Business Groups Seek CISA 2015 Extension Through 2035 in FY2027 NDAA

Thirty-five business groups are pressing Congress to extend the Cybersecurity Information Sharing Act of 2015 (CISA 2015) through 2035 as part of final negotiations on the FY2027 National Defense Authorization Act (NDAA). The request was made in a November 1 letter to leaders of the House and Senate Armed Services committees. The House version of the defense bill includes a 10-year extension, while the Senate version does not. As of November 3, 2026, the law’s current stopgap extension is scheduled to expire on December 11, leaving a short window for lawmakers to resolve the difference. The proposed extension is not enacted, and its fate depends on House-Senate negotiations.

CISA 2015 provides a legal framework for exchanging cyber threat information between private-sector organizations and the federal government, as well as among companies. Its protections are intended to limit liability exposure, including lawsuits and regulatory penalties, when firms share threat information with federal partners such as the FBI or the National Security Agency. Shared data can contain personal or proprietary information about individuals and organizations affected by intrusions. Business groups argue that uncertainty about these protections could discourage disclosures, weakening the flow of information defenders use to identify and respond to threats.

The groups say the case for a long-term renewal has become more urgent as artificial intelligence changes the speed and economics of cyber operations. Their letter warns that advanced AI systems can identify and exploit software vulnerabilities at “machine speed,” shrinking the interval between discovery and attack. It also states that AI tools are making sophisticated cyber capabilities cheaper, faster, and easier to use, allowing threats to spread and adapt in real time. For federal contractors providing incident response, managed security, threat intelligence, or other cyber services, the policy debate has direct operational relevance: information-sharing arrangements may depend on the legal certainty the statute provides.

Congress has repeatedly relied on short-term extensions after CISA 2015’s prior 10-year sunset passed. The law lapsed during the 2025 government shutdown and was restored through spending legislation, with subsequent extensions moving the deadline first to January 2026, then September, and ultimately December 11. Senate negotiations have also involved disputes over what additional provisions should accompany a longer renewal. Senate Homeland Security and Governmental Affairs Committee Chairman Rand Paul has linked support for a long-term extension to provisions addressing federal agency practices he says threaten free speech, while administration officials have advocated a straightforward extension. Contractors should therefore treat the renewal as an unresolved policy and continuity risk rather than assume the House provision will become law.

• Thirty-five business groups asked Congress to extend CISA 2015 through 2035 in the FY2027 NDAA.
• The House NDAA contains a 10-year extension; the Senate version does not.
• The current stopgap extension is scheduled to expire December 11, 2026; the proposal has not been enacted.
• CISA 2015 covers threat-data exchanges between government and industry and among companies, with liability protections for sharing.
• The statute’s protections are relevant to disclosures to federal partners including the FBI and National Security Agency.
• Industry groups warn that legal uncertainty could increase litigation or regulatory exposure and reduce private-sector threat reporting.
• The letter cites AI-enabled vulnerability exploitation at “machine speed” and faster, cheaper, more adaptable cyber threats.
• Contractors should inventory agreements, incident-response workflows, and threat-sharing services that rely on CISA 2015 protections.
• Prepare contingency guidance for clients and internal teams in case the December deadline arrives without a legislative extension.