CISA 2015 Info-Sharing Protections Now Expire 11 December
The Cybersecurity Information Sharing Act of 2015, which gives liability protection and an antitrust exemption for sharing cyber threat indicators, was extended only to 11 December 2026 by the Continuing Appropriations and Extensions Act, 2027. No longer-term reauthorization has passed.
Why It Matters
Private-sector threat-sharing programs, ISACs and managed security providers rely on CISA 2015 for their legal footing. The statute already lapsed once, on 30 September 2025, and has since been carried by a series of short extensions. This one leaves about six weeks.
If the authority lapses again, sharing under the Act's protections would stop being covered until Congress acts. Compliance and legal teams should know which sharing arrangements depend on the statute, and what the contract says if it lapses.
Action Items
Inventory your dependencies — list every threat-indicator sharing arrangement (ISAC, vendor, customer, government) that relies on CISA 2015 protections. Do it before 11 December.
Add lapse language — check that sharing agreements say what happens if the statute lapses, and whether sharing pauses or continues on another basis.
Brief legal and the CISO — agree in advance who decides whether to continue sharing if there is no reauthorization by 11 December.
Get the full analysis. Pro subscribers receive the complete deep dive, all 5 action items, source documents, and jurisdiction-specific compliance checklists.
Subscribe to Pro to read the rest.
Become a paying subscriber of Pro to get access to this post and other subscriber-only content.
UpgradeA subscription gets you:
- Deep dives of each updated regulation
- Source verification documents
- Extended jurisdiction-specific analysis
- Compliance deadline tracker
- Regulation crosswalk