Watch the Deep Dive of this post
Cybersecurity Alert: Critical National Security Law CISA 2015 on the Brink of Expiration
A vital piece of national security legislation, the Cybersecurity Information Sharing Act of 2015 (CISA 2015), is set to expire at the end of this month unless Congress and the President act to reauthorize it. First signed into law by President Obama in December 2015, CISA 2015 has been instrumental in bolstering the nation’s cybersecurity defenses by fostering a unique, voluntary information-sharing process between private entities and the federal government. Its lapse could have significant consequences for the security of critical infrastructure across the United States.
What is CISA 2015 and Why Does it Matter?
CISA 2015 was established to encourage both private and public sector entities to actively monitor their networks for cyber threats and to share crucial data about these threats with one another. The Act pursues these objectives through three core mechanisms:
- Government-to-Private Sector Information Sharing: It mandates key federal agencies, including the Director of National Intelligence (DNI), the Department of Homeland Security (DHS), the Department of Defense (DoD), and the Attorney General (AG), to develop procedures for sharing classified and unclassified cyber threat indicators and defensive measures with the private sector. This has led to a dramatic increase in information exchange; for instance, DHS shared 12,000,000 unclassified threat indicators in 2020, a 3,900% jump from 2017.
- Private Sector Network Monitoring Authorization: The Act uniquely authorizes private entities to monitor their own networks, or those of other entities with consent, for cybersecurity purposes. This provision was designed to alleviate concerns about privacy and surveillance laws, thereby encouraging robust network defense without fear of legal repercussions. It specifically grants liability protection for such monitoring.
- Protections for Shared Information: CISA 2015 provides special safeguards for information shared under its rules. These include protection from the waiver of evidentiary privileges, limits on how the government can use shared information for regulatory enforcement, and general liability limitations.
However, these authorities and protections are not without boundaries. To qualify, monitoring and information sharing must strictly adhere to the Act’s requirements, focusing on a “cybersecurity purpose,” involving “cyber threat indicators” or “defensive measures,” and requiring the removal of personal information. A “cybersecurity purpose” is defined as protecting information systems or data from cyber threats or vulnerabilities.
The Current State of Play in Congress
The impending expiration has spurred legislative action. On September 2, 2025, House Committee on Homeland Security Chair Andrew Garbarino introduced the “Widespread Information Management for the Welfare of Infrastructure and Government Act.” This proposed legislation seeks to reauthorize CISA 2015 for another decade, largely keeping its core tenets intact. It also introduces minor amendments to integrate artificial intelligence (AI) technology into cybersecurity efforts and mandates the DHS Secretary to create an outreach plan for small and rural critical infrastructure owners, who often lack dedicated cybersecurity staff. The bill received unanimous approval from the House Committee on Homeland Security and is currently awaiting consideration by the full House.
Despite broad support from industry groups advocating for renewal, political obstacles remain. Senate Homeland Security Chair Rand Paul has expressed unwillingness to support the bill without amendments that prohibit the Cybersecurity and Infrastructure Security Agency (CISA, the agency) from engaging in what he terms “anti-disinformation work online.” Reports even suggest Senator Paul has drafted his own version of the bill, proposing a shorter two-year reauthorization with new oversight requirements.
The Grave Implications of a Lapse
Should Congress allow CISA 2015 to expire, the impact on cybersecurity could be severe. Experts estimate that private sector information sharing could drop by as much as 80%. Without the crucial protections related to legal privileges, liability, and antitrust, private entities would likely become hesitant to voluntarily share vital threat information with the federal government or even other private entities due to a perceived increase in risk. This is particularly concerning given that the private sector owns and operates the majority of critical infrastructure in the United States.
While federal agencies might continue some level of information sharing independently, the absence of CISA 2015’s congressional reporting obligations could reduce their inclination to prioritize and monitor such activities. Moreover, a decision by Congress to let the law lapse could be interpreted as a signal that continued sharing is disfavored.
The stakes are high. As the cybersecurity landscape continues to evolve, the collaborative framework established by CISA 2015 is more critical than ever. The ongoing debate in Congress highlights the urgent need to address this critical national security law before time runs out.
Tags: Cybersecurity, CISA 2015, National Security, Information Sharing, Cyber Threats, Private Sector, Federal Government, Critical Infrastructure, Legislation, Privacy, Artificial Intelligence, DHS, Congress, MarketUS