Watch the Deep Dive of this post
Cybersecurity Showdown: House Advances Key Measures Ahead of September Deadline
The clock is ticking! With crucial cybersecurity authorities set to expire on September 30, 2025, the House Homeland Security Committee has taken decisive action, advancing two significant measures aimed at bolstering our nation’s cyber defenses. These moves are critical for maintaining the flow of cyber threat information between government and industry and supporting vital state and local cybersecurity efforts.
Keeping Cyber Threat Information Flowing
One of the cornerstone efforts is the reauthorization of the 2015 Cybersecurity Information Sharing Act (CISA 2015). This legislation has been instrumental in incentivizing businesses to share cyber threat information with the federal government and with each other. The new House version, introduced by Chairman Andrew Garbarino, goes further:
- It renames the law to the Widespread Information Management for the Welfare of Infrastructure and Government Act (WIMWIG).
- It extends the authorization through 2035, providing long-term stability.
- The updated text maintains the core framework but incorporates targeted updates for today’s environment, including explicit references to the use of artificial intelligence (AI) tools.
- It outlines updated oversight responsibilities for the Department of Homeland Security (DHS) and the Department of Justice (DOJ).
- A key requirement is for the Attorney General and the Secretary of Homeland Security to jointly update and publish policies for threat sharing, with priority on rapid dissemination to state, local, Tribal, and territorial (SLTT) governments and critical-infrastructure owners and operators.
- DHS will also be required to develop and continuously implement an outreach plan, especially for small and rural infrastructure operators.
This bill, H.R. 5079, remarkably cleared committee unanimously, 25-0, showcasing bipartisan support for its core mission.
Strengthening State and Local Cyber Defenses
The second vital bill addresses the State and Local Cybersecurity Grant Program (SLCGP). Created by the 2021 Infrastructure Investment and Jobs Act, this program has already provided $1 billion over four years to help states, localities, and tribal governments fortify their networks. The House committee advanced H.R. 5078, the Protecting Information by Local Leaders for Agency Resilience Act (PILLAR), with a strong 21-1 vote. This measure aims to continue the program for ten years with some key adjustments:
- It proposes a tightening of cost-sharing, generally capping the federal share at 60 percent for single-entity awards and 70 percent for multi-entity awards through fiscal year 2035.
- There’s a potential incentive bump in federal share for states that implement certain identity and access-management controls by October 1, 2027.
- Significantly, the bill bars the use of grant dollars for software or hardware from “foreign entities of concern” and directs alignment with CISA’s “secure by design” guidance.
- The text also shifts from specific references to the Multi-State Information Sharing and Analysis Center (MS-ISAC) to broader “Information Sharing and Analysis Organizations,” which could lead to adjustments for program users.
Why This Matters Now
Cyber policy experts are united in cautioning that a lapse in these authorities would create significant uncertainty for companies that rely on the law’s liability protections. This uncertainty, in turn, could chill real-time information sharing, making our collective defenses weaker at a time when cyber threats are constantly evolving. Both measures have drawn broad industry and state support, emphasizing the urgent need to avoid any gap.
While the House committee’s votes keep the bills moving forward, the final passage hinges on Senate dynamics and calendar realities. Discussions are already underway among lawmakers for a short-term extension, potentially via a stopgap funding bill, to prevent any interruption if a permanent agreement isn’t reached by the September 30 deadline.
The push to advance these cybersecurity measures is a critical step in safeguarding our digital infrastructure and ensuring continuous protection against ever-growing cyber threats.
Tags: Cybersecurity, Information Sharing, CISA, WIMWIG, PILLAR, State and Local Grants, DHS, Critical Infrastructure, AI, Legislative Update, Homeland Security, September Deadline, MarketUS