The Cybersecurity Information Sharing Act (CISA) is designed to provide encouragement and protection for sharing threat information.
See also: CISA added Sudo vulnerability to KEV List
A sunset clause embedded in the Cybersecurity Information Sharing Act of 2015 (PDF) means it will expire at the end of September 2025 unless it is reauthorized by the U.S. Congress. At the time of this writing, it has not been reauthorized.
The government agency that receives the threat information may or may not take any action, but will further share this data with other agencies and share it with other companies that may be similarly threatened. “Or the company involved may share the threat information directly with other companies.”
In short, it encourages the sharing of information about threats and facilitates further exchange, while protecting the identities of those involved.
See also: CISA: Requires Cisco to patch zero-day vulnerabilities
Given the obvious benefits to the security ecosystem that flow from CISA, how did it get to this dangerous position—and will it ever be renewed? The answer to the former is probably nothing more than “politics” and timing. The need to renew CISA coincides with the separate need to renew the government’s debt ceiling—which is more important, more controversial, and more pressing for Congress than renewing CISA.
At the same time, the effort Congress will likely make is likely to be greater than simply approving “Renewal.” Rand Paul, for example, seeks to use the Freedom of Information Act to allow individuals who have been reported to learn more about their inclusion in the CISA process, i.e. to protect their civil liberties.
His certainty that CISA will be renewed is based on his value. If a company detects suspicious activity on its network, it may be able to stop it – but that doesn’t necessarily prevent it from happening again from the same source. The individual company may just be seeing part of the problem.
See also: CISA: Chrome zero-day vulnerability in KEV Catalog
CISA is entering a deadlock. There is a possibility of its renewal with potential for improvement, but not a certainty. If it is renewed, it will likely be retroactive – but that is not guaranteed. So the big question for CISOs right now is: How should we handle threat intelligence sharing immediately after September 30, 2025?
