The Cybersecurity Information Sharing Act of 2015 (“CISA 2015”), which provides protections for sharing cybersecurity threat information with the federal government and others, was reauthorized under the funding bill to reopen the federal government, which was enacted on November 12, 2025. The information sharing mechanisms and protections under CISA 2015, which had previously sunset on September 30, 2025, will now extend through January 30, 2026.
As we have previously described, the law creates a cybersecurity information sharing framework and establishes certain protections – including exemptions from disclosure under FOIA, limits to liability, and limits to waiver of legal privilege – for sharing that information with private parties and the federal government. See our prior blog posts in 2015 and 2016. Prior to lapsing in September, multiple bills had been introduced to reauthorize CISA 2015, some of which would have adjusted or altered the substance of the law. However, the Continuing Appropriations, Agriculture, Legislative Branch, Military Construction and Veterans Affairs, and Extensions Act, 2026 (“Continuing Resolution”), leaves the preexisting law intact by simply substituting the statutory sunset date (6 U.S.C. § 1510(a)) with “January 30, 2026.”
While CISA 2015 is now reauthorized through the end of January 2026, it remains unclear whether Congress will reauthorize the law before the new sunset date. For now, qualified cyber threat information can be shared with the protections afforded by CISA 2015. However, organizations should continue to monitor for future legislative efforts to modify or simply reauthorize CISA 2015 beyond the new January 2026 sunset date.