CISA's 2026 Election Infrastructure Security Plan identifies structural barriers in the certification ecosystem that delay patching of election software vulnerabilities, limiting vendors' ability to release patches and system owners' ability to apply them promptly. State, local, tribal, and territorial election offices often lack mature cybersecurity practices, increasing risk. Voter registration databases have been targeted by foreign adversaries, with confirmed breaches in at least 20 states. Insider risks include malicious or careless actions by permanent staff, temporary workers, volunteers, and vendors, potentially affecting voter databases and election systems. Physical security incidents, primarily bomb threats, are also noted. CISA recommends real-time patching aligned with certification, use of paper ballots and audits, multi-factor authentication, network monitoring, access restrictions, log retention, and formal insider threat programs. The agency provides free cybersecurity services and a no-cost information-sharing platform to support election security.

The plan highlights risks to election infrastructure from delayed patching of software vulnerabilities due to certification constraints, immature cybersecurity practices at many election offices, and insider threats. Voter registration databases have been breached in multiple states, posing risks to voter data integrity and availability. Physical threats such as bomb threats also impact election security operations. These factors collectively increase the risk of disruption or manipulation of election processes if not properly mitigated.

CISA recommends aligning patch management processes with certification requirements to enable timely application of security updates without compromising certification. Election officials should encourage vendors to assign CVE identifiers to vulnerabilities, promptly disclose incidents such as source code leaks, and provide software bills of materials. Use of paper ballots and manual post-election audits is advised to enhance election integrity. Multi-factor authentication, network anomaly monitoring, access limitation, and log retention are prioritized for protecting voter registration databases. Formal insider threat programs incorporating bipartisan controls and chain-of-custody procedures are recommended. CISA also offers free cybersecurity services including vulnerability scanning, penetration testing, and an information-sharing platform to support election security efforts.