Coalition Letter Supporting Reauthorization of the Cybersecurity Information Sharing Act of 2015

Summary

SIFMA joined a broad coalition of industry associations in urging Congress to include a 10-year reauthorization of the Cybersecurity Information Sharing Act of 2015 (CISA 2015) in the final FY2027 National Defense Authorization Act. The letter emphasizes the importance of preserving legal protections that enable timely cyber threat information sharing between the private sector and government, particularly as AI-enabled cyber threats continue to evolve.

Excerpt

We write to express our strong support for Section 1706 of H.R. 8800, which would reauthorize the Cybersecurity Information Sharing Act of 2015 (CISA 2015) for an additional 10 years. As you work to reconcile the House and Senate versions of the Fiscal Year 2027 National Defense Authorization Act (NDAA), we urge you to retain this provision in the final conference agreement. In an era of increasingly sophisticated AI-enabled cyber threats, it is more important than ever for the private sector and the government to quickly and securely share information about cyber threats and defenses.

Over the past decade, CISA 2015 has become a foundational component of the nation's cybersecurity. The law enables the voluntary sharing of cyber threat indicators and defensive measures between private entities and with the federal government, while providing the liability protections and legal certainty needed to encourage such sharing. These authorities support the timely exchange of actionable threat intelligence and are central to the collective defense of public- and private-sector networks, particularly across critical infrastructure sectors.

The case for a long-term reauthorization has only grown more urgent. Recent incidents have demonstrated that advanced AI systems can identify and exploit software vulnerabilities at machine speed, collapsing the window between the discovery of a weakness and its use in an attack. AI tools are also making sophisticated cyber capabilities cheaper, faster and easier to use, allowing threats to spread and adapt in real time. In this environment, the speed and breadth with which defenders share information determines whether they keep pace with adversaries. That speed depends on the legal certainty CISA 2015 provides.