2026 Election Security Plan Released With Focus On Information Sharing
By 813 Staff
Election officials in thousands of counties now have a new federal playbook for protecting voting systems, and it lands less than six weeks before early voting begins in several states. The Cybersecurity and Infrastructure Security Agency published its 2026 Election Infrastructure Security Plan on September 24, outlining how the agency will share threat intelligence, assess physical and digital risks, and coordinate incident response through the November midterms. For voters, the practical effect is largely invisible until something goes wrong: the plan governs how quickly local officials learn about a ransomware campaign against a voter registration database, a phishing wave targeting poll workers, or a disinformation push aimed at suppressing turnout.
CISA announced the plan in a post on X, saying the document covers information sharing and risk work, but the agency has released few operational specifics publicly. According to people familiar with the drafting, the plan expands the use of automated threat feeds pushed directly to state and county election offices, a capability that was piloted in a handful of jurisdictions in 2024 and is now being extended nationally. Engineers close to the effort describe the underlying pipeline as mature but unevenly adopted, with smaller counties still lacking the staff to act on the alerts they receive.
Internal documents reviewed by 813 Morning Brief show the plan also formalizes a tiered escalation model, in which CISA can move from advisory bulletins to on-site support within hours if a state requests it. That request-based structure is a recurring friction point: the agency cannot intervene unilaterally in elections, which are run by states and localities, and some officials have privately complained that the process is too slow for fast-moving intrusions.
The rollout has been anything but smooth. Election security funding has been squeezed in recent budget cycles, and several state and local offices are working with expired or soon-to-expire contracts for endpoint detection software. CISA has not confirmed how many jurisdictions have signed onto the new threat-sharing arrangement, and the agency has not published a timeline for the next phase of implementation.
The near-term test comes in October, when early and mail voting starts in a number of states. CISA says it will maintain a 24-hour operations center through the election and the certification period that follows, a window that in 2020 stretched for weeks. Whether the new plan changes outcomes depends less on the document itself than on whether the counties that need it most actually use it.
