- CISA's 2026 Election Infrastructure Security Plan says certification rules can limit vendors' ability to release patches and stop election offices from applying them quickly, across more than 10,000 local jurisdictions.
- CISA says voter registration systems have faced breach attempts in all 50 states, with confirmed successful breaches in more than 20, and 96 of 107 election security incidents since January 2022 were bomb threats.
- Organizations under any compliance regime can ask their security teams whether patches trigger full recertification, whether vendors must disclose CVEs and provide software bills of materials, and whether insider-threat programs cover temporary staff.
A federal plan for a system it doesn't own
CISA released its 2026 Election Infrastructure Security Plan this month, following a July directive from Homeland Security Secretary Markwayne Mullin instructing the agency to produce it. The plan's starting premise is one budget-holders in any distributed organization will recognize: CISA doesn't run election systems. More than 10,000 local jurisdictions do, each responsible for its own infrastructure, with the federal government limited to offering tools, assessments and information.
Certification rules can outlast the threat they were built for
CISA's central finding is structural rather than technical. The agency states that "structural constraints within the certification ecosystem can significantly limit vendors' ability to release patches and prevent system owners from applying them quickly." In plain terms: a compliance regime designed to lock down a product's configuration can also lock out the fix for a known flaw, because applying it risks tripping a recertification requirement. Separate agency assessments point to a related weakness: many state, tribal and local election offices still lack mature patching and basic security hygiene practices. Compounding that, election systems often sit on the same networks as everyday government IT — so an attacker who breaks into an ordinary email inbox or desktop machine can potentially work sideways into equipment that administrators believed was walled off.
CISA's proposed remedy is to rewrite the relationship between patching and certification — letting vendors push security fixes immediately rather than waiting on a new certification cycle to bless each change. Beyond that, the agency is pushing election officials to hold vendors to standards long common in corporate IT departments: labeling flaws with CVE numbers, notifying customers quickly if source code is stolen or exposed, reporting breaches to authorities, and including a software bill of materials with each product shipped.
Voter databases remain a standing target
Drawing on roughly ten years of incident reporting, CISA describes voter registration databases as a recurring point of interest for foreign hacking groups. The agency's own language is direct about the scale of the attempts and the fraction that have succeeded.
CISA's prescribed defenses for these databases read like a baseline enterprise checklist: multi-factor authentication, network monitoring for anomalies, access limited to what each role actually needs, log retention of at least a year, and a hard separation between the public-facing registration and lookup tools and the master voter database itself.
Insider risk widens with seasonal and volunteer staff
The plan also widens the definition of insider risk far beyond salaried staff, folding in seasonal hires, volunteer poll workers, contractors and outside vendors — a roster CISA flags because these groups often skip the background screening that permanent employees go through. The risk cuts two ways: someone acting with intent could tamper with registration records, ballot definitions, tabulation configurations or how results get reported, while someone merely careless could click a phishing link, insert an unapproved USB drive into voting equipment, or handle it improperly. CISA's recommended countermeasures — bipartisan two-person ballot handling, counting observers, chain-of-custody procedures — are not new, but the agency says they hold up better when formalized into a documented insider threat program rather than left as informal practice.
Physical threats concentrate in one category
On physical security, CISA's plan draws on open-source incident tracking rather than internal reporting alone, and the resulting picture is narrow rather than broad-based.
Heading into the 2026 cycle, CISA is bundling a free information-sharing platform for fusion centers and election officials — the agency points to its earlier use around the 2026 FIFA World Cup as precedent — together with no-cost vulnerability scans, web application testing, ongoing penetration testing, and decoy systems built to catch intruders.
What a budget-holder should ask
Any organization operating under a certification or compliance regime — not just election offices — can use this plan as a prompt for its own governance review. Worth asking a security team directly: Do vendor contracts require CVE disclosure and a software bill of materials, as CISA recommends here? Does the patch approval process force a full recertification cycle for a security-only fix, or can one be applied without retriggering it? Is there a written insider-threat program that explicitly covers seasonal, volunteer and contractor access, not only permanent staff? And are logs retained for at least a year, with public-facing lookup systems logically separated from the systems of record they reference?
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: SecurityWeek.
