CISA Releases 2026 Election Security Plan, Highlighting Patching Barriers and Voter Database Threats

CISA's Election Security Plan Overview

The US Cybersecurity and Infrastructure Security Agency (CISA) has released its 2026 Election Infrastructure Security Plan. This document outlines the cyber and physical threats facing election systems and details the free services CISA provides to election officials and partners. Homeland Security Secretary Markwayne Mullin initiated the development of this plan in July.

Challenges in Patch Management and Cyber Hygiene

CISA identified that election software often contains vulnerabilities, but existing certification rules limit vendors' ability to release patches and prevent system owners from applying them quickly. Assessments also show that state, local, tribal, and territorial (SLTT) election offices frequently struggle with basic cyber hygiene and vulnerability remediation. Election infrastructure is often connected to general enterprise networks, allowing lateral movement for attackers who compromise other systems.

Specific issues include vulnerability management constrained by outdated certification regimes, inconsistent vendor transparency regarding vulnerabilities and patch status, and the cybersecurity immaturity of many SLTT networks hosting election systems.

Recommendations for Improved Security

CISA recommends aligning patch management with certification requirements to enable real-time security updates without affecting system certification. The agency also suggests the use of paper ballots and manual post-election audits. Furthermore, CISA advises election officials to encourage software providers to assign CVE identifiers to flaws, promptly report source code leaks or thefts, report incidents to authorities, and include a software bill of materials (SBOM) with every product.

Voter Registration Database Threats

Voter registration databases remain a target for foreign adversaries, with CISA citing reports of attempted breaches in all 50 states and confirmed success in at least 20 states over the past decade. To protect these databases, the plan prioritizes multi-factor authentication and network monitoring to detect anomalies.