Congress Rallies to Extend Cybersecurity Information Sharing Act (CISA): What’s at Stake for US Digital Defense

Introduction

As cyber threats become increasingly complex and relentless, a critical piece of U.S. cybersecurity policy is at a crossroads. The Cybersecurity Information Sharing Act (CISA), first enacted in 2015, is set to expire this September unless Congress takes action. Now, with bipartisan backing, a new bill aims to reauthorize CISA for another 10 years — a move seen as essential for preserving national cyber resilience.

Co-sponsored by Senators Gary Peters (D-MI) and Mike Rounds (R-SD), the proposed legislation reaffirms the importance of a legal bridge between the federal government and private sector entities. This bridge allows for secure, liability-free sharing of threat intelligence — a critical component in combating cyberattacks that target everything from hospitals and schools to major financial institutions and infrastructure.

The conversation is not just about renewal. Experts and industry leaders view this as a timely opportunity to modernize the legislation to meet today’s evolving cyber landscape, ensuring it remains a dynamic defense mechanism in the digital age.

10-Year CISA Extension Bill Gains Bipartisan Support: What You Need to Know

A new bipartisan bill introduced in Congress seeks to extend the Cybersecurity Information Sharing Act (CISA) for an additional 10 years before it expires in September 2025.
Senators Gary Peters and Mike Rounds co-sponsored the legislation, emphasizing the law’s critical role in enabling secure information sharing between businesses and the federal government.
CISA, enacted in 2015, is the legal foundation for programs like the Joint Cyber Defense Collaborative (JCDC), which coordinates public-private responses to major cybersecurity incidents.
The law encourages, but does not mandate, businesses to share cyber threat indicators, while offering them legal immunity if done in good faith.
Without CISA, many organizations may hesitate to share emerging threats due to fears of lawsuits, compliance issues, or reputational harm.
Industry leaders argue that this legal shield is instrumental in breaking down silos and facilitating fast, coordinated responses to national cybersecurity threats.
April Lenhard from Qualys and Chad Cragle from Deepwatch highlight the operational importance of CISA in preventing hesitation and enhancing real-time threat intelligence.
While reauthorization enjoys strong support, there’s a concurrent push to modernize the law — focusing on data privacy, third-party vendor risks, and international intelligence sharing.
Experts note the cyber threat landscape has evolved dramatically since 2015, with more frequent ransomware, nation-state attacks, and supply chain vulnerabilities.
CISA has played a vital role in fostering trust between the government and the tech industry, enabling programs like Information Sharing and Analysis Centers (ISACs).
The bill is seen as a key pillar to continuing successful public-private collaborations, particularly in high-risk sectors such as healthcare, finance, and energy.
Casey Ellis, founder of Bugcrowd, stressed that “cybersecurity is a team sport” and that CISA enables safe and productive collaboration within and across sectors.
The bill’s supporters are urging Congress to act swiftly, as the September deadline for CISA’s expiration looms.
The potential failure to reauthorize could lead to a chilling effect, with fewer companies willing to report threats, ultimately weakening national cyber defenses.
While the current bill focuses on extension, amendments are being considered to fine-tune and adapt the law to today’s digital challenges.

What Undercode Say:

The push to reauthorize the Cybersecurity Information Sharing Act underscores a broader truth: information is the currency of modern defense. Since its inception in 2015, CISA has become a linchpin in America’s cybersecurity infrastructure, enabling public and private entities to respond to threats with a level of speed and cooperation that would be difficult — if not impossible — without a formal legal framework.

From an analytical standpoint, CISA’s most effective feature lies in its dual strategy: it incentivizes collaboration while reducing legal exposure. This legal immunity is not just a safeguard; it’s an enabler. In a world where cyberattacks are increasingly damaging and litigious, removing the fear of liability can be the difference between a company choosing to stay silent or sounding the alarm.

CISA also lays the groundwork for one of the government’s most valuable assets — the Joint Cyber Defense Collaborative (JCDC). This initiative has turned threat response into a collective action, making it harder for attackers to exploit fragmented communication between the public and private sectors.

Yet the world in 2025 is very different from 2015. Cyber threats are no longer just about lone hackers or ransomware; they now involve well-funded state actors, AI-driven exploits, and intricate supply chain breaches. Reauthorizing CISA without modernizing it would be a missed opportunity.

Privacy remains a pressing concern. Critics argue that while companies are protected when sharing data, individuals often lack clarity about how their personal information is being handled. A revamped CISA must address transparency, data minimization, and oversight to maintain public trust.

Additionally, the third-party vendor ecosystem has exploded — with many companies relying on dozens of SaaS tools, platforms, and remote partners. A breach in a vendor’s system can lead to a domino effect. The new bill must consider protocols for vendor-related disclosures and security standards.

Global cooperation is another area ripe for refinement. Cyber threats don’t respect borders. As geopolitical tensions rise, international information sharing will become increasingly vital. Any new iteration of CISA should include provisions for secure, cross-border data exchange, particularly among allies.

In essence, CISA needs not only a renewal but an evolution. Congress has the chance to update a successful model and align it with modern realities. Cybersecurity is a moving target, and laws that govern it must move just as fast — or faster.

The broad bipartisan support is encouraging. It demonstrates a shared understanding that cyber defense is not a partisan issue — it’s a national imperative. By updating and extending CISA, lawmakers can reinforce a foundation of cooperation and resilience that has already proven its worth.

But the countdown is on. If action stalls, the window to reinforce national cyber defense may close — just as threats are peaking. The reauthorization of CISA is not just a political decision; it’s a strategic necessity.

Fact Checker Results

CISA’s original 2015 law is confirmed to expire in September 2025, making the timeline for reauthorization accurate.
The bill enjoys bipartisan sponsorship and industry backing, verified by multiple public statements and interviews.
Claims of operational benefits from CISA are consistent with historical data on collaborative threat intelligence initiatives.