CISA 2026 Election Security Plan: Eight Questions to Ask

On September 24, 2026, CISA published its 2026 Election Infrastructure Security Plan. For election-technology teams, the useful response is not to treat it as a new certification or a generic checklist. Ask whether the people, systems, suppliers, and recovery decisions behind the next election are ready to hold up under pressure.

These prompts guide security, compliance, and product leaders. Applicable law, governing rules, contracts, and delegated authority still control.

What CISA’s new plan is, and what it is not

CISA frames election infrastructure security as year-round work that depends on coordination among state, local, and federal partners. It is not a law, a platform approval, or a declaration that any voting method is suitable for every election.

That boundary matters. A public election office may have statutory procedures, certification duties, and records rules that a private membership organization does not. A union, cooperative, association, pension fund, or board election may instead be governed by bylaws, notice, and contracts. A vendor’s security controls do not settle either set of legal questions.

But operational discipline travels well. Before voting opens, the provider and election administrator should be able to explain who owns critical work, how they will recognize a problem, who can decide quickly, and what evidence will remain after an incident. Votem’s election operations resources put that work in context.

Eight questions to ask before launch

Use these questions in a working session with the election administrator, technical owner, support lead, and critical vendors. Record the answer, owner, date, and supporting evidence for each one.

• Which services and data are election-critical? Map the voter or member file, access systems, ballot configuration, credential delivery, support channels, result exports, and third-party handoffs. The undocumented dependency is often the one discovered during an outage.


• Who can act, and who can approve? Name the operational owner, security escalation point, customer contact, and decision-maker for notices, access exceptions, and incident closure. A help-desk agent should not have to improvise policy at 8:55 p.m. on closing night.


• Is privileged access narrow and reviewable? Remove stale administrator and contractor accounts, give each role only the access it needs, and retain a reviewable record of elevated activity without exposing ballot choices.


• Has the incident response plan been exercised? Walk through a credential failure, suspected account compromise, outage near close, and misleading results claim. Test the escalation path, not just the technical fix.


• Can the operation recover without changing rules on the fly? Document recovery objectives, backup communications, and vendor contacts. Any extension or alternate access method must be evaluated against the governing rules and existing authority; it is never an automatic platform feature.


• Can the team detect and document an incident responsibly? Preserve system events, support tickets, vendor notices, approvals, and corrective actions. Keep administrative and participation records separated from ballot content.


• Are communications agreed before they are needed? Prepare concise templates for voters, customer contacts, and internal responders. A useful status notice explains the impact and next update time without speculation or sensitive detail.


• What will the after-action file contain? Identify the logs, change records, approvals, reconciliations, certification material, and incident reports that belong in the election file. Align retention with the requirements that govern the election.

Instead of asking whether a platform is “secure,” ask to see the access-review process, escalation procedure, test record, and evidence package. That is where an assurance becomes an operational commitment.

Use CISA support carefully and directly

The plan points readers to CISA support for election infrastructure. CISA also maintains a directory of no-cost cybersecurity services and tools. Those offerings are voluntary, requested through CISA, and subject to its scope and availability. They are not a promised outcome or a substitute for an organization’s own risk decisions.

Identify the gap that needs attention: an exercise, assessment, external-exposure review, continuity discussion, or better coordination with a customer’s security team. Take current eligibility and service details from CISA.

Public-election administrators should also keep their own requirements in view. The Election Assistance Commission’s security-preparedness resources provide additional context. Private and member-election administrators should compare the same questions against their governing documents and counsel’s advice where appropriate.

When voter-registration database guidance applies

On the same day, CISA released guidance on threats to statewide voter-registration databases. That publication concerns a specific public-election data environment. It should not be used to claim that every member roster, customer list, or online voter file has the same legal or technical profile.

It is relevant when the data flow is real. A provider or election office that handles, connects to, or receives data from a statewide registration environment should map what arrives, where it is stored, who can access it, how long it remains available, and who must be alerted if an incident occurs.

The same discipline applies to ordinary election data. Know what information is necessary, protect it for the required period, and remove or restrict it when its authorized purpose ends. A well-designed online voting platform can support those controls, but the administrator and provider still have to operate them deliberately.

A 30-day operating review

Give one accountable leader 30 days to run a focused readiness review and retain the outputs in the election file.

1. List the critical services, data stores, vendors, and operational owners for the next election.


2. Review privileged access, current contacts, escalation routes, and communications approvals.


3. Run one tabletop scenario that combines a technical problem with a voter-support or communications decision.


4. Document the recovery path, decision authority, evidence to retain, and open remediation items.


5. Confirm that remediation work is complete before the election opens.

Keep the output practical: named owners, dates, decisions, and evidence locations. A plan that cannot answer who makes the next call is a filing artifact, not a contingency plan.

Frequently Asked Questions

Is CISA’s 2026 Election Infrastructure Security Plan mandatory?

No. The plan is a CISA resource, not a universal legal mandate or product certification. Election offices, private organizations, and vendors must follow the rules and authorities that apply to their own election.

Can an online voting provider decide to extend an election after an outage?

Not on its own. An extension or alternate access path depends on the governing rules, notice, delegated authority, and facts of the incident. Those decision rights should be agreed and documented before the election whenever possible.

Does voter-registration database guidance apply to membership election rosters?

Not automatically. CISA’s September 24 guidance addresses statewide voter-registration databases. Other voter or member files should be assessed on their own facts.

What evidence should be retained after a security incident?

Preserve the timeline, relevant logs, support and vendor records, decisions, communications, recovery actions, and follow-up work. Protect ballot secrecy and follow the retention and disclosure requirements that govern the election.

The Bottom Line

The value of CISA’s new plan is not a one-time badge. It is a prompt to make resilience observable: clear ownership, tested responses, disciplined communications, and evidence that survives an incident. The strongest teams do that work before a voter asks whether the system is ready.

If your next election needs a practical review of roles, controls, testing, and incident readiness, talk with the Votem team before you set the final election calendar.