The Cybersecurity Information Sharing Act of 2015 (CISA 2015) has been temporarily reauthorized as part of the broader legislation passed on November 12, 2025, to reopen the federal government. Under the appropriation legislation, CISA 2015 is now reauthorized until January 30, 2026.
As previously discussed in details on this blog, CISA 2015 expired at the end of September 2025, after Congress missed the reauthorization deadline. The expiration of the legal framework removed statutory protections and liability exemptions companies relied upon to share cyber threat information with private and public partners. Although cyber threat information sharing continued during the lapse of CISA 2015, companies had to reassess the risks associated with their practices, such as unwanted exposure to FOIA disclosures, and other regulatory and liability risks.
This temporary extension grants lawmakers approximately 2 months to adopt a more permanent reauthorization of CISA 2015, beyond January 2026. A longer-term reauthorization of the legal framework would provide companies with greater certainty around cyber threat information sharing. It remains unclear whether a new 10-year extension would include changes to the statute’s protections. Some lawmakers have proposed extending the law until 2035 with minor amendments to the legislation and updates that would address the increasing use of artificial intelligence (AI) technology to support information sharing practices.
With CISA 2015 temporarily reauthorized, companies can again rely on its statutory protections to resume cyber threat information sharing with companies, Information Sharing and Analysis Organizations and Centers (ISAOs/ISACs), and the federal government. Nevertheless, legal teams and external counsel should remain actively engaged in assessing legal risks associated with information system monitoring and cyber threat intelligence sharing. Given the short extension of CISA 2015 until the end of January 2026, companies should prepare for the possibility of another lapse and continue evaluating their legal posture as this situation evolves.