Certification rules slow election-system patching, CISA's 2026 security plan says

CISA's proposed fix is to align patch management with certification requirements, so security updates can be applied in real time without affecting a system's certification ^[6]. SecurityWeek's account of the plan does not say who would change those requirements or when ^[6].

Certification is one of three problems the plan names. The other two are inconsistent vendor transparency about vulnerabilities and patch status, and the cybersecurity immaturity of many state, local, tribal and territorial networks that host election systems ^[5]. CISA's own assessments show those election offices often struggle with basic cyber hygiene and vulnerability remediation ^[3].

So the plan supports a structural explanation for part of the gap. I think it holds for certified election systems that lag on vendor fixes. It explains less about the first step of the intrusion CISA describes, a compromise of office email or a workstation on the general enterprise network ^[4]. Remediation there is the local work CISA's assessments say offices struggle with ^[3].

For the count, CISA recommends paper ballots and manual post-election audits ^[7]. A hand audit does not depend on the tabulator's patch level ^[7].

The voter registration figures cover reports from the past decade, and CISA calls registration databases attractive targets for foreign adversaries ^[8]. Its controls for those databases start with multi-factor authentication, anomaly monitoring and access limited to what each user's job needs ^[9]. Critical logs are kept for at least a year, and the public online registration and lookup tools are walled off from the master database ^[9].

Seasonal workers and volunteer poll workers may not get the vetting permanent staff do ^[10]. CISA says a malicious insider could make unauthorized changes to voter registration databases, ballot definitions, tabulation settings or results reporting ^[10]. Of 107 election-related security incidents tracked in open-source reporting since January 2022, 96 were bomb threats ^[16], about 90 percent ^[17].

More than 10,000 local jurisdictions run US elections, and state and local officials hold primary responsibility for protecting the infrastructure ^[15]. CISA's part is free help: vulnerability and web application scanning, continuous penetration testing, risk and vulnerability assessments, and decoy systems and canary tokens for spotting intrusions ^[12]. For the 2026 cycle it is also supporting a no-cost information-sharing platform for fusion centers and state and local election officials ^[11].