Your Threat Sharing Protection Now Expires December 11. The Statute Says What Happens to Sharing You Already Did.
Congress moved the Cybersecurity Information Sharing Act of 2015 sunset again this month. H.R. 6500, the Continuing Appropriations and Extensions Act, 2027, struck "September 30, 2026" from 6 U.S.C. 1510(a) and inserted "December 11, 2026."
That is section 2011 of the bill. Sections 2012 and 2014 moved two related authorities to the same date, the Federal Cybersecurity Enhancement Act of 2015 at 6 U.S.C. 1525(a) and the Technology Modernization Fund.
Eleven weeks of authorization, attached to a continuing resolution, for the statute that makes threat intelligence sharing legally safe.
What the protections actually are
CISA 2015 is voluntary. Nothing in it requires you to share anything. What it does is remove the legal penalties for sharing cyber threat indicators and defensive measures.
Four protections matter in practice. Information shared under the statute is exempt from disclosure under the Freedom of Information Act and comparable state and local disclosure laws. Sharing in accordance with the statute does not create liability. Sharing does not waive applicable privileges, including trade secret protection. And there are limits on regulatory use of what you share.
Those protections are why counsel signs off on participation in an information sharing and analysis center, and why threat data moves between institutions and the federal government at all.
The statute applies to non-federal entities generally. There is no sector limitation and no size threshold. A credit union, a payments company, and a Fortune 100 bank stand in the same position under it.
The lapse question, answered by the statute
Most coverage of these sunsets says protection disappears when the clock runs out. That is not what the text says, and the distinction changes what you should actually worry about.
Subsection (b) of 6 U.S.C. 1510 is an exception clause. It provides that for any action authorized by the subchapter, or information obtained pursuant to an authorized action, which occurred before the provisions cease to have effect, the provisions continue in effect.
Sharing you completed before a sunset keeps its protection. The text sets no expiration on that preservation. What a lapse exposes is sharing you do during the lapse, which sits outside the statute until Congress acts again. Your historical participation is not the risk. Your Tuesday morning during a gap is.
That reframes the operational question. You are not deciding whether to unwind years of participation. You are deciding what your team does with a threat indicator during a window when the statute is dark.
The protections are conditional
One point that gets lost in coverage of the sunsets: the protections are not automatic for any information you happen to share. They attach to sharing conducted in accordance with the statute's requirements.
The statute covers cyber threat indicators and defensive measures as it defines those terms, and it conditions protection on following its procedures, including obligations around personal information not directly related to a cybersecurity threat.
In practice that means two separate failure modes. One is sharing during a lapse, when the statute is dark for everyone. The other is sharing outside the statute's requirements at any time, which forfeits protection whether or not the authorization is current.
Institutions tend to plan for the first and assume the second is handled. If your sharing process was built years ago and has not been reviewed against the statute's conditions since, a lapse is a reasonable prompt to check both.
This has happened twice already
The original authorization carried a ten-year sunset and expired on September 30, 2025. The statute was dark until November 12, 2025, when a funding bill reauthorized it through January 30, 2026. It lapsed again for several days during a subsequent appropriations gap. The Consolidated Appropriations Act enacted February 3, 2026 extended it to September 30, 2026. This month's continuing resolution moved it to December 11.
Two lapses and four extensions inside fifteen months, every one of them attached to a funding vehicle rather than passed as standalone cybersecurity legislation.
That pattern is the planning assumption. Expect the December 11 date to be resolved the way the previous four were, in whatever appropriations fight is running at the time, on a timeline nobody can predict.
What to do before December 11
Write the lapse procedure now, not on December 12. Decide in advance what your team does with a threat indicator during a gap. Options generally include holding it until authorization returns, sharing under a different legal basis, or sharing with the protection question escalated to counsel. Any of those is defensible. Deciding it live, under time pressure, with a live threat, is the failure mode.
Get counsel's position on the other legal bases. Sharing that does not rely on CISA 2015 may still be supportable through existing agreements, sector arrangements, or other authorities. That analysis takes time and is the same analysis whether the lapse arrives in December or later.
Mark your sharing records against the dates. Subsection (b) protects what occurred before a sunset. Records that establish when a disclosure happened are what make that protection usable. Most organizations have this data and have never needed to retrieve it by date.
Check your ISAC and vendor agreements for dependencies. Some sharing arrangements reference the statute directly. Those references may behave differently during a lapse than they do now, and your counterparties may not raise it.
Put December 11 in front of your board or risk committee alongside the history. The useful framing is that this is now a recurring operational condition rather than a one-time event.
Source note
This article is based on the enrolled text of H.R. 6500, the Continuing Appropriations and Extensions Act, 2027, sections 2011, 2012, and 2014; the Cybersecurity Information Sharing Act of 2015 as codified at 6 U.S.C. 1501 through 1510, particularly subsections 1510(a) and 1510(b); and reporting on the extension from Nextgov/FCW and Defense One. The lapse and extension history draws on contemporaneous law firm client alerts from Covington, Hunton Andrews Kurth, and Davis Wright Tremaine.
Disclaimer
This article is provided for general information and does not constitute legal advice. Regulatory requirements, compliance dates, examiner priorities, and enforcement posture change frequently. The authorization described here expires on a near-term date and has been extended repeatedly on short notice. Whether any particular sharing activity qualifies for statutory protection depends on facts specific to that activity. Verify current requirements against primary sources and your legal counsel before acting on anything described here.