CISA 2015 Law Set to Expire Amid New Cyber Incident Reporting Requirements

• •CISA 2015 is set to expire on September 30, 2026, affecting data sharing protections.
• •The CIRCIA law introduces new mandatory reporting requirements for critical infrastructure sectors.
• •Industry groups are pushing for the renewal of CISA to avoid gaps in cybersecurity collaboration.

The Cybersecurity Information Sharing Act (CISA) of 2015 is set to expire on September 30, 2026, with Congress yet to decide on its renewal. This law facilitates data sharing between the government and private sector, providing legal protections for companies that report cyber threats. A Congressional Research Service report warns that without CISA, private entities may hesitate to share vital threat information, potentially leading to a lack of comprehensive threat awareness. Concurrently, the Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) mandates new reporting obligations for tech companies, which will significantly impact compliance across the sector. CISA's expiration could hinder the effectiveness of CIRCIA's implementation, as both laws are intertwined in addressing cybersecurity challenges. The tech industry is advocating for a long-term renewal of CISA to maintain these protections.