States and counties need to conduct regular security assessments ahead of November and beyond, a former federal cybersecurity strategist said.