Cybersecurity Information Sharing Act Renewal: Congress Push to Extend CISA 2015 Through 2035

WASHINGTON — A law that lets companies share warnings about cyberattacks with the federal government without fearing a lawsuit for doing so is once again running on borrowed time, and industry groups have just made their most urgent appeal yet for a long-term fix. In a letter dated November 1 2026 to the leaders of the House and Senate Armed Services Committees, a coalition of 35 industry groups urged negotiators on the annual defense policy bill to keep a provision from the House bill that would extend the Cybersecurity Information Sharing Act of 2015, commonly called CISA 2015, through 2035. The signers include the United States Chamber of Commerce, the Business Software Alliance, the American Bankers Association, Airlines for America, the American Public Power Association and the National Rural Water Association.

The appeal matters because the current arrangement is temporary. The law’s permanent authority lapsed at the end of fiscal 2025, during the record government shutdown that stretched from late 2025 into early 2026, and it has since survived only through a series of short-term extensions attached to spending bills. The current extension runs out in December. If no longer-term renewal is agreed, the legal certainty that companies rely on when they pass threat data to federal partners could lapse again, and industry groups warn that sharing would fall just as threats from criminal gangs and foreign adversaries continue to grow.

This article explains what CISA 2015 actually protects, why a defense bill has become its most likely vehicle, where the Senate standoff that has blocked a long-term renewal comes from, and what happens next when Congress returns after the election recess. The dispute is not about whether cyber threat-sharing is valuable in principle. Both parties, and both chambers, have backed long-term renewal in some form. It is about what else, if anything, should be attached to that renewal, and whether a single senator’s objection should be able to keep a broadly supported law on a short leash indefinitely.

Cybersecurity Information Sharing Act renewal: what the law protects

CISA 2015 gives liability protections, including protection from antitrust law, to companies that share indicators of a cyber threat with the federal government or with each other. The indicators in question are technical fingerprints of an attack: malicious internet addresses, malware signatures, methods used to break in, and similar data that defenders need to recognise the same attack elsewhere. The key protections are designed to shield firms from lawsuits and regulatory penalties when sharing that information with federal partners such as the Federal Bureau of Investigation or the National Security Agency. The shared data often includes personal or proprietary information tied to individuals and companies affected by intrusions, which is why the liability shield matters: without it, a company’s lawyers may advise against sharing at all.

Industry groups put the point bluntly in their November 1 letter. In their words, the speed and breadth with which defenders share information determines whether they keep pace with adversaries, and that speed depends on the legal certainty CISA 2015 provides. They have consistently warned that allowing the measure to lapse would create legal risks for companies sharing breach data and lead to a drop in private-sector threat disclosures. On the first day of last year’s shutdown, cybersecurity lawyers were already fielding calls from clients asking whether their existing sharing agreements still protected them. That uncertainty, the groups argue, is itself a security problem, because defenders who hesitate lose the hours in which an attack can be contained.

Supporters also stress that the law is voluntary. It does not compel any company to share anything, and it does not give the government new power to demand data. It removes a legal disincentive to sharing that companies choose to do. Critics, however, say that distinction is thinner than it sounds. Privacy and civil-liberties advocates have long argued that the law’s definition of a cyber threat indicator is broad, that personal information swept up in shared data may be retained and used beyond its original purpose, and that liability protection removes an important check on careless sharing. Those concerns have never been resolved to the critics’ satisfaction, and they resurface every time renewal is debated.

Why the defense authorization bill is now the vehicle

The defense policy bill, formally the National Defense Authorization Act for fiscal year 2027, is attractive as a vehicle precisely because it is one of the few large bills Congress is expected to pass each year. The House passed its version, H.R. 8800, on July 22 2026 by 216 votes to 212, and that bill contains a provision extending CISA 2015 through 2035. The Senate has not passed its own version: a July 14 cloture vote on proceeding to the Senate companion bill, S. 4784, failed by 50 votes to 46, with a motion to reconsider still pending. Before any defense bill can become law, the Senate must act and the two chambers must agree on a single text, a compromise expected to be negotiated by the Armed Services Committee leaders in the lame-duck session.

Attaching the cyber extension to that compromise is a deliberate strategy. A standalone cyber bill would need its own floor time in both chambers, time that is scarce in a short post-election session crowded with other unfinished business. A provision inside the defense bill rides with a package that carries troop pay, procurement and military construction, and that both parties have strong reasons to pass. The industry letter is therefore addressed to the Armed Services negotiators, not to the committees that normally handle cyber policy, because those negotiators will decide which House provisions survive into the final text.

That strategy also carries a risk. If the defense bill stalls, or if negotiators drop the cyber provision to make room for other priorities, the extension falls with it. Industry groups are aware of that risk, which is why their letter frames the provision as something to keep rather than something to add: it is already in the House-passed bill, and removing it would be an active choice, not an oversight. Whether negotiators see it that way will become clear only when a compromise text emerges.

The Senate standoff: Peters, Rounds and Paul

The deeper obstacle is in the Senate, where a long-term renewal has been blocked for more than a year despite bipartisan backing. Senator Gary Peters, a Democrat of Michigan and the ranking member of the Homeland Security and Governmental Affairs Committee, is the sponsor of two bipartisan bills that would extend CISA 2015 through fiscal 2035. The first would extend the programme without changes. The second, introduced during the fall 2025 partial government shutdown, would also have made the liability protections retroactive during the period they lapsed and would have renamed the programme the Protecting America from Cyber Threats Act, in part to avoid confusion with the Cybersecurity and Infrastructure Security Agency, the Department of Homeland Security agency that shares the CISA initials. Senator Mike Rounds, a Republican of South Dakota, has worked with Peters on the ten-year extension effort, and Rounds has previously said he believes a long-term bill would command well over 60 votes, perhaps over 90, if it reached the floor.

The blockade, according to Peters and to reporting on the dispute, comes from the committee’s chairman, Senator Rand Paul, a Republican of Kentucky. Paul has said he has had an amendment for over two years that would, if adopted, make him supportive of a long-term authorisation. The amendment would bar federal officials from pressuring social media companies to restrict speech, in Paul’s words making it illegal for the government to try to restrict speech by sending the Federal Bureau of Investigation to social media headquarters or threatening companies. Paul has said he and Peters have discussed the amendment several times without reaching an agreement, and last year he cancelled a markup that Peters said was expected to include a renewal of the cybersecurity programme.

Peters, for his part, has said Paul has not allowed any kind of long-term extension to be put forward, calling him the impediment and adding that unless he changes his mind, it will still be difficult. Paul’s defenders answer that his concern is not about cyber-sharing itself but about government contact with online platforms, an issue shaped by his criticism of Biden administration efforts to influence content moderation, including posts about COVID-19 and the 2020 election. Peters has accused Paul of conflating CISA 2015, the sharing law, with the homeland security agency of the same initials. Both characterisations are contested, and the practical result is the same either way: a broadly supported renewal has not received a clean vote, and short-term extensions have become the substitute.

What the House has already done

The House side of the story is less contested. Last year, the House Homeland Security Committee voted unanimously to advance a bill by its chairman, Representative Andrew Garbarino, a Republican of New York, that would reauthorise CISA 2015 through 2035 with selected changes. That bill, like Peters’ shutdown-era Senate bill, would also rename the programme, calling it the Widespread Information Management for the Welfare of Infrastructure and Government Act. The unanimous committee vote suggests that, in the House at least, the policy itself is not the problem.

The House bill has nevertheless not been taken up on the floor, with no indication that it will receive a vote before the end of the year. That is why the defense bill provision matters so much to supporters: it offers a path that does not require a separate floor vote on a standalone cyber bill. It also explains why the industry coalition, which spans banking, utilities, airlines, software and water providers, chose to write to the Armed Services leaders rather than simply to the homeland security committees. The coalition’s members are the companies that operate much of the country’s critical infrastructure, and they are the ones whose threat data federal agencies most want to receive.

What a lapse would cost, and what critics still fear

The cost of another lapse is disputed in its details but not in its direction. Michael Daniel, who leads the Cyber Threat Alliance, a membership organisation for companies that share cyber threat intelligence, has said he has not seen too much change in information sharing in the absence of a long-term extension, because sharing has continued under the short-term renewals. He has also said, however, that the uncertain status of the programme has possibly discouraged new organisations from starting or expanding their sharing, and that the ongoing fight has distracted from other cybersecurity policy discussions. His prescription is a medium-term reauthorisation in the law’s current form, to buy time for lawmakers to update it for the age of artificial intelligence, including new types of information companies will need to share, such as data about so-called distillation attacks on AI models.

That AI point cuts both ways. Supporters of updating the law say its 2015 definitions were written before modern AI attacks existed, and that a renewal through 2035 should not simply freeze old language in place for another decade. Critics of a clean extension make a related argument from the opposite direction: if Congress is going to lock in liability protections for ten years, it should first tighten safeguards on personal data and on government use of shared information. A clean extension, in their view, gives away leverage. A conditional extension, in the industry view, risks loading a security law with unrelated fights and losing the renewal altogether. The Paul amendment debate is one version of that tension, but it is not the only one, and it will recur whenever a long-term bill is drafted.

There is also a quieter institutional cost. The law originally expired at the end of fiscal 2025, and it has since been renewed only in short bursts tied to spending bills. That pattern leaves threat-sharing subject to the politics of government funding fights, as one analysis put it, and opens the possibility of further lapses whenever funding negotiations stall. Defenders who cannot be sure the shield will still be there next quarter must build their sharing programmes on an assumption, not a guarantee, and that is a fragile foundation for infrastructure that the country depends on every day.

What happens next for the cyber-sharing renewal

The immediate question is whether the Armed Services negotiators keep the House provision extending CISA 2015 through 2035 in the final defense bill. If they do, and if that bill passes both chambers, the cycle of short-term extensions ends and companies gain a decade of certainty. If they do not, the law will need yet another short-term extension, and the long-term fight will carry into the 120th Congress that convenes in January, with new committee leaders and a new political balance still to be determined by the midterm results.

That next Congress may look different in ways that matter for this law. Peters is retiring, so the Senate Homeland Security Committee’s Democratic leadership will change regardless of which party holds the majority. Senator Maggie Hassan, a Democrat of New Hampshire and the second most senior Democrat on the committee, is a co-sponsor of Peters’ original ten-year extension bill and a plausible successor voice on the issue. On the Republican side, Paul would not be term-limited out of the chair if Republicans keep the Senate, although he could also be a candidate to lead another committee. None of those possibilities guarantees a different outcome, and supporters are careful not to present the next Congress as a solution in itself.

For now, the clearest signal is the November 1 letter itself. Thirty-five industry groups, spanning sectors that rarely agree on much, have jointly told Congress that the current short-term footing is not good enough, and they have pointed to a specific provision in a specific bill as the fix. Congress can accept that advice, amend it, or ignore it. What it cannot do, without consequence, is keep postponing the decision: every short-term extension is another deadline, and the next one arrives in December, whether or not lawmakers have used the intervening weeks to settle the argument that has kept this law in limbo for more than a year.

Sources
USN reviewed reporting from multiple outlets for this story. Read more from Nextgov/FCW [LINK: https://www.nextgov.com/cybersecurity/2026/11/industry-groups-urge-congress-renew-cyber-threat-sharing-law-through-defense-authorization/416985/?oref=ng-homepage-river], GovTech [LINK: https://www.govtech.com/security/federal-cyber-info-sharing-law-languishes-in-senate] and Government Executive [LINK: https://www.govexec.com/technology/2026/11/companies-warn-cyber-threat-sharing-new-legal-protections/416989/].