What Happened
A coalition of 35 industry groups sent a letter on Nov. 1 to the leaders of the House and Senate Armed Services committees. They urged negotiators to maintain a House provision that would extend the Cybersecurity Information Sharing Act of 2015 through 2035. Signers include the U.S. Chamber of Commerce, Business Software Alliance, American Bankers Association, Airlines for America, the American Public Power Association, and the National Rural Water Association.
The law's liability protections shield firms from lawsuits and regulatory penalties when they share threat information with federal partners like the FBI or the National Security Agency. This data often includes personal or proprietary information tied to individuals and companies affected by cyber intrusions.
This isn't about a specific breach. It's a recurring issue at the policy level: a legal safeguard your sharing program relies on has repeatedly come close to disappearing, and many programs lack a contingency plan.
Timeline of Events
Here's the timeline:
- Last year: The law lapsed during a record government shutdown. Cybersecurity attorneys received client calls about whether existing agreements still protected them.
- November 2025: Congress restored the law through January 2026 when the government reopened.
- February of this year: Lawmakers extended it again, through Sept. 30.
- Since then: A stopgap funding bill moved the deadline to Dec. 11.
- Nov. 1: The 35-group letter urges a 10-year extension in the annual defense policy bill.
- Open dispute: Senate Homeland Security and Governmental Affairs Committee Chairman Rand Paul wants a provision barring federal officials from pressuring social media companies to restrict speech. He and Sen. Gary Peters have discussed the amendment several times without agreement. Peters and Sen. Mike Rounds pushed for a 10-year extension during last year's shutdown.
The pattern is clear: protection has survived through short-term patches, each with a hard expiration date.
Identifying Control Failures
Treat the lapse as a stress test for your program. The failures to look for are organizational, not technical.
1. No documented legal basis for sharing. Many teams share indicators assuming the statute covers them. If your sharing decisions can't be traced to a written authority and a defined scope, a lapse leaves you guessing.
2. No contingency for loss of liability protection. Counsel were fielding "are we still covered?" calls on day one of the shutdown. This indicates most organizations had no pre-decided answer.
3. Sharing agreements reliant on a single statute. If your contracts and information-sharing arrangements assume protections exist indefinitely, they've built in a single point of failure.
4. Unclear data minimization. Shared threat data can include personal or proprietary information. Without a defined filtering step, you're exposed on privacy and liability grounds.
5. Ad hoc sharing decisions. Without an approval path, individual analysts make legal judgment calls under time pressure.
Compliance Standards and Requirements
CISA 2015 is a liability statute, not a control framework, but your compliance obligations already assume you can share and report. Map the dependency:
- DFARS 252.204-7012 requires contractors to rapidly report cyber incidents and preserve relevant data for DoD analysis. Reporting is a contractual obligation. It doesn't disappear if statutory protections lapse. Have counsel confirm how your reports are protected under the clause's terms.
- NIST SP 800-171 (Rev 2 and Rev 3) includes incident response requirements covering incident handling and reporting. Your documented incident response capability should state who authorizes external disclosure and what gets disclosed.
- NIST SP 800-53 Rev 5 includes incident response controls and supply chain and external-party controls. Incident reporting to designated authorities is an expected, assessable behavior.
- Cybersecurity Maturity Model Certification under 32 CFR Part 170 assesses incident response practices derived from NIST SP 800-171. An assessor will look for evidence that your reporting process exists and works, not for a statutory citation.
- Executive Order 13556 and the CUI program mean Controlled Unclassified Information may be embedded in the data you'd share. Marking and handling rules still apply when you pass indicators to a federal partner.
None of these frameworks tells you to stop reporting if protections lapse. Your obligations stay fixed while your legal cover may not.
Action Items for Your Team
1. Document your sharing authority. Create a short internal procedure naming the statutes, contract clauses, and agreements that authorize each type of disclosure. Include DFARS 252.204-7012 reporting separately from voluntary sharing.
2. Pre-decide your lapse posture. Have counsel provide a written position now: what continues, what pauses, and who decides. Don't wait for a shutdown to find out.
3. Track the Dec. 11 date as a program risk. Put the expiration in your risk register with an owner and a trigger for review. Update it as Congress acts on the defense bill.
4. Separate mandatory from voluntary disclosure. Contractual reporting continues regardless. Voluntary sharing is where a lapse changes your risk calculus. Your procedure should treat them differently.
5. Build a data minimization step into every outbound share. Strip or generalize personal and proprietary details before release unless they're necessary to the indicator. This addresses the privacy balance regardless of what Congress does and reduces exposure under any legal regime.
6. Check CUI before you share. Confirm whether the material contains Controlled Unclassified Information and apply the handling rules before it leaves your environment.
7. Define an approval path. Name who can authorize external sharing, who reviews it, and how fast. Speed matters, so decide this in advance and don't improvise under pressure.
8. Review your agreements. Look at information-sharing agreements and subcontract flow-down language for assumptions that the statute is permanent.
9. Monitor the privacy debate. The dispute over added provisions may shape what a longer renewal looks like. Your minimization and approval controls hold up whichever version passes.
The coalition argues that legal certainty drives sharing speed. Your job is to ensure your program doesn't depend on that certainty arriving on time.
