A coalition of 35 business associations is urging congressional leaders to preserve a 10-year extension of federal cyber threat-sharing authorities in the final fiscal year 2027 (FY 2007) defense policy bill.
The coalition’s Nov. 1 letter supports Section 1706 of the House-passed National Defense Authorization Act (NDAA). The provision would extend the Cybersecurity Information Sharing Act of 2015 (CISA 2015) through 2035.
The letter asks the leaders of the House and Senate Armed Services committees to retain the provision while reconciling their versions of the legislation.
“In this environment, the speed and breadth with which defenders share information determines whether they keep pace with adversaries,” the coalition wrote. “That speed depends on the legal certainty CISA 2015 provides.”
Enacted in December 2015, CISA 2015 was designed to improve coordination between the federal government and private sector in identifying, preventing, and responding to cyberattacks. The law originally included a 10-year sunset provision and was set to expire Sept. 30, 2025, but Congress has since extended its authorities through Dec. 11, 2026.
The associations said CISA 2015 enables voluntary sharing of cyber threat indicators and defensive measures between private entities and the federal government. They also pointed to the law’s liability protections and legal certainty as incentives for that sharing.
Artificial intelligence (AI) has increased the urgency of long-term reauthorization, the group said, because advanced AI systems can identify and exploit software vulnerabilities at machine speed and AI tools can make sophisticated cyber capabilities faster, cheaper, and easier to use.
“In an era of increasingly sophisticated AI-enabled cyber threats, it is more important than ever for the private sector and the government to quickly and securely share information about cyber threats and defenses,” the letter reads.
Signatories include the Business Roundtable, U.S. Chamber of Commerce, Business Software Alliance, Cybersecurity Coalition, Information Technology Industry Council, National Technology Security Coalition and other groups representing banking, aviation, energy, telecommunications, manufacturing, healthcare, and water utilities.
FY 2027 NDAA seeks long-term CISA 2015 reauthorization
The House-passed bill would do more than reauthorize the law. Section 1706 would add statutory definitions for AI and critical infrastructure, update federal cyber information-sharing procedures and guidance, and address the use of AI deployed strictly for cybersecurity purposes.
The legislation would also require the federal government to maintain the capability to share cyber threat indicators and defensive measures in real time, consistent with protections for classified information. It would also require the government to maintain the capability to provide voluntary technical assistance to non-federal entities using that information for cybersecurity purposes.
According to the coalition’s letter, these authorities would “support the timely exchange of actionable threat intelligence and are central to the collective defense of public- and private-sector networks, particularly across critical infrastructure sectors.”
While the House advanced its version of the annual defense policy bill, the Senate remains at an impasse.
The Senate has not begun floor consideration after a July 14 cloture vote on the motion to proceed failed, 50-46. Senate Democrats voted against beginning debate. Senate Minority Leader Chuck Schumer, D-N.Y., cited concerns about President Trump’s military actions involving Iran and the bill’s overall funding level.
Congress is scheduled to return from its pre-election recess the week of Nov. 9, and the Senate is expected to address the NDAA and compromise legislation during the lame-duck session.