The US Cybersecurity and Infrastructure Agency (CISA) has published a new Election Infrastructure Security Plan ahead of the November 2026 midterm elections.
The document provides guidance and resources for relevant state, local and federal bodies on how to mitigate cyber and physical threats to election. The agency warned that electoral infrastructure is a tempting target for various threat actors for purposes such as manipulating voting systems and stealing sensitive data.
This infrastructure covers physical assets, such as storage facilities, polling places and centralized vote tabulation locations used to support the election process.
It also covers the information and communications technology aspect, including voter registration databases, voting machines and systems used to manage the election process and report results.
“By leveraging collaborative partnerships, robust cyber defenses, and ongoing threat intelligence, the plan ensures that all stakeholders are prepared to address evolving risks. Continued vigilance, adaptability, and transparency will be essential as we work together to protect the foundations of our Constitutional Republic and maintain public trust in our elections,” CISA wrote in the Plan, published on September 24.
Security experts have previously warned that reported cuts by President Trump’s administration to CISA in 2025 impacted the agency’s efforts to secure critical election infrastructure.
This included reports that CISA terminated federal funded activities supporting the Election Infrastructure Information Sharing and Analysis Center (EI-ISAC) as part of efforts to save costs. The EI-ISAC was not specifically mentioned in the new election infrastructure security plan.
On September 3, 2026, two Democrat party legislators, Senator Alex Padilla and Representative Joe Morelle, published an open letter demanding that the Trump Administration immediately restore funding to EI-ISAC ahead of the 2026 midterms.
Cyber Threats to Election Infrastructure
The new CISA report set out the primary cyber threats to election infrastructure it expects to see as we approach the midterm election date of November 3, and how these should be mitigated.
Vulnerability Exploitation
CISA warned that election infrastructure is often accessible from general enterprise networks, which enables malicious actors to gain access via known vulnerability exploits and move laterally.
The agency added that state, local, tribal, and territorial (SLTT) election offices frequently struggle with basic cybersecurity hygiene and vulnerability remediation, partly due to outdated certification regies and inconsistent transparency from election system vendors.
Election officials and stakeholders have been urged to harmonize patch management and certification requirements for voting systems and associated IT infrastructure to allow cybersecurity updates in real-time without affecting system certification.
CISA also advocated the use of paper ballots that can be easily reviewed to verify that voting systems are functioning properly and identify errors.
Voter Registration Databases
CISA noted that threat actors have attempted to breach Statewide Voter Registration Databases (VRDB) in all 50 states, with confirmed success in at least 20 states over the last decade.
Election officials should therefore prioritize the security of data held in these systems. This includes implementing multifactor authentication (MFA) for all access to the VRDB and connected systems, using phishing-resistant methods for privileged accounts where possible.
Continuous network monitoring and anomaly detection should be carried out to quickly identify unauthorized access attempts, while comprehensive logging and audit trails should be kept to detect and reverse unauthorized modifications to databases.
Insider Threats
The report noted that election infrastructure stakeholders rely on a large temporary workforce during elections, including volunteer poll workers, contractors and vendors.
Seasonal and volunteer personnel may not undergo the same vetting procedures as permanent staff, increasing the risk of intentional and unintentional insider risk.
Threats from insiders include deliberate sabotage to election systems, such as making unauthorized changes to voter registration databases and ballot definitions.
Workers may also introduce unintentional risks, such as falling for phishing attacks or inserting removable media into election systems that contain malicious files.
CISA said relevant bodies should follow longstanding election practices to mitigate known insider risks, such as handling ballots in bipartisan teams of two, allowing observers to be present during ballot counting, and maintaining chain-of-custody procedures.
Election Officials Urged to Deploy No-Cost Cybersecurity Services
CISA also set out a range of no-cost, voluntary cybersecurity services it offers that election officials and private-sector election infrastructure partners can deploy to assist their efforts.
These include:
- Deploying CISA tabletop exercise packages and penetration testing services,
- Requesting workshops and briefings on particular security topics
- Using the agency’s vulnerability and web scanning services to identify vulnerabilities
- Incorporating CISA’s KEV catalog to keep pace with active threat activity
- Coordinating with CISA’s cadre of regional security advisors
- Working with state and regional fusion centers to share threat intelligence and risk assessment data
