Congress Kicked the Can Again on CISA 2015 & Here’s Why the Pattern Itself Is the Risk

The Cybersecurity Information Sharing Act of 2015 was supposed to expire September 30. Again. This is now the fourth time in thirteen months that this law has approached its sunset date, and the fourth time Congress has resolved it with a short-term patch rather than a durable fix and this time extending the law through December as part of a broader continuing resolution.

If you’re tracking this closely, you already know the history. If you’re not, here’s why a board-level GRC function should be tracking it regardless of whether your organization directly participates in formal information sharing programs.

The Pattern, Not Just the Law

CISA 2015 establishes the legal framework that lets private companies share cyber threat indicators and defensive measures with the federal government and with each other, with liability protection, antitrust safe harbor, and FOIA exemptions attached to that sharing. It’s the legal plumbing underneath most of the collective cyber defense infrastructure built over the last decade: ISACs, threat intel sharing agreements, and the informal networks that let a bank tell another bank about an active campaign without opening itself up to a lawsuit for doing so.

The law originally expired September 30, 2025, lapsed for several weeks, was reauthorized through January 30, 2026, lapsed briefly again, was reauthorized through September 30, 2026 as part of February’s funding legislation, and has now been extended again through December via a continuing resolution. Congress has passed a version of “we’ll deal with this later” four times in just over a year.

The recurring short-term extension pattern is itself the risk. Every time this law approaches expiration, organizations that rely on its protections have to reassess their information-sharing practices, evaluate exposure to antitrust risk and FOIA disclosure, and in some cases pause or modify sharing activity until the legal status is resolved. That’s not a one-time compliance event. It’s become a recurring quarterly disruption to an activity that’s supposed to be foundational and stable.

What Actually Happens When It Lapses

When CISA 2015 lapsed in 2025, information sharing did not collapse, but uncertainty slowed it. Companies continued sharing information with peers and with the government, but with less confidence about their legal protection for doing so, and legal counsel at many organizations advised pausing or scaling back sharing activity until clarity returned.

That’s the practical risk for your program: not that the law disappears and information sharing stops entirely, but that your organization’s participation in threat intelligence sharing becomes legally uncertain at unpredictable intervals, disrupting exactly the kind of collective defense activity that’s most valuable during active threat campaigns.

The timing risk compounds this. The current administration’s OT Cybersecurity Coalition and other industry groups flagged this specific concern in July, warning that a lapse would be especially damaging given recent attacks on water and wastewater systems and the accelerating use of AI in both offense and defense. A federal AI cybersecurity clearinghouse program (the Treasury Department’s “Gold Eagle” initiative) is explicitly built on CISA 2015 authorities. Programs like that don’t function well when their underlying legal authorization is renewed in ten-day and forty-five-day increments.

Why This Belongs in Your Governance Conversation

If your organization participates in a sector ISAC, shares threat intelligence with peers, or has any structured relationship with CISA or federal threat intelligence programs, this is not background noise. It’s an operational dependency with an unstable legal foundation, and your risk register should reflect that.

The governance question isn’t whether Congress will eventually pass a long-term reauthorization, it’s whether your program has a documented position on what changes when the law’s status shifts.

Specifically:

Does your legal team/counsel have a standing position on information sharing during a lapse period? Rather than re-litigating this every few months, a documented policy, what your organization will and won’t share, and under what conditions, when CISA 2015 protections aren’t in effect, saves significant time and reduces inconsistent decision-making under pressure.

Is your threat intelligence sharing dependency mapped? If a meaningful portion of your early warning capability comes through channels that depend on CISA 2015 protections, that’s a single point of failure worth naming explicitly rather than assuming it’ll always be there.

Does your board understand this as a recurring operational risk rather than a one-time news item? This is the fourth cycle. It’s reasonable to expect a fifth. A board that’s briefed once and doesn’t hear about it again isn’t tracking an ongoing exposure; they’re getting a single data point that ages out of relevance within a quarter.

The Broader Governance Lesson

This is a useful case study in a pattern that shows up across a lot of regulatory and legal infrastructure right now: durable frameworks propped up by short-term political fixes. It happened with CIRCIA’s implementation timeline. It happened with the EU AI Act’s high-risk deadline. It’s happening here.

The organizations that manage this well aren’t the ones hoping for legislative stability. They’re the ones that build governance processes assuming instability is the baseline: documented fallback positions, mapped dependencies, and board reporting that treats recurring legal uncertainty as an ongoing risk category rather than a series of unconnected news events.

CISA 2015 is extended through December.

Mark the date.

Expect to be back here again.

Discussion Questions

Does your organization have a documented legal position on information sharing practices during a CISA 2015 lapse period, or is that decision made reactively each time the law’s status changes?
How dependent is your organization’s threat intelligence program on channels that rely on CISA 2015 protections? Is that dependency mapped and known to leadership?
Is your board tracking this as a recurring operational risk, or did it register once as a news item and then drop off the radar?