On 30 September 2025, a key piece of U.S. cybersecurity legislation the Cybersecurity Information Sharing Act of 2015 (commonly abbreviated as “CISA 2015”) officially expired. Though passage of a short-term extension was considered, the law lapsed alongside a government funding shutdown. Its expiration represents not merely a legislative technicality, but a potentially significant shock to how cybersecurity threat intelligence is exchanged across the U.S. private sector, state, and federal levels.
In this post, I will sketch out:
- What CISA 2015 did (and what it authorised)
- How its expiry came about (legislative, political, timing factors)
- Key risks, criticisms, and concerns arising from the lapse
- Possible paths forward: renewal, reform, or alternatives
- Broader lessons for cybersecurity regimes and public–private cooperation
What Was CISA 2015 And Why It Mattered
When CISA was passed as part of a broader legislative package in late 2015, it responded to a growing recognition that cyber threats do not respect organisational or jurisdictional boundaries and that the private sector owns and operates much of the infrastructure that adversaries target.
At its core, CISA 2015:
- Created a voluntary framework for private entities (companies, critical infrastructure operators, etc.) to share cyber-threat indicators (for instance, suspicious IP addresses, malicious signatures, or tactics, techniques, and procedures) with federal agencies and, in turn, for government agencies to share information back.
- Provided liability protections (or safe harbour) for organisations that shared information in good faith, shielding them from certain legal risks such as antitrust challenges or lawsuits.
- Imposed some constraints, such as requiring removal of personal information not related to cybersecurity threats, to balance privacy with utility.
- Enabled federal agencies to use the shared threat indicators internally (across departments) and where appropriate re-distribute them (subject to privacy safeguards) to other public or private actors.
From a practical standpoint, CISA 2015 served as a kind of legal glue: by reducing the legal risk for private-sector sharing, it helped build trust in public–private collaboration, encouraged stronger situational awareness, and allowed federal defenders to piece together threat information submitted from many sources.
Importantly: the lapse of CISA does not entirely prohibit sharing of threat information. Organisations could still exchange cyber-threat data under prior statutory or common-law authorities. What disappears, however, are the specific legal protections and incentives that had encouraged greater sharing under known guardrails.
How the Expiry Happened: Timing, Politics, and Last-Minute Maneuvers
That a cybersecurity law would expire in a threat and political climate of increasing concern should raise eyebrows. Yet the lapse is the result of a confluence of factors:
Sunset clauses and congressional authorisation
The original CISA 2015 law was built with an authorisation period that would end on 30 September 2025. This meant that Congress would need to reauthorise it (or extend it) before the deadline for continuity. This built-in sunset made a future lapse possible if lawmakers failed to act in time.
Legislative gridlock and competing priorities
Although CISA’s reauthorisation had bipartisan support in many quarters, Congress has lately been mired in broader budget and funding battles, including fights over government funding (continuing resolutions), shutdown risks, and partisan demands. In particular, attempts to bundle a “clean” (unchanged) extension of CISA into funding bills have repeatedly stalled.
Last-minute demands and scrutiny
In the weeks before expiry, competing proposals emerged. Some legislators (notably Senator Rand Paul) sought amendments to curb government overreach, require more transparency (e.g., FOIA access to information submitted), or limit the role of the Cybersecurity and Infrastructure Security Agency (the federal agency known colloquially as “CISA”) in content moderation or censorship. These demands complicated agreement on a unified reauthorisation package.
Attempts at extension that faltered
There was some movement. The House included a short-term extension of CISA’s provisions until 21 November in a continuing resolution bill. Also, the House Homeland Security Committee passed a reauthorisation bill (a ten-year extension with updates).
But these proposals never secured enough support in the Senate. At the point of government funding lapse, the CISA law expired concurrently.
The shutdown as tipping point
With the broader U.S. federal government shutdown taking effect, President, Congress, and funding mechanisms were in disarray. The expiry of CISA occurred at midnight as the funding expired. The shutdown, thus, made reauthorisation in the final hours more difficult.
Thus, it is not simply that Congress chose to let CISA lapse, but that a combination of built-in sunset, legislative delay, competing amendment demands, and budget gridlock allowed the inevitability to set in.
Risks, Concerns, and Criticisms of the Lapse
With the legal protections of CISA 2015 gone, a number of risks emerge some real, some potential, some overstated. Below are the principal issues being voiced by security experts, industry groups, legal analysts, and government stakeholders.
Chill effect on threat sharing
Perhaps the most immediate concern is that private organisations, especially smaller ones or those with cautious legal counsel, may become reluctant to share threat indicators. Without the liability shield and clear legal backing, companies may fear lawsuits, regulatory scrutiny, antitrust exposure, or privacy liabilities. According to WilmerHale, the lack of “critical protection for legal privileges” could deter voluntary sharing. The result: a degradation in the volume, speed, and granularity of threat signals reaching federal cybersecurity agencies.
Fragmented visibility and blind spots
Cyber defenders rely on the aggregation of threat signals from many sources; losing a piece of that mosaic could introduce “blind spots” in detection. Attackers are adaptive; losing early-warning intelligence worsens reaction time. In highly distributed networks (e.g., critical infrastructure sectors such as energy, water, healthcare, transport), localized incidents may no longer yield broader upstream alerts.
Legal uncertainty and risk exposure
Without the statutory safe harbours, companies face greater legal uncertainty. They may face potential liability under:
- Antitrust laws for sharing data that might be construed as coordinating behaviour among rivals
- Privacy or data protection laws if threat indicators inadvertently include personal data (or personal identifiers)
- Contractual or shareholder litigation if sharing is judged imprudent
- Freedom of Information Act (FOIA) exposure under some proposals, governments might be required to disclose submissions to FOIA requests
Because CISA 2015 had explicit legal scaffolding to shield many of these risks, its lapse raises new legal caution. Legal advisors are already scrambling to update counsel to clients on how to proceed in the interim.
Reduced federal coordination and prioritisation
The federal agencies that had become dependants (in part) on incoming threat data may face shortfalls. Less data means lower signal strength for joint analysis, slower attribution, and diminished ability to issue warnings or coordinate response actions.
Moreover, the lapse coincides with reductions due to the shutdown in staff available at federal cybersecurity bodies. As of early October, CISA (the agency) was operating at about 35% of its workforce due to furloughs. The combined effect fewer human defenders + less data compounds the risk environment.
Adversarial opportunity and message to attackers
From the perspective of threat actors (state-sponsored groups, criminal gangs, hacktivists), the expiration of CISA is a signal: detection becomes harder, coordination weaker, defenders less aggressive. Some experts warn of a “gift to attackers,” giving them more freedom to act clandestinely. The lapse of a law that united private and public defenders is a tempting vector for adversaries to probe gaps or accelerate reconnaissance.
Uneven effect on different sectors and jurisdictions
Smaller organisations (with limited security budgets or legal teams) may suffer more from the uncertainty than large firms that already share data through bespoke agreements or internal confidence.
State, local, and educational entities (e.g. K–12 school systems) often lack mature legal or cybersecurity programmes; the absence of clear threat-sharing incentives or protections could leave them exposed.
International and cross-border coordination might also be hampered: foreign entities might be less able to trust or rely on U.S. partners’ threat data flow in the absence of stable legal mechanisms.
Criticisms and counterarguments
It is worth noting that critics of CISA had long argued the law was imperfect. Concerns included:
- Insufficient privacy protections or inadequate oversight
- Potential for overreach or misuse by government
- Ambiguities in definitions of “threat indicator”
- The voluntary nature of sharing, meaning not all actors would engage
Thus, some observers argue the lapse is also an opportunity to revisit and strengthen the law rather than merely repeat the old. Nonetheless, the abrupt lapse removes the safety net while those reforms are debated.
What Happens Now and What Options Remain
Having examined what’s lost (or threatened) by the lapse of CISA, we should consider possible futures: reauthorisation, reform, or alternative regimes.
Short-term stopgaps or retroactive legislation
One path is a retroactive reauthorisation or “gap-filling” law that reinstates protections retroactively (i.e. covering the period during the lapse). Legal continuity would reduce disruption. Some reauthorisation proposals floated in Congress contemplate doing precisely that.
Other stopgap approaches include embedding CISA’s extension in continuing resolutions or omnibus funding bills. The House, for example, included a short-term extension until mid-November in a CR proposal. Whether the Senate will accept that remains uncertain.
Reauthorisation with reforms (modernisation, guardrails)
Most stakeholders accept that simple renewal is inadequate. Instead, the consensus is shifting toward reauthorisation with updates:
- Extending CISA for a longer duration (e.g. 10 years) rather than a short patch.
- Incorporating changes to reflect new threat modalities (e.g. AI-driven attacks, supply-chain attacks, zero-day vulnerabilities)
- Strengthening privacy protections, oversight, and transparency including clarifying privacy rules, reporting obligations, and redress mechanisms.
- Addressing concerns about government overreach (e.g. FOIA access to submitted data, limiting agency powers) some lawmakers have insisted on adding constraints.
- Better aligning with state/local cybersecurity efforts, clarifying responsibilities, and ensuring equitable support to smaller participants.
However, negotiating these reforms can slow reauthorisation and indeed, that is part of the reason the law lapsed. The delicate balance is to modernise without creating so much friction that renewal fails again.
Sector- or state-level alternatives
Absent a strong federal scheme, some states or sectors might act independently:
- States could establish their own threat-sharing regimes or legal protections (though that leads to patchwork rules)
- Critical sectors (e.g. financial services, energy) might implement sector-specific agreements under regulatory frameworks or public utility regimes
- Industry consortiums might formalise private threat-sharing alliances with contractual protections (though they may lack the same reach or authority)
But such fragmentation comes with costs: varying legal regimes, interoperability challenges, duplication, and inconsistent incentives.
Longer-term rethinking of threat-sharing architecture
Beyond renewal or patchwork, some voices argue for more radical rethinking: building a new legal framework (with clearer modern criteria), embedding stronger privacy-by-design principles, and employing new technologies (e.g. secure multiparty computation, differential privacy) to mediate sensitive sharing.
However, such an overhaul is unlikely to happen overnight the urgency of the lapse means defenders must act in the interim under greater uncertainty.
What organisations can do now
While the legal environment is in flux, private sector actors (and public-sector partners) should take a cautious but proactive posture:
- Legal review and risk assessment revisit internal policies regarding threat sharing, data anonymisation, retention, and institutional risk tolerance
- Document decisions and disclosures maintain clear audit trails and rationale for sharing or withholding information
- Limit shared data to core threat signals avoid oversharing personally identifiable or proprietary content until protections are assured
- Seek bilateral or contract-based sharing agreements where safe harbour is stronger
- Engage with policy and advocacy efforts lend voices to legislative reauthorization, comment on privacy safeguards, etc.
Broader Lessons and Reflections
The lapse of CISA 2015 carries lessons for policymaking, cybersecurity, and public–private cooperation:
- The design of sunset or authorisation periods can introduce fragility: even well-intentioned laws must have political path resilience
- Legal incentives (liability protection, clarity) matter as much as technical capabilities in enabling cooperation
- Trust is fragile: once a protective regime vanishes, rebuilding confidence is slow and uncertain
- Cybersecurity is inherently dynamic legislative frameworks must anticipate evolution (AI, IoT, supply chains, global threats)
- The interdependence of government, industry, and civil society means that legal gaps in one domain (like threat-sharing) ripple across the ecosystem
- Crisis moments (such as shutdowns) test whether critical infrastructure and security regimes are robust to political uncertainty
Conclusion: A Critical Juncture for U.S. Cybersecurity
The expiry of the Cybersecurity Information Sharing Act of 2015 marks more than a legislative footnote. It is a critical inflection point in how the U.S. government, private sector, and civil institutions cooperate against cyber threats. The loss of clear legal protections weakens the incentives and trust that enabled years of information sharing.
Much now depends on how swiftly, smartly, and broadly Congress acts to reinstate and ideally, improve the law. Equally important is the ability of organisations to navigate the interim period with prudence and to adapt when new rules emerge.
If the lapse stretches, there may be damage not only in data flow and defence posture, but in the very fabric of collaborative cybersecurity. Conversely, if reauthorisation is paired with modernisation, stronger guardrails, and renewed confidence, we may emerge with a more resilient, privacy-aware regime.