CISA 2015 Lapses With Reauthorization Uncertain — Why It Matters, What's At Stake, And What's Next

On Tuesday, September 30, 2025, the Cybersecurity Information Sharing Act of 2015 (CISA 2015) expired after its 10-year effective period lapsed without reauthorization from Congress, in the wake of a government shutdown that took effect on October 1, the following day. This cornerstone framework has served as an enabling mechanism for industry to voluntarily share cyber threat indicators and defensive measures with the federal government while receiving liability and privilege protections that make such collaboration feasible in practice. CISA 2015's lapse could cause tremors through the foundation of public–private cyber defense, chilling information sharing and weakening collective resilience. Businesses and trade groups have urged the extension of the law to preserve these protections, but political obstacles have cast doubt on whether reauthorization, albeit delayed, is a possibility. As a result, both private entities and government agencies may face uncertainty