Business Groups Push for Decade-Long Renewal of Cybersecurity Info Sharing Law

"The case for a long-term reauthorization has only grown more urgent," they wrote — a line pulled from a fresh appeal by 35 business groups demanding Congress renew a decade-long legal safe harbor for threat data sharing that is due to lapse on Dec. 11, 2026.

35 business groups pressed House and Senate Armed Services leaders

On Sunday, 35 trade and sector organizations sent a joint letter to the leaders of the House and Senate Armed Services panels asking that Congress include a 10-year extension of the Cybersecurity Information Sharing Act of 2015 (CISA 2015) in the final fiscal 2027 National Defense Authorization Act (NDAA). The letter was led by the Business Roundtable and also counted the Chamber of Commerce among its signatories. It included groups representing critical infrastructure sectors such as aviation, telecommunications and technology.

CISA 2015: scope, sunset and the Dec. 11 deadline

CISA 2015 "provides legal protections for threat data exchanges between the government and private sector as well as between companies," the letter notes. Congress has used a mix of short-term renewals and lapses since the statute's prior 10-year sunset passed last year. According to the business groups, the law is now set to expire again on Dec. 11, creating a hard deadline that overlaps the typical window in which the annual defense policy bill is finalized — often at the end of one calendar year or the start of the next.

House and Senate NDAA diverge; Rand Paul has been a roadblock

The House version of the fiscal 2027 defense bill includes a 10-year extension of CISA 2015. The Senate version, by contrast, does not. Past efforts to secure a long-term extension in the defense bill have run into objections from Senator Rand Paul, R‑Ky., who chairs the Senate Homeland Security and Governmental Affairs Committee. The source reports that Paul has conditioned his support for any long-term extension on the adoption of provisions he says would curtail past practices at the other CISA — the Cybersecurity and Infrastructure Security Agency — practices he maintains threaten free speech.

Trump administration's public push and CISA agency dispute

Top Trump administration cyber officials have publicly pressed Congress for a straightforward extension of the CISA 2015 laws, according to the reporting. The Trump administration also touted its efforts to crack down on what it characterized as free-speech‑limiting disinformation work by the Cybersecurity and Infrastructure Security Agency. The Biden administration, per the same source, denied that the agency's work impinged on free speech and said that it had ended the practices the Trump team criticized.

How technologists, policymakers, and aviation, telecommunications and technology companies are responding

• Technologists and security teams: The letter frames urgency around technical realities — citing recent incidents in which "advanced AI systems can identify and exploit software vulnerabilities at machine speed" and warning that AI-enabled tools are "making sophisticated cyber capabilities cheaper, faster and easier to use." Security teams that depend on fast, legally protected sharing of indicators and analysis would, under the business groups' framing, rely on CISA 2015 for the "legal certainty" that enables rapid collaboration.
• Policymakers and regulators: With the House and Senate split on a long-term extension, and with a potential congressional committee leadership shuffle that could change the 2027 dynamics, lawmakers must weigh the business groups' operational arguments against objections raised by Senator Paul. The Dec. 11 expiration creates a compressed timetable for negotiators working through the NDAA.
• Aviation, telecommunications and technology companies: These sectors joined the letter because they say their ability to share threat information at scale underpins operational defenses. The signatories argue that in an environment where threats can "spread and adapt in real time," the speed and breadth of defender collaboration depends on the statutory protections the 2015 law provides.

The petition from 35 industry groups places the NDAA conference process at the center of a broader fight over legal certainty for cyber information sharing, agency practice, and free‑speech concerns tied to the separate Cybersecurity and Infrastructure Security Agency. With the House including a 10‑year extension, the Senate excluding it, and Dec. 11 looming, the next weeks will determine whether Congress stitches a decade of legal protection into the defense bill or continues the pattern of short-term renewals and lapses that has characterized recent years.

Original story: https://cyberscoop.com/business-groups-cisa-2015-renewal-ndaa-cybersecurity/