With the November midterms weeks away, Ohio Secretary of State Frank LaRose has rolled out an expanded version of his office’s Ready for November initiative, pairing statewide training for local election officials with a mandatory cybersecurity audit of all 88 county boards of elections.
A Statewide Readiness Push
LaRose’s office announced the expanded 2026 version of Ready for November on June 17, describing it as a training push built on lessons from the 2020 and 2024 elections. The program includes Regional Readiness Seminars covering election-day procedures and disaster preparedness, along with Ohio Tabletop the Vote, a series of virtual cybersecurity exercises run jointly with county boards and their IT staff to rehearse how they would respond to a ransomware attack, a phishing attempt, or another intrusion in the middle of an election. The initiative builds on a 2025 statewide conference that drew nearly 500 election administrators from 85 of Ohio’s 88 counties.
A Seventh Directive in Six Years
Underpinning the training is a cybersecurity directive LaRose issued March 17, 2026, his seventh election security directive since taking office. It requires every county board to review its compliance with existing state security standards, undergo a formal cybersecurity audit, and resolve any findings by August 31, 2026. To help offset the cost, the secretary of state’s office is distributing a $10,000 security grant to each county board. The directive spells out specific required protections, including continuous network monitoring and intrusion detection, regular vulnerability scanning, advanced endpoint threat detection on election systems, and secure, verified backups of voter registration data.
Coordinating Beyond the Statehouse
The initiative also folds in law enforcement and homeland security briefings intended to sharpen coordination between county boards and local, state, and federal agencies in the event of a physical or cyber incident at a polling place or counting facility. That layered approach mirrors a national pattern this cycle: in February 2026, the FBI invited election officials nationwide to a briefing on midterm preparations that also involved the Department of Homeland Security, the Justice Department, the U.S. Postal Inspection Service, and the Election Assistance Commission, reflecting how thoroughly federal agencies have embedded themselves in state-level planning for November.
Building on a Pattern of Escalating Directives
LaRose’s seventh directive did not emerge in a vacuum. Ohio has steadily tightened its election security requirements since 2019, when the secretary of state’s office first mandated basic cybersecurity standards for county boards following warnings from federal intelligence agencies about foreign interference attempts in the 2016 and 2018 elections. Each subsequent directive has added requirements, from multi-factor authentication to mandatory incident reporting timelines, as county systems have become more networked and, by extension, more exposed to remote attack. Election security specialists generally regard this layered, iterative approach as sound practice, even as they caution that no single directive can fully close the gap between well-funded, well-staffed boards in Ohio’s largest counties and their smaller, rural counterparts.
Resources Still Lag the Mandates
Not every county is equally equipped to meet LaRose’s August 31 deadline. Smaller, rural boards of elections often run on skeleton IT staffs, sometimes relying on part-time contractors or county government technology departments already stretched thin, and a flat $10,000 grant covers a fraction of what a full audit, remediation, and new monitoring tools can cost. That gap reflects a broader national pattern: the U.S. Election Assistance Commission has separately flagged chronic strain in election offices nationwide, noting in its own 2026 recruitment push that nearly half of jurisdictions surveyed reported difficulty simply staffing elections, before even accounting for specialized cybersecurity needs. Ohio’s approach, mandates paired with modest state funding, illustrates the tension many states face between tightening security standards and ensuring the officials actually running elections have the money and staff to meet them.
What’s Next Before Election Day
With the August 31 compliance deadline now passed, attention shifts to whether Ohio’s 88 county boards actually cleared their audit findings in time and whether the tabletop exercises translate into smoother responses if a real incident occurs on or before November 3. LaRose’s office has not yet detailed how many counties met the deadline in full. Ohio’s math matters beyond its own borders: the state hosts competitive statewide and congressional races this cycle, and any disruption, whether a cyberattack, a mechanical failure, or simple human error at a county board, could draw outsized national attention in a midterm where control of Congress may again come down to a handful of close contests.
Photo: webandi / PIXABAY via Pixabay
