Overview

• The Cybersecurity Information Sharing Act of 2015 is set to lapse on September 30 unless a bicameral reauthorization deal is reached, and committee chairs including Rand Paul and Andrew Garbarino have scheduled markups next month without a finalized agreement.
• Without its liability and antitrust shields, companies would move threat-data sharing decisions from CISOs to general counsels, potentially slashing raw information flows by 80–90 percent, experts warn.
• Industry observers expect a brief extension to be attached to the fiscal-year continuing resolution, but long-term reauthorization may stall over proposed amendments on privacy, agency authority and anti-censorship measures.
• A recent Supreme Court decision on federal regulatory power has heightened uncertainty around non-statutory guidance from the Justice and Homeland Security departments if CISA protections expire.
• Security specialists caution that a lapse would hit small and medium businesses—already facing average ransomware losses of $432,000—and disrupt hospitals’ access to critical threat alerts linked to patient-safety outcomes.