Extending Expired Cybersecurity Authorities Act
- Sponsor
- Sen. Peters, Gary C. [D-MI]
- Last action
- Oct 8, 2025
Bottom line
This bill extends a key federal cybersecurity information sharing program for another decade and renames the underlying act to reflect its broader protective mission.
What it actually does
This bill reauthorizes the Cybersecurity Information Sharing Act (CISA) of 2015, extending its sunset date from September 30, 2025, to September 30, 2035. It also renames the original Act to the "Protecting America from Cyber Threats Act" and includes conforming amendments to reflect this new title throughout relevant statutes, ensuring continuity of federal cybersecurity information sharing programs.
Proponents argue
Supporters argue that CISA 2015 has been crucial for enabling the sharing of cyber threat indicators and defensive measures between the government and private sector, significantly enhancing national cybersecurity. They contend that reauthorization is essential to maintain these vital protections against evolving cyber threats and ensure continuity in cybersecurity efforts without interruption.
Opponents contend
While direct opposition to the reauthorization of CISA's core information-sharing mechanisms is less common, some privacy advocates have historically raised concerns about the scope of data shared and potential for government surveillance. Critics might argue that a simple reauthorization misses an opportunity for comprehensive reform to strengthen privacy safeguards or adapt the framework to new technological realities.
The bill is extremely short and can be read in a couple of minutes, making it highly accessible for public review and evaluation.
Section 2(a)
Extension of Cybersecurity Information Sharing Act
This provision amends Section 111(a) of the Cybersecurity Information Sharing Act of 2015 to change its sunset date from September 30, 2025, to September 30, 2035. This effectively reauthorizes the Act for an additional ten years, allowing the programs and authorities established under it, which facilitate cyber threat information sharing between government and the private sector, to continue operating without interruption.
Supporters argue
Supporters argue that extending CISA is critical for national security, as it facilitates timely and effective information sharing necessary to defend against sophisticated cyberattacks. They contend that the existing framework has proven effective in enhancing the collective cybersecurity posture of the nation.
Critics contend
No specific opposition is typically raised against the reauthorization of CISA's core information-sharing mechanisms, though some privacy advocates have historically expressed concerns about the scope of data shared and potential for government surveillance. However, this bill is a simple reauthorization, not an expansion.
Tradeoffs
The primary tension involves balancing national security needs for robust cyber threat information sharing with privacy and civil liberties concerns regarding data collection and retention. The bill maintains the existing balance established in the original Act rather than altering it.
Section 2(c)
Renaming the Cybersecurity Information Sharing Act
This provision renames the "Cybersecurity Information Sharing Act of 2015" to the "Protecting America from Cyber Threats Act." It also includes conforming amendments to Title XXII of the Homeland Security Act of 2002, ensuring that wherever the old name appeared, it is replaced with the new title. This is a largely administrative change to the official designation of the underlying law.
The amendment made by subsection (a), which extends the sunset date of the Cybersecurity Information Sharing Act of 2015, shall take effect as if enacted on October 1, 2025. This ensures that there is no lapse in the legal authority for cyber threat information sharing, even if the bill passes after the original September 30, 2025, expiration date.
Section 2(b)
Why it matters:This is standard legislative practice to ensure continuity of authority, especially when a reauthorization bill might pass after an existing authority has technically expired. It is a technical provision designed to prevent a gap in legal authority and operational capabilities.
Case for: Supporters argue that a retroactive effective date is necessary to prevent any lapse in the critical cybersecurity information sharing authorities, ensuring seamless continuity of operations and legal protections for participants in the program. This avoids a period of uncertainty for both government and private sector entities.
Case against: No specific opposition is typically raised against retroactive effective dates for reauthorization, especially when it ensures the uninterrupted continuity of an established and widely supported program.
Estimated impact: Ensures uninterrupted operation of CISA 2015 authorities, preventing a temporary cessation of critical cyber threat information sharing activities between government and the private sector.