The House has approved a stopgap government funding bill that temporarily extends the Cybersecurity Information Sharing Act of 2015 through December 11, preventing the key cyber law from expiring at the end of September. The Senate previously passed the measure, which now heads to the President for his signature.
Industry groups and federal cyber officials have warned that allowing CISA 2015 protections to lapse could discourage companies from sharing breach and threat information and disrupt real-time intelligence sharing between government and the private sector.
CISA 2015 briefly expired during last year’s government shutdown, and efforts to secure a long-term reauthorization have repeatedly stalled despite calls from the White House and industry for a more permanent solution. The stopgap bill also extends the Technology Modernization Fund and National Cybersecurity Protection System through December 11.
Doc McConnell, Head of Policy and Compliance, Finite State:
“Although it is a positive sign that Congress has extended the Cybersecurity Information Sharing Act of 2015 through December rather than allow it to lapse, short-term renewals are counterproductive to our goals of shared cybersecurity responsibilities and free-flowing threat information.
“The United States has placed a bet that voluntary information-sharing is the best model for collective security. The benefit of pooling threat data means companies can learn from threat activity across the ecosystem and proactively defend themselves, rather than waiting to be targeted individually. CISA 2015 reduces the potential risks to sharing this data by creating liability protections, exemptions from antitrust concerns, and prohibitions on using this data for regulatory enforcement actions.
“Our voluntary approach stands in stark contrast to governments elsewhere, such as the European Union, that have strict mandatory reporting and disclosure requirements. If we want to demonstrate that the voluntary approach can be successful, we need a long-term, predictable structure to build trust. We cannot build that trust if companies expect their risk calculus to change every 90 days.”
Denis Calderone, CTO, Suzu Labs:
“Congress keeps telling us cybersecurity is a national priority and then governing it like it’s an afterthought. This is the second near-lapse of CISA 2015 in a year, and last year’s brief expiration during the shutdown sent legal teams scrambling. Some organizations paused their threat sharing programs entirely until the protections were confirmed back in place. The liability protections in CISA 2015 are what make private sector threat sharing work, and that kind of uncertainty slows down exactly the intelligence sharing that is so needed in the industry. The law has had broad bipartisan support since it was enacted in 2015 and the White House has been pushing for a permanent reauthorization. If you can’t get a long-term deal done on a law that virtually nobody opposes, that tells you everything about where cyber policy actually ranks on the Hill.”
Seemant Sehgal, Founder & CEO, BreachLock:
“Every few months, the industry has to wonder whether the legal framework that makes threat sharing possible will still exist by the end of the quarter. Companies making decisions about what to share and with who are already calculating risk, and this kind of administrative instability changes those calculations before any law actually expires. Extending CISA 2015 to December 11 buys time, but it still doesn’t fix what the recurring uncertainty is doing to the underlying trust that makes information sharing work in the first place.”
Donald McFarlane, Advisory Board Member, Xcape, Inc.:
“It is disappointing that cybersecurity information sharing has once again proved so intractable in Washington.
“I share Senator Paul’s broader concerns about government overreach, but opening voluntarily-shared threat intelligence to FOIA, or stripping away the narrow good-faith liability protections that enable sharing, seems like solving the wrong problem.
“If Washington cannot provide a durable framework for collective defense, it only serves to make private-sector partnerships that are less dependent on Washington look more attractive.”
John Strand, Owner, Black Hills Information Security, Inc.:
“In the early years of computer security, there was a huge reticence to publicly share information about breaches or vulnerabilities in products. Even penetration testing was something that was largely done in the shadows.
“Laws like this helped pull that information sharing out of the darkness. And that sharing is something the entire security industry now lives and breathes on. Researchers share vulnerabilities. Organizations share information about attacks. Security teams share indicators and techniques. That flow of information makes everybody better at defending their networks.
“So I think it’s incredibly important that they extended it. I’m just a little disappointed that this is another short-term extension that only buys us a few more months.
“This shouldn’t be something we have to keep revisiting every few months. It needs to be permanent. We need to make sure the level of information sharing we’ve developed over the past seven or eight years continues without organizations having to wonder whether the legal protections that helped enable it are suddenly going to disappear.”
The CISA does a lot of good work. Honestly, they need to funded in the long term. Otherwise the US is really going to come under threat from a cybersecurity standpoint.
Related
This entry was posted on September 2, 2026 at 3:07 pm and is filed under Commentary with tags CISA. You can follow any responses to this entry through the RSS 2.0 feed.
You can leave a response, or trackback from your own site.
Congress temporarily extends CISA 2015 through December
The House has approved a stopgap government funding bill that temporarily extends the Cybersecurity Information Sharing Act of 2015 through December 11, preventing the key cyber law from expiring at the end of September. The Senate previously passed the measure, which now heads to the President for his signature.
Industry groups and federal cyber officials have warned that allowing CISA 2015 protections to lapse could discourage companies from sharing breach and threat information and disrupt real-time intelligence sharing between government and the private sector.
CISA 2015 briefly expired during last year’s government shutdown, and efforts to secure a long-term reauthorization have repeatedly stalled despite calls from the White House and industry for a more permanent solution. The stopgap bill also extends the Technology Modernization Fund and National Cybersecurity Protection System through December 11.
Doc McConnell, Head of Policy and Compliance, Finite State:
“Although it is a positive sign that Congress has extended the Cybersecurity Information Sharing Act of 2015 through December rather than allow it to lapse, short-term renewals are counterproductive to our goals of shared cybersecurity responsibilities and free-flowing threat information.
“The United States has placed a bet that voluntary information-sharing is the best model for collective security. The benefit of pooling threat data means companies can learn from threat activity across the ecosystem and proactively defend themselves, rather than waiting to be targeted individually. CISA 2015 reduces the potential risks to sharing this data by creating liability protections, exemptions from antitrust concerns, and prohibitions on using this data for regulatory enforcement actions.
“Our voluntary approach stands in stark contrast to governments elsewhere, such as the European Union, that have strict mandatory reporting and disclosure requirements. If we want to demonstrate that the voluntary approach can be successful, we need a long-term, predictable structure to build trust. We cannot build that trust if companies expect their risk calculus to change every 90 days.”
Denis Calderone, CTO, Suzu Labs:
“Congress keeps telling us cybersecurity is a national priority and then governing it like it’s an afterthought. This is the second near-lapse of CISA 2015 in a year, and last year’s brief expiration during the shutdown sent legal teams scrambling. Some organizations paused their threat sharing programs entirely until the protections were confirmed back in place. The liability protections in CISA 2015 are what make private sector threat sharing work, and that kind of uncertainty slows down exactly the intelligence sharing that is so needed in the industry. The law has had broad bipartisan support since it was enacted in 2015 and the White House has been pushing for a permanent reauthorization. If you can’t get a long-term deal done on a law that virtually nobody opposes, that tells you everything about where cyber policy actually ranks on the Hill.”
Seemant Sehgal, Founder & CEO, BreachLock:
“Every few months, the industry has to wonder whether the legal framework that makes threat sharing possible will still exist by the end of the quarter. Companies making decisions about what to share and with who are already calculating risk, and this kind of administrative instability changes those calculations before any law actually expires. Extending CISA 2015 to December 11 buys time, but it still doesn’t fix what the recurring uncertainty is doing to the underlying trust that makes information sharing work in the first place.”
Donald McFarlane, Advisory Board Member, Xcape, Inc.:
“It is disappointing that cybersecurity information sharing has once again proved so intractable in Washington.
“I share Senator Paul’s broader concerns about government overreach, but opening voluntarily-shared threat intelligence to FOIA, or stripping away the narrow good-faith liability protections that enable sharing, seems like solving the wrong problem.
“If Washington cannot provide a durable framework for collective defense, it only serves to make private-sector partnerships that are less dependent on Washington look more attractive.”
John Strand, Owner, Black Hills Information Security, Inc.:
“In the early years of computer security, there was a huge reticence to publicly share information about breaches or vulnerabilities in products. Even penetration testing was something that was largely done in the shadows.
“Laws like this helped pull that information sharing out of the darkness. And that sharing is something the entire security industry now lives and breathes on. Researchers share vulnerabilities. Organizations share information about attacks. Security teams share indicators and techniques. That flow of information makes everybody better at defending their networks.
“So I think it’s incredibly important that they extended it. I’m just a little disappointed that this is another short-term extension that only buys us a few more months.
“This shouldn’t be something we have to keep revisiting every few months. It needs to be permanent. We need to make sure the level of information sharing we’ve developed over the past seven or eight years continues without organizations having to wonder whether the legal protections that helped enable it are suddenly going to disappear.”
The CISA does a lot of good work. Honestly, they need to funded in the long term. Otherwise the US is really going to come under threat from a cybersecurity standpoint.
Share this:
Like this:
Related
This entry was posted on September 2, 2026 at 3:07 pm and is filed under Commentary with tags CISA. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.