IC Oversight & Policy — 2026-09-28

CISA Unveils 13-Page Midterm Election Security Plan Covering Cyber, Insider and Physical Threats

BLUFCISA's voluntary framework cannot close the certification, patching, and local capacity gaps it identifies, leaving midterm election infrastructure defense contingent on uneven state-level uptake.

CISA released a 13-page Election Infrastructure Security Plan, "Securing the Next 250," on September 24, directed by DHS Secretary Markwayne Mullin, outlining voluntary no-cost services including threat information sharing, vulnerability scanning, and technical assistance for state and local election officials 1. The plan identifies three cybersecurity threats to elections: software vulnerability management hampered by outdated certification regimes, inconsistent vendor transparency on patches, and cybersecurity immaturity in state and local networks 23. CISA states that hackers have attempted to breach voter registration systems in all 50 states, with confirmed success in at least 20 2. CISA also published an 11-page guide on securing statewide voter registration databases, originally drafted in July, plus a separate report on lessons learned from election security work between 2019 and 2024 2.

Analysis
CISA's plan shifts the burden of defense onto voluntary uptake by state and local officials, leaving three structural problems unresolved before November: outdated certification regimes, inconsistent vendor patch disclosure, and immature local network security. The agency routed its voter-registration-database guide and 2019-2024 lessons-learned report through a footnote and resources page rather than the headline rollout, even as it confirms breach attempts against registration systems in all 50 states. The pattern is more consistent with routine document-management practice than deliberate suppression ahead of the midterms. Sourcing rests on DHS's and CISA's own primary releases, corroborated by independent secondary reporting that converges without adding adversarial detail. Proposed fiscal 2026-2027 budget cuts cap how much "no-cost" assistance CISA can deliver at scale, leaving pre-Election Day adoption dependent on state-level capacity and political will the agency cannot compel.

4 sources

DHS Announces Release of 2026 Election Infrastructure Security Plan - U.S. Department of Homeland Security
CISA provides guidance on securing voter registration databases under rollout of Election Day priorities - Inside Cybersecurity
CISA Election Security Plan Flags Patching Barriers, Voter Database Attacks - SecurityWeek
Securing the Next 250: 2026 Election Infrastructure Security Plan - CISA