House Homeland plans CISA 2015 markup with expiration looming
The House Homeland Security Committee will mark up a reauthorization bill for CISA 2015, a key information sharing law that expires at the end of September.
Justin Doubleday
The House Homeland Security Committee plans to convene in early September to mark up a reauthorization bill for a soon-to-expire cybersecurity law that’s viewed as critical to cyber collaboration across government and industry.
In a statement, House Homeland Security Committee Chairman Andrew Garbarino (R-N.Y.) confirmed the committee will mark up a reauthorization bill for the Cybersecurity Information Sharing Act of 2015 once Congress returns from August recess.
“Reauthorizing the Cybersecurity and Information Sharing Act is essential as the deadline nears and as threats evolve,” Garbarino said. “The House Committee on Homeland Security plans to mark up our legislative text for its reauthorization shortly after Congress returns from recess in September. In a 10-year extension, I will preserve the privacy protections in the law, and I aim to provide enhanced clarity to certain pre-existing provisions to better address the evolving threat landscape.”
CISA 2015, as it’s known, expires at the end of September. The law provides liability protections and privacy guardrails to especially encourage private sector organizations to voluntarily share data with each other and government agencies.
Garbarino has praised the statute, while pushing for some changes to the 10-year-old law. Other lawmakers say the committee should pass a clean reauthorization, given the tight deadline, and consider changes later.
Industry representatives have also called on lawmakers to prioritize passing the reauthorization before the law expires.
“We cannot allow the perfect to be the enemy of the good,” John Miller, senior vice president of policy at the Information Technology Industry Council, said during a May homeland security committee hearing. “Please do not jeopardize the cybersecurity improvements and partnerships that CISA 15 has catalyzed and that many now likely take for granted by letting the law lapse if that is the price of making changes.”
The reauthorization of CISA 2015 is also expected to be a priority for new National Cyber Director Sean Cairncross.
In a slate of recent recommendations, ITI recommended the Office of the National Cyber Director focus on improving public-private collaboration. The industry group specifically urged Cairncross to rely on CISA 2015 authorities to improve information sharing between federal entities.
“The law already gives [the Cybersecurity and Information Security Agency] the authorities it needs to deliver real-time visibility across government, so the problem is not legal but operational,” ITI wrote. “ONCD should double down on existing authorities, removing whatever internal roadblocks are impeding intragovernmental information flow, and ensuring that agencies share data quickly and securely. Real-time intelligence sharing is essential to faster response, smarter defense, and national resilience.”
If lawmakers were to update the information-sharing law, cyber policy experts have pointed to a potential need to update definitions to account for changes in the technology landscape since 2015.
“The law is pretty good as it stands now,” Megan Brown, a partner at Wiley Rein, told the Federal Drive with Terry Gerton in a May interview. “I think it’s important. I don’t think there’s big problems with it. But in the definitions, they could be expanded a bit to just make it clear that more things can be shared perhaps beyond cyber threat indicators as defined, maybe collaboration encouraged that is a little bit beyond what’s currently authorized by the statute. But the baseline is pretty good in the definitions right now.”
Copyright
© 2025 Federal News Network. All rights reserved. This website is not intended for users located within the European Economic Area.
link