US cybersecurity agency releases election security plan 40 days before midterms

Key facts

• CISA released a plan to protect election infrastructure 40 days before the midterm elections.
• The plan offers free resources to state and local election offices, voter registration machine owners, ballot storage facilities, and polling places.
• Resources include on-site penetration testing, vulnerability scanning, and tabletop exercises for responding to cyberattacks.
• Homeland Security Secretary Markwayne Mullin stated the plan is crucial for the security, freeness, and fairness of elections.
• CISA acting Director Nick Andersen described the plan as part of a holistic approach to securing critical US networks.

The Cybersecurity and Infrastructure Security Agency (CISA) has unveiled a comprehensive plan to bolster the security of US election infrastructure, just 40 days before the midterm elections. The plan outlines free resources for "election infrastructure stakeholders," defined as state and local election offices, owners of voter registration machines, facilities that store ballots and other election equipment, and polling places. These resources include on-site penetration testing, vulnerability scanning, and access to CISA’s tabletop exercises to help organizations practice responding to a cyberattack. CISA and the Department of Homeland Security had largely put these services on hold early last year while evaluating CISA’s election security work. "CISA’s goal is to ensure the American people can trust voting systems and know that physical safety measures will be in place when they go to their assigned polling locations to cast their votes," the plan reads. "Election security is not a partisan issue. Election security is national security." Homeland Security Secretary Markwayne Mullin stated in a release that the plan, "which will be implemented in full, is crucial to the security, freeness, and fairness of choosing the leaders of our country." CISA acting Director Nick Andersen had previously noted the agency’s "holistic approach" to securing critical U.S. networks includes protecting elections.