Industry groups urge Congress to renew cyber threat-sharing law through 2035

Thirty-five industry groups sent Congress a letter on Nov. 1, 2026, asking leaders of the House and Senate Armed Services committees to renew the Cybersecurity Information Sharing Act of 2015 through 2035 by adding it to the fiscal 2027 National Defense Authorization Act before the stopgap expires Dec. 11, 2026.

The law lets private companies voluntarily share cyber threat indicators and defensive measures with federal partners. It protects firms from lawsuits and regulatory penalties for sharing cyber threat information. Those federal partners include the FBI and the National Security Agency. Data exchanged under the statute frequently includes personal and proprietary details about people and companies injured in cyber intrusions.

The Business Roundtable led the Nov. 1 letter urging renewal. Other signers include the U.S. Chamber of Commerce, the Business Software Alliance, the American Bankers Association, Airlines for America, the American Public Power Association, and the National Rural Water Association. Together they represent banking, utilities, aviation, telecommunications, and technology.

The groups said advanced artificial intelligence systems can find and exploit software flaws at machine speed, cutting the time between discovery and attack. They said AI tools make advanced cyber capabilities cheaper and faster to deploy, letting threats spread and adjust quickly. They argued that whether defenders keep pace with attackers depends on how fast and how widely they share threat information and that this speed rests on the legal certainty the law provides. “That speed depends on the legal certainty CISA 2015 provides,” the groups said.

Congress passed the Cybersecurity Information Sharing Act of 2015 in 2015 after a breach at the Office of Personnel Management exposed private information belonging to millions of federal employees and contractors. Private firms may voluntarily share threat indicators and defensive measures with the government under the law. The law lapsed during the 2025 record government shutdown, and lawmakers restored it through January 2026 after reopening the government in November 2025. In February 2026, they extended it through Sept. 30, then moved the expiration to December with a stopgap funding bill.

A coalition of 13 trade associations pressed for extension before a Sept. 30, 2025, deadline in a Sept. 4, 2025, letter. Legislation led by Representative Andrew Garbarino (R-NY) cleared the House Committee on Homeland Security by a unanimous 25-0 vote during the 2025 push for renewal.

Senator Rand Paul blocked scheduled renewal votes in September 2025. His alternative bill would extend the law by two years and curtail Department of Homeland Security work on foreign disinformation. Paul has tied his support for a long-term extension to language that would limit Cybersecurity and Infrastructure Security Agency activities he says threaten free speech. That language includes a provision barring administration officials from pressing social media companies to restrict speech.

During the 2025 government shutdown, Senators Gary Peters and Mike Rounds pushed for a 10-year extension of the law. The House’s fiscal 2027 defense bill includes a 10-year extension, while the Senate version leaves it out. The annual defense policy measure passes near the end of a calendar year or at the start of the next one. A possible shuffle in congressional committee leadership could alter the law’s prospects in 2027.

Top Trump administration cyber officials asked Congress for a straightforward extension of the Cybersecurity Information Sharing Act of 2015. The administration has promoted its efforts to scale back the Cybersecurity and Infrastructure Security Agency’s disinformation work. The Biden administration said the agency’s work did not violate free speech and that it had ended the activity.

Industry groups warn that letting the measure lapse would create legal risks for companies sharing breach data. They predict that private-sector threat reporting would fall if the law expires. During the first day of the 2025 shutdown, cybersecurity lawyers were already receiving calls from clients asking whether existing sharing agreements still protected them.

In a May 2025 letter, the chamber said no inspector general review had found abuse of personally identifiable information under CISA implementation. Personally identifiable information is data that can identify a specific person. The letter offered an industry assurance about privacy safeguards under the law during the earlier push for renewal.