Thirty-five business associations have asked the lawmakers negotiating the annual defense policy bill to keep a 10-year renewal of the Cybersecurity Information Sharing Act of 2015, the law that shields companies from liability when they share cyber threat data, before it expires Dec. 11, CyberScoop reported Monday. For corporate security and legal teams, the outcome decides whether that sharing continues under settled legal protections.
What Happened
In a Nov. 1 letter led by Business Roundtable, the groups wrote to the chairs and top Democrats of the Senate and House Armed Services committees: Sens. Roger Wicker and Jack Reed and Reps. Mike Rogers and Adam Smith. Signers include the U.S. Chamber of Commerce, the American Bankers Association, the American Petroleum Institute, the Edison Electric Institute, CTIA and TechNet.
They asked negotiators on the fiscal 2027 National Defense Authorization Act (NDAA) to keep Section 1706 of the House bill, H.R. 8800, which would extend the law for 10 more years. The House version includes the extension; the Senate version does not, CyberScoop reported.
The law is often called CISA 2015, but it is separate from the Cybersecurity and Infrastructure Security Agency, also known as CISA. Its original 10-year term ran out in 2025, and Congress has since relied on short-term renewals, with lapses in between.
Why It Matters
The letter argues that artificial intelligence lets attackers find and exploit software flaws at "machine speed" and makes advanced tools cheaper, so the pace of sharing between defenders matters more. The law provides "the liability protections and legal certainty needed to encourage such sharing," the groups wrote. If it lapses, company lawyers may advise sharing less with peers and federal agencies, slowing warnings that help others block the same attacks. The signers span banking, energy, telecommunications and other critical sectors, where that exchange is most routine.
Context
Sen. Rand Paul, the Kentucky Republican who chairs the Senate Homeland Security and Governmental Affairs Committee, has objected to past efforts to add a long-term extension to the defense bill and has tied his support for any long-term extension to curbs on past practices at the agency CISA that he says threaten free speech, CyberScoop reported. Top administration cyber officials have urged a straightforward extension.
The agency itself leans on voluntary cooperation with industry: The Primary Wire reported in October, citing The Register, that its acting director called partnerships the core of its mission.
What to Watch
The test is whether NDAA negotiators keep Section 1706 in the final agreement before Dec. 11, and if not, whether Congress passes another short-term extension or lets the law lapse again. CyberScoop noted that possible changes in committee leadership in 2027 could alter the outlook, but the December deadline comes first.
