ballot counting, and maintaining chain-of-custody protocols.
CISA also provides a host of no-cost, voluntary cybersecurity services to assist election officials and private sector partners in fortifying their defenses. These services include the deployment of tabletop exercise packages and penetration testing, workshops on specific security topics, vulnerability and web scanning services, and access to CISA’s Known Exploited Vulnerabilities (KEV) catalog, among other resources.
In summary, as the U.S. gears up for the crucial midterm elections in November 2026, the newly released Election Infrastructure Security Plan by CISA is a timely and necessary initiative aimed at safeguarding the electoral process. It highlights both external and internal threats while providing a framework for enhancing cybersecurity preparedness across multiple stakeholders in the election ecosystem.