The Cybersecurity Information Sharing Act of 2015 (CISA 2015) has been temporarily reauthorized as part of the broader legislation passed on November 12, 2025, to reopen the federal government. Under the appropriation legislation, CISA 2015 is now reauthorized until January 30, 2026.
As previously discussed in details on this blog, CISA 2015 expired at the end of September 2025, after Congress missed the reauthorization deadline. The expiration of the legal framework removed statutory protections and liability exemptions companies relied upon to share cyber threat information with private and public partners. Although cyber threat information sharing continued during the lapse of CISA 2015, companies had to reassess the risks associated with their practices, such as unwanted exposure to FOIA disclosures, and other regulatory and liability risks.
This temporary extension grants lawmakers approximately 2 months to adopt a more permanent reauthorization of CISA 2015, beyond January 2026. A longer-term reauthorization of the legal framework would provide companies with greater certainty around cyber threat information sharing. It remains unclear whether a new 10-year extension would include changes to the statute’s protections. Some lawmakers have proposed extending the law until 2035 with minor amendments to the legislation and updates that would address the increasing use of artificial intelligence (AI) technology to support information sharing practices.