Industry groups urge Congress to renew cyber threat-sharing law through defense authorization

MalBot · November 2, 2026, 10:25pm

A coalition of 35 industry groups is urging Congress to use the annual defense policy bill to renew a law that gives companies legal protections when they share information about cyber threats with the federal government.

Introduction to Malware Binary Triage (IMBT) Course

Looking to level up your skills? Get 10% off using coupon code: MWNEWS10 for any flavor.

Enroll Now and Save 10%: Coupon Code MWNEWS10

Note: Affiliate link – your enrollment helps support this platform at no extra cost to you.

In a Nov. 1 <a href=“Multi-Association CISA 2015 NDAA Conference Letter | Business Roundtable”>letter</a> to the leaders of the House and Senate Armed Services committees, the groups asked negotiators to keep a<a href=“https://www.govinfo.gov/content/pkg/BILLS-119hr8800eh/html/BILLS-119hr8800eh.htm”> provision in the House bill</a> that would extend the Cybersecurity Information Sharing Act of 2015 through 2035. The law lapsed during last year’s record government shutdown and has since stayed in place through a series of spending bills. Its<a href=“Stopgap funding bill temporarily extends key cyber info-sharing law - Nextgov/FCW”> current extension</a> expires Dec. 11.

The signers include the U.S. Chamber of Commerce, Business Software Alliance, American Bankers Association, Airlines for America, the American Public Power Association and the National Rural Water Association.

“In this environment, the speed and breadth with which defenders share information determines whether they keep pace with adversaries,” the groups wrote. “That speed depends on the legal certainty CISA 2015 provides.”

The key liability protections in the law are designed to shield firms from lawsuits and regulatory penalties when sharing threat information with federal partners like the FBI or National Security Agency. That data often includes personal or proprietary information tied to individuals and companies affected in cyber intrusions.

Industry groups have consistently warned lawmakers that allowing the measure to lapse would create legal risks for companies sharing breach data, leading to a drop in private sector threat disclosures.

On the first day of the shutdown last year, cybersecurity attorneys were already<a href=“Attorneys scramble to advise clients after lapse of key cyber info-sharing law - Nextgov/FCW”> fielding calls from clients</a> about whether their existing agreements still protected them.

Congress restored the law through January 2026, when it reopened the government in November 2025. Lawmakers extended it again in February of this year, this time through Sept. 30, then moved the deadline to December in a stopgap funding bill.

A sticking point in the Senate reauthorization process has been what else to put in a longer renewal. Sens. Gary Peters, D-Mich., and Mike Rounds, R-S.D., pushed for a 10-year extension during last year’s shutdown.

But Senate Homeland Security and Governmental Affairs Committee Chairman Rand Paul, R-Ky.,<a href=“Cyber information-sharing law stuck in Senate stalemate - Roll Call”> told Roll Call last month</a> that he wanted a provision barring federal officials from pressuring social media companies to restrict speech. Paul — who has routinely <a href=“Vital cyber data-sharing law appears likely to expire amid looming government shutdown - Nextgov/FCW”>pushed back</a> on clean extensions of the law — said he and Peters had discussed the amendment several times without reaching an agreement.

Article Link: Industry groups urge Congress to renew cyber threat-sharing law through defense authorization - Nextgov/FCW