CISA activates election incident group for Nov. 1-5 midterms
CISA calls the group routine, but the plan it supports landed less than six weeks before Election Day and the election security work behind it has been cut.
TL;DR
CISA's Incident Coordination Group is running Nov. 1-5 and around the clock on Election Day, sharing information among federal, state, local and private-sector partners, a spokesperson told Inside Cybersecurity, describing it as part of "CISA's routine election posture." It supports a 2026 election plan published Sept. 24, which Bennie Thompson and Jim Himes told DHS Secretary Markwayne Mullin on Oct. 20 had "arrived weeks behind schedule." Election security work has been cut under the second Trump administration, so the routine is being run with less behind it.
The Incident Coordination Group is an internal CISA coordinating body stood up for specific events, and a source told Inside Cybersecurity it "mirrors what CISA has done for internal operational coordination in past elections." On Election Day it runs around the clock, assessing incoming incident reports and feeding recommendations into coordinated responses across federal, state, local and private-sector partners. CISA has done visible versions of this before, standing up an election day operations center in 2022 with federal agencies and election officials' representatives in the room (https://insidecybersecurity.com/daily-news/cisa-stands-election-day-operations-center-monitor-threats-close-collaboration-partners) and hosting an Elections Operations Center in 2023 (https://www.cisa.gov/news-events/news/election-day-cisa-and-partners-coordinate-security-operations).
The 2026 activation arrives on schedule. The document behind it didn't.
CISA published its 2026 election infrastructure security plan on Sept. 24, less than six weeks before Election Day, routing information sharing with DHS through state-run fusion centers and laying out the no-cost cybersecurity services available to election officials. On Oct. 20, House Homeland Security ranking member Bennie Thompson and House Intelligence ranking member Jim Himes wrote Mullin that the plan "arrived weeks behind schedule" and was "too late to be of use to state and local election officials." Election security work has been cut during the second Trump administration, and the Nov. 1 start date doesn't settle whether the agency has the staffing and the standing with state and local officials to run what it ran in past cycles.
For anyone outside the building, the concrete deliverable in CISA's Nov. 2 statement is access, upon request, to a no-cost information sharing tool, granted to authorized federal, state and local partners. The spokesperson also pointed to regional teams that assess risk and help partners strengthen defenses.
Published ·Deep Fathom