“In this environment, the speed and breadth with which defenders share information determines whether they keep pace with adversaries,” the coalition of industry groups wrote in a Nov. 1 letter to the leaders of the House and Senate Armed Services committees.
Coalition of 35 industry groups urges inclusion in defense bill
Thirty-five trade associations — including the U.S. Chamber of Commerce, Business Software Alliance, American Bankers Association, Airlines for America, the American Public Power Association and the National Rural Water Association — asked negotiators to preserve a provision in the House version of the annual defense policy bill that would extend the Cybersecurity Information Sharing Act of 2015 through 2035. The groups delivered the request in a Nov. 1 letter to the chairs and ranking members of the House and Senate Armed Services committees.
What the law’s liability protections do
The core protections in CISA 2015, as described by the industry signers, shield companies from lawsuits and from regulatory penalties when they share cyber-threat information with federal partners such as the FBI or the National Security Agency. The shared information can include personal or proprietary data tied to individuals and companies affected by intrusions; industry groups argue that legal certainty is necessary to maintain the pace of private-sector disclosures.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleRecent history and the current deadline
CISA 2015 lapsed during last year’s record government shutdown, prompting concern among corporate legal teams; the letter noted that on the first day of the shutdown cybersecurity attorneys were already fielding client calls about whether existing agreements still protected them. Congress restored the law through January 2026 when it reopened the government in November 2025. Lawmakers then extended it again in February 2026 through Sept. 30, and moved the deadline to December in a stopgap funding bill. The current authorization is set to expire on Dec. 11, creating a near-term negotiating point for the defense bill conference.
Senate disagreement: Rand Paul, Gary Peters, and Mike Rounds
Negotiators are not in full agreement on what a longer reauthorization should contain. Senators Gary Peters and Mike Rounds advocated for a 10-year extension during last year’s shutdown. But Senate Homeland Security and Governmental Affairs Committee Chairman Rand Paul told Roll Call last month that he wants an amendment that would bar federal officials from pressuring social media companies to restrict speech. The source notes that Rand Paul “has routinely pushed back on clean extensions of the law,” and that Paul and Peters have discussed the proposed amendment several times without reaching an agreement.
What this means for banks, utilities, and federal partners
- American Bankers Association and financial firms: The letter frames the liability shield as essential to avoiding legal risk when banks share breach data with federal partners; signers warned that allowing the measure to lapse would reduce private-sector threat disclosures.
- Electric and water utilities: Groups such as the American Public Power Association and the National Rural Water Association joined the coalition, signaling concern that lapsing protections could impede sharing of operational-impacting cyber-threat data that may include customer or proprietary information.
- Federal partners like the FBI and the National Security Agency: The industry letter positions these agencies as the primary recipients of shared threat information and implies that their access to timely private-sector reporting depends on continued statutory protections for donors of that information.
Conclusion: a December 11 deadline and a political compromise
The industry letter frames the extension as a pragmatic measure to preserve the flow of threat information into federal channels; its signatories are asking negotiators to adopt the House provision extending CISA 2015 to 2035 in the defense authorization bill. Lawmakers have already used a series of stopgap measures to keep the law in force through a convoluted sequence of restorations and short-term extensions, and the current authority expires Dec. 11. With at least one senator seeking an amendment addressing social-media pressure and others advocating a long extension, the conference over the defense bill will need to reconcile competing priorities or accept another temporary fix.
