The Cybersecurity Information Sharing Act Faces Expiration

The Cybersecurity Information Sharing Act (CISA) is set to expire on 30 September 2025 unless reauthorized by the US Congress, and at the time of writing it has not been reauthorized. The article notes that a sunset clause means the law will lapse unless Congress acts, prompting questions about risk, politics and the future of threat intelligence.

It describes CISA as encouraging threat information sharing while protecting the identities of those involved, and includes views from several industry figures on whether it will be renewed. According to Andrew Grosso, there is an expectation that CISA will be renewed, probably retroactively, but the certainty remains uncertain and renewal could take weeks or months.

Moiz Virani also believes there is a moderate to high chance of renewal, but acknowledges it is not guaranteed and that the renewal process could be complex. The piece frames the potential renewal as an opportunity to improve the framework, while warning that any gap in information sharing would leave a serious void in the legal protections for reporting entities.