NEW YORK (AP) — The nation’s cybersecurity agency on Thursday released an election infrastructure security plan 40 days before November’s midterms, laying out potential threats to election systems and listing services it would offer to election officials to protect the vote.

The plan, which Homeland Security Secretary Markwayne Mullin had originally promised to release by mid-August, comes as the Trump administration has been trying to kickstart efforts to help states protect voting systems. Election officials have argued that such efforts are too little, too late after the administration gutted the agency’s election security work last year, prompting the officials to pay for private services to ensure they were prepared for the upcoming elections.

“Election security is national security,” Mullin said in a statement Thursday. “This plan, which will be implemented in full, is crucial to the security, freeness, and fairness of choosing the leaders of our country.”

The document warns of various threats to election security, including software vulnerabilities, hacks of voter registration databases, insider threats and physical security incidents, such as bomb threats that targeted several polling locations in the 2024 elections.

But it affirms that many longstanding election practices can address such threats and says the agency's goal is “to ensure the American people can trust voting systems and know that physical safety measures will be in place when they go to their assigned polling locations to cast their votes.”

Its release follows Mullin's efforts in recent months to advance unsubstantiated claims about hundreds of thousands of noncitizens on voting rolls in various states. In July, Mullin threatened election officials with fines, penalties or prison time if they didn't participate in a now-blocked federal voter database to hunt for noncitizens on the rolls. Even as President Donald Trump continues to claim noncitizen voting is a widespread problem, research shows it is extremely rare.

The U.S. Cybersecurity and Infrastructure Security Agency, which is housed under the Department of Homeland Security, has since its founding in 2018 helped warn state and local election officials about potential threats from foreign governments.

But CISA, as it’s known, was largely absent from that role in last year’s elections after the Trump administration dismantled much of its role on election security. The administration cut some 1,000 employees from CISA and slashed $10 million from two cybersecurity initiatives, including one dedicated to helping state and local election officials.

CISA has also gone the entirety of Trump’s second term without a Senate-confirmed director, instead cycling through a series of acting leaders.

Plan refers to ‘consistent’ support that many election officials say has been lacking

The 13-page document released Thursday says DHS has “consistently supported CISA’s delivery of cybersecurity and physical security services to election officials,” and that such services are provided at no cost to state and local election officials at their request.

Numerous state election officials around the country have told The Associated Press otherwise, noting that services historically provided by CISA, such as live tabletop exercises and penetration tests to evaluate security of their systems, were not available in the lead-up to this year's midterm elections.

Minnesota Secretary of State Scott Simon, a Democrat, said in August that his office expects to spend roughly $250,000 on private vendors to conduct penetration testing, which can expose security vulnerabilities and recommend actionable fixes.

Shenna Bellows, the Democratic secretary of state in Maine, told the AP the same month that communications with CISA had been “sporadic and irregular, to say the least.”

She said it would be helpful if the Trump administration could restore intelligence briefings that used to be granted to election officials about threats from foreign adversaries, but noted that trust with federal officials had been broken with the cuts to the agency.

Thursday's plan doesn't mention any specific 2026 threats from adversaries like Russia, Iran or China, all of whom have sought to meddle in U.S. elections — either directly through hacking or indirectly through influence campaigns.

Kris Warner, the Republican secretary of state in West Virginia, said Thursday that some of CISA’s assistance to his state had been continual throughout the Trump administration, including no-cost reviews of its public-facing websites for cybersecurity issues.

Warner acknowledged CISA had cut back under the Trump administration but said he views the agency “as a resource and not as a service provider” and said his office had last year hired a departing CISA election security adviser who has helped fill any gaps that may exist.

Cisco Aguilar, the Democratic secretary of state in Nevada, said Thursday he hadn't had a chance to review the report but that its lateness indicated a “complete, absolute failure of leadership.”

“For them to come in five weeks before the election, yeah, nice effort," Aguilar said, adding that he would have liked to see the federal government give more funding for cybersecurity, rather than Nevada taxpayers having to pay for it.

The agency's new document explains that CISA's support to election officials is led by 10 “regional directors,” a structure that strays from how CISA had operated in the past, said David Becker, executive director of the Center for Election Innovation and Research. In the past, there were state and regional advisers, he said.

Becker said the new report was a positive step, but perhaps a performative one given that states have already turned to other resources.

“The reality is that no state, red or blue, is relying upon the federal government for this assistance at this point,” he said.

Report follows August call between CISA and election officials

In early August, two CISA officials – acting director Nick Anderson and assistant director for integrated operations Jim Harrell – joined a National Association of Secretaries of State call attended by a bipartisan group of secretaries of state, according to several election administrators.

Simon said the officials appeared interested in rebuilding relationships and previewing their future plans, which he appreciated. But he said the effort at goodwill came later than election officials needed.

“I would say it’s a pretty low bar for them to win the expectations battle because secretaries of state have already moved on and sought other partners and other resources for the services that CISA has retreated from over the last year and a half,” Simon said.

At one point in the call, Arizona's Democratic Secretary of State Adrian Fontes voiced concerns about the withdrawal of federal resources.

Fontes told the AP at the time that he told the CISA officials he didn’t trust them. He said it seemed to him the officials were there “to cover their butts.”

“They even acknowledged on the call that it was too late for them to do anything for 2026,” he said. Still, he added, he’s confident that November’s elections will be secure.

“We’re going to have a good election whether or not we have a partner in CISA or the Department of Homeland Security,” he said.

___

Associated Press writer Jessica Hill in Las Vegas contributed to this report.