Executive Summary
- The Cybersecurity Information Sharing Act of 2015 (CISA 2015) has been extended through January 30, 2026, avoiding its scheduled sunset.
- The reauthorization was passed as part of a broader government funding bill, the Continuing Appropriations Act, 2026.
- The extension is a temporary measure that only changes the law’s expiration date, with no substantive alterations to its provisions.
The Cybersecurity Information Sharing Act of 2015 (CISA 2015) has been temporarily reauthorized through January 30, 2026, as part of a government funding bill enacted on November 12, 2025. This short-term extension prevents the law, which provides legal protections for sharing cybersecurity threat data, from lapsing after its previous September 30, 2025, sunset date.
The reauthorization was included in the Continuing Appropriations, Agriculture, Legislative Branch, Military Construction and Veterans Affairs, and Extensions Act, 2026. This legislation simply updated the law’s expiration provision without making any substantive changes to its existing framework.
The act establishes a legal structure for private entities to share cyber threat indicators and defensive measures with the federal government and other private parties. To encourage this exchange, CISA 2015 provides key legal protections, including liability limits and exemptions from Freedom of Information Act (FOIA) disclosures.
While this extension provides continuity for the program, the long-term future of CISA 2015 remains uncertain. Congress will need to address a more permanent reauthorization or modification of the law before the new January 2026 deadline. Organizations that rely on the act’s protections are advised to monitor future legislative developments.