Business Groups Urge Congress to Renew CISA 2015
Thirty-five business groups asked congressional armed services leaders to extend the Cybersecurity Information Sharing Act for 10 years in the fiscal 2027 defense bill.
Updated on Nov. 2, 2026 in Cybersecurity
Thirty-five business groups, led by the Business Roundtable, sent a letter asking leaders of the House and Senate Armed Services panels to renew the Cybersecurity Information Sharing Act of 2015 for 10 years as part of the fiscal 2027 National Defense Authorization Act. The law is set to expire again on December 11, 2026.
Why it matters
The letter argues that AI systems can find and exploit software vulnerabilities at machine speed, shrinking the window between discovery and attack. Congress has so far renewed the law only through short-term extensions and lapses, leaving companies uncertain about long-term information-sharing protections.
The coalition's request for a 10-year extension contrasts with the short-term renewals and lapses Congress has used since the law's prior sunset last year, and the House and Senate defense bills currently diverge on including it. The Senate's position remains unresolved, and no final text has been agreed.
The players
Business Roundtable
A association of chief executives of major U.S. companies that advocates for public policy positions on economic and regulatory issues.
Rand Paul
A U.S. senator from Kentucky who chairs the Senate Homeland Security and Governmental Affairs Committee and has pushed back on long-term extensions of the information-sharing law.
The details
The Business Roundtable led the coalition, whose signatories include the Chamber of Commerce and groups representing aviation, telecommunications, and technology. The letter seeks inclusion of the extension in the final negotiations over the fiscal 2027 defense authorization bill, while Senate Homeland Security and Governmental Affairs Chairman Rand Paul has objected to past attempts to attach a long-term extension to the defense bill.
Timeline
- Dec. 11, 2026: Current expiration date of the Cybersecurity Information Sharing Act of 2015.
- Sunday before Nov. 2, 2026: Business groups sent the letter to armed services leaders.
- 2027: A possible committee leadership shuffle could change the outlook for the law.
Big Picture
The Cybersecurity Information Sharing Act of 2015 created the framework companies use to share threat data with the federal government, and its repeated short-term renewals since its prior sunset have left the framework's long-term status uncertain. The current push for a 10-year renewal tests whether Congress will move from stopgap extensions to a durable framework as AI-driven attacks accelerate.
Companies that share cyber threat information with the federal government rely on the liability protections in this law, and a lapse creates uncertainty about whether those protections remain in force. Whether the extension passes determines how long businesses can plan around current information-sharing arrangements.
The takeaway
Long-term cybersecurity policy depends on whether Congress can settle on durable rules rather than repeated short-term fixes. Businesses and policymakers watching this debate should track the defense bill's final text, which will show whether the information-sharing framework gets a multiyear footing.
What happens next
The fiscal 2027 defense authorization bill's final negotiations will determine whether the 10-year extension is included before the December 11, 2026 expiration date.
Further reading
For more on how federal policy shapes digital defenses, explore our Cybersecurity coverage.
