CISA Election Plan Highlights Patching Barriers and Voter Database Risks
Summary
CISA’s 2026 election security plan highlights certification-related patching barriers, risks to voter registration databases and insider threats, and recommends measures including MFA, network monitoring and documented procedures.
Key points
- CISA says election software certification constraints can delay vendors’ patches and prevent election officials from applying updates quickly.
- The agency recommends aligning patch management with certification requirements and asks software providers to disclose vulnerabilities and patch status promptly.
- CISA says attempts to breach voter registration systems have occurred in all 50 states, with confirmed success in at least 20, citing reports from the past decade.
- The plan prioritizes MFA, network monitoring, least-privilege access, retaining critical logs for at least a year, and separating public-facing registration tools from master databases.
- CISA warns that insiders could alter voter data or election settings, while careless staff or volunteers could fall for phishing or mishandle equipment; it recommends formal insider threat programs.
- CISA is supporting a no-cost information-sharing platform for election officials and fusion centers during the 2026 cycle, alongside free scanning, testing and assessment services.
Article Details
- Event Type
- CISA published its 2026 Election Infrastructure Security Plan, outlining cybersecurity and physical risks to election systems and protective measures for election officials.
- Impact
- CISA reports that election software patching can be delayed by certification constraints and that many state, local, tribal, and territorial election offices struggle with basic cyber hygiene and vulnerability remediation. Voter registration systems have been targeted in all 50 states, with confirmed breaches in at least 20, according to CISA. The plan also addresses insider risks and notes that 96 of 107 election-related security incidents tracked through open-source reporting since January 2022 were bomb threats.