AI threats create ‘urgent’ need to renew cybersecurity information-sharing law, businesses tell Congress - Cybersecurity Dive
Three dozen business groups representing critical infrastructure sectors are urging Congress to renew the Cybersecurity Information Sharing Act before it expires next month.
The 2015 Cybersecurity Information Sharing Act "has become a foundational component of the nation's cybersecurity," according to the groups. The law provides liability protections for companies sharing cyber threat indicators among themselves and with federal agencies, underpinning public-private collaboration groups that have emerged over the past decade.
Lawmakers Consider Extension
After the law's initial 10-year period expired in 2025, lawmakers passed several short-term extensions, with the latest set to lapse on Dec. 11. Businesses now want Congress to include a new 10-year extension in the National Defense Authorization Act for fiscal year 2027.
These authorities support the timely exchange of actionable threat intelligence and are central to the collective defense of public- and private-sector networks, particularly across critical infrastructure sectors.
AI Threats Accelerate Need
Cybersecurity experts say the need for machine-speed information sharing has grown as AI has accelerated vulnerability discovery and cyberattack orchestration. The business groups pointed to recent vulnerability crises that have led to global patching scrambles.
The House's draft version of the 2027 NDAA includes a provision reauthorizing and renaming the cybersecurity information sharing law, adding AI to the list of topics companies can share. The Senate's draft NDAA does not include this reauthorization.
Lawmakers will begin reconciling the two bills after returning to Washington on Nov. 9 following the midterm elections.
Related
