US punts renewal of threat data sharing law to September | Computer Weekly

"The United States' Cybersecurity Information Sharing Act of 2015 - CISA 2015 - which came within a hair's breadth of lapsing for good at the end of 2025, will now likely be extended through to the end of September as part of a Department of Homeland Security (DHS) funding package for 2026. The DHS Appropriations Act narrowly passed the House of Representatives on Thursday 22 January, overcoming Democrat objections to funding the controversial Immigration and Customs Enforcement (ICE) agency, which falls under the department's remit. It will head to the Senate where it is expected to be taken up before the end of the month."

"CISA 2015 enables organisations to report and share information on cyber security threats and incidents without fear of being on the receiving end of legal action as a result. The law was first enacted during the Obama years and contained a 10-year sunset clause allowing it to be revisited and revised. By the autumn of 2025, legislators were making progress on a replacement but the federal government shutdown beginning at midnight on 1 October caused it to lapse briefly - although the true impact to real-world data-sharing appears to have been limited."

"Any step forward in putting formal protections in place for information sharing between the private and public sectors should be seen as a positive. If this legislation is passed, industry will get renewed, but temporary safe harbour to share critical threat information. However, as 2025's lapse in those protections made clear, we need a long-term solution. It's critical that protecting cyber security information sharing is considered its own priority in Congress in order to maintain a strong national security p"

CISA 2015 will be extended through September 2026 as part of the DHS funding package, after the House narrowly passed the DHS Appropriations Act on 22 January. The bill overcame Democratic objections to ICE funding and now moves to the Senate for expected consideration before month end. CISA 2015 allows organisations to share cyber threat and incident information without fear of legal action and included a 10-year sunset when enacted. A federal government shutdown on 1 October 2025 briefly caused CISA to lapse despite progress on a replacement. Earlier extensions covered to January 2026; the new extension buys Congress more time to pursue a long-term solution.

Read at ComputerWeekly.com