Companies warn cyber threat sharing could suffer without new legal protections

A coalition of 35 industry groups is urging Congress to use the annual defense policy bill to renew a law that gives companies legal protections when they share information about cyber threats with the federal government.

In a Nov. 1 letter to the leaders of the House and Senate Armed Services committees, the groups asked negotiators to keep a provision in the House bill that would extend the Cybersecurity Information Sharing Act of 2015 through 2035. The law lapsed during last year’s record government shutdown and has since stayed in place through a series of spending bills. Its current extension expires Dec. 11.

The signers include the U.S. Chamber of Commerce, Business Software Alliance, American Bankers Association, Airlines for America, the American Public Power Association and the National Rural Water Association. 

“In this environment, the speed and breadth with which defenders share information determines whether they keep pace with adversaries,” the groups wrote. “That speed depends on the legal certainty CISA 2015 provides.”

The key liability protections in the law are designed to shield firms from lawsuits and regulatory penalties when sharing threat information with federal partners like the FBI or National Security Agency. That data often includes personal or proprietary information tied to individuals and companies affected in cyber intrusions.

Industry groups have consistently warned lawmakers that allowing the measure to lapse would create legal risks for companies sharing breach data, leading to a drop in private sector threat disclosures.

On the first day of the shutdown last year, cybersecurity attorneys were already fielding calls from clients about whether their existing agreements still protected them. 

Congress restored the law through January 2026, when it reopened the government in November 2025. Lawmakers extended it again in February of this year, this time through Sept. 30, then moved the deadline to December in a stopgap funding bill.

A sticking point in the Senate reauthorization process has been what else to put in a longer renewal. Sens. Gary Peters, D-Mich., and Mike Rounds, R-S.D., pushed for a 10-year extension during last year’s shutdown. 

But Senate Homeland Security and Governmental Affairs Committee Chairman Rand Paul, R-Ky., told Roll Call last month that he wanted a provision barring federal officials from pressuring social media companies to restrict speech. Paul — who has routinely pushed back on clean extensions of the law — said he and Peters had discussed the amendment several times without reaching an agreement.