CISA 2015 Protections and Federal Funding Face Expiration on December 11 Unless Congressional Action is Taken
Trade associations representing major corporations are actively urging Congress to ensure that a critical law regarding cybersecurity—specifically the Cybersecurity Information Sharing Act of 2015 (CISA 2015)—does not lapse again. This legislation has significant implications for how private sector organizations share cyberthreat information with the federal government, particularly through the Department of Homeland Security. As it stands, the current authorization for CISA 2015 is set to expire on December 11, coinciding with the deadline for government funding.
A coalition including the Business Roundtable, the American Bankers Association, and 33 others, such as the U.S. Chamber of Commerce, formally expressed their concerns in a letter sent on November 1 to the leading members of the House and Senate Armed Services Committees. Their message is clear: without legislative action, critical cybersecurity measures will become defunct, hampering the private sector’s ability to effectively counteract cyber threats.
CISA 2015 grants liability protections and antitrust exemptions to companies, allowing them to freely share information about cyber threats with one another and with governmental bodies. This sharing is vital for enhancing collective cybersecurity efforts. The industry leaders assert that a decade-long reauthorization of this law is essential for national security. Their stance is further supported by the House of Representatives, which passed a version of the defense bill containing provisions for the law’s reauthorization on a narrow vote of 216 to 212 back in July.
However, challenges loom on the legislative horizon. The Senate’s version of the defense bill does not include any extension of CISA 2015. Democrats in the Senate opted not to bring this legislation to the floor during their session in July, creating further uncertainty. The lobbying organizations argue that the absence of legal protections under CISA 2015 would deter companies from sharing vital threat intelligence, which is crucial for staying a step ahead of cyber attackers. They assert that as the speed at which attackers exploit vulnerabilities is increasing—largely aided by AI technologies—the law must remain in force to provide necessary support to organizations facing these evolving threats.
The urgency of extending CISA 2015 has also been recognized at the White House level. A senior official stated in July that a federal initiative called Gold Eagle, which coordinates responses to vulnerabilities identified by AI models, relies heavily on the framework provided by CISA 2015. Therefore, the administration is in favor of extending CISA 2015 for another decade without alterations to its current provisions.
Yet, not all voices support a straightforward extension. Senator Rand Paul of Kentucky, who chairs the Senate Homeland Security and Governmental Affairs Committee, poses a potential hurdle. He has accused the Cybersecurity and Infrastructure Security Agency (CISA) of engaging in disinformation and infringing on the rights of American citizens. As a condition for supporting any long-term renewal, he has pushed for the inclusion of his Free Speech Protection Act, which aims to safeguard First Amendment rights against government censorship. Last year, he prevented a clean 10-year extension of CISA 2015 from sliding through the Senate’s defense bill.
Compounding the difficulty, a draft proposed by Paul in September 2025 sought a two-year extension while also suggesting cuts to the principal legal protections afforded by CISA 2015. Therefore, the fate of this critical piece of legislation remains uncertain.
Since its reinstatement in November 2025, following a previous lapse, Congress has extended CISA 2015 two additional times. The most recent extension came through a stopgap spending bill signed by former President Donald Trump on September 2. Despite these extensions, many Information Sharing and Analysis Centers (ISACs) have indicated that they would continue to exchange threat data among their members even if the protections were to lapse momentarily. However, their leaders have cautioned that any interruption could have a detrimental effect on the quality and amount of information shared with government entities.
As the December 11 deadline approaches, the combined efforts of trade associations, lawmakers, and various stakeholders will be critical in determining whether CISA 2015 will receive the reauthorization it needs to remain effective. The looming expiration of this legislation underscores the ongoing challenges in navigating cybersecurity governance in an increasingly complex digital landscape.