Renewing Cyber Threat Sharing: Sharing Protections under the Cybersecurity Act of 2015

In the Cybersecurity Information Sharing Act of 2015 (CISA, or the “Act”)[1], Congress provided protections to businesses for information sharing with the federal government. The protections were implemented to allow and even encourage information sharing among private entities. The Act was originally slated for a ten-year period, then extended to September 30, 2026[2], and is now extended to December of 2026. Now, Congress is racing to renew the Act before the sharing provisions expire.[3]

The debate over renewing the Act centers on the legal framework supporting that cooperation. The statute provides:

(b) SHARING OR RECEIPT OF CYBER THREAT INDICATORS.—No cause of action shall lie or be maintained in any court against any private entity, and such action shall be promptly dismissed, for the sharing or receipt of a cyber threat indicator or defensive measure under section 104(c) if— (1) such sharing or receipt is conducted in accordance with this title; and (2) in a case in which a cyber threat indicator or defensive measure is shared with the Federal Government, the cyber threat indicator or defensive measure is shared in a manner that is consistent with section 105(c)(1)(B)…[4]

While the provisions related to FOIA protections are:

(3) EXEMPTION FROM DISCLOSURE.—A cyber threat indicator or defensive measure shared with the Federal Government under this title shall be— (A) deemed voluntarily shared information and exempt from disclosure under section 552 of title 5, United States Code, and any State, tribal, or local provision of law requiring disclosure of information or records; and (B) withheld, without discretion, from the public under section 552(b)(3)(B) of title 5, United States Code, and any State, tribal, or local provision of law requiring disclosure of information or records[5]

The renewal issue is more than keeping a statute on the books; it is about keeping the flow of information between the Federal Government and private organizations intact. Sharing useful and timely information with the government allows that information to be used to create additional alerts or warnings and to help other organizations recover from similar cyber events. Without this protection, however, many organizations would not be willing to share such information lest it become the subject of a class action lawsuit.

Sharing information is especially beneficial given the overwhelming number of threats to infrastructure we have read about recently due to ongoing wars. Such information can help other institutions investigate potential exposure or adjust their defenses. That said, it is still important to be discerning in sharing information. For example, an entire customer record, email archive, or incident file may contain information unrelated to the threat. Effective sharing requires separating what others need to defend their systems from what they do not need to receive.

Regardless of the legislative outcome, organizations in critical industries should review and revise their information-sharing procedures. Those procedures should identify:

• authorized personnel,
• establish review and escalation paths,
• address unnecessary personal information, and
• document the basis for disclosures.

Security and legal teams should also distinguish voluntary threat sharing from separate reporting, notification, contractual, and confidentiality obligations.