American flags planted to commemorate lung cancer victims fly in the wind along the National Mall on November 10, 2025 on Capitol Hill in Washington, DC. The Senate reached a deal late Sunday to fund the Government, aiming to end the longest shutdown in history. Tom Brenner/Getty Images
By David DiMolfetta,
Cybersecurity Reporter, Nextgov/FCW
|
The Cybersecurity Information Sharing Act of 2015 expired when the government’s calendar reset without a funding package for FY 2026.
The proposed Senate bill that would end the longest government shutdown in U.S. history contains a measure to reauthorize, at least in the near term, a bedrock cybersecurity data-sharing law.
The 2015 Cybersecurity Information Sharing Act lapsed when the government shut down at the end of the fiscal year. The law gave companies various forms of legal cover when they transmitted cyber threat data to the government. The Senate measure passed Sunday night would extend the law through Jan. 30, 2026.
Legal exemptions were made a core feature of the 2015 regulation because cyber threat information often contains sensitive data about victims and companies. To help agencies like the FBI track nation-state cyber threats and criminal hackers, those datasets often need to be shared with government analysts.
The 2015 law’s expiration opened the door wider for cyber adversaries, as it disincentivizes the exchange of information that can help stop hacking threats. Public and private sector entities have also sought to rework their legal approaches to keep data exchanges afloat.
For weeks, lawmakers have pursued means to revive the statute as the shutdown persisted. Months ahead of the shutdown, industry leaders and senior administration officials pressed for renewal, but Congress remained at an impasse.
Since at least May, the Trump administration has argued for a clean, 10-year extension of the measure. The temporary reprieve offered in the latest shutdown-ending package means that the law risks lapsing again at the start of February.