The House passed the National Defense Authorization Act (NDAA) by a narrow margin, embedding a decade-long extension of the Cybersecurity and Information Sharing Act of 2015. But if you're counting on renewed legal protections for threat intelligence sharing, don't update your vendor contracts yet. The bill faces Senate opposition, lacks matching language in the Senate's draft NDAA, and must survive bicameral negotiations before it becomes law.
For GRC leaders managing threat intelligence programs, this legislative uncertainty creates a planning problem: your information-sharing agreements with federal partners and ISACs operate under legal frameworks that could lapse on September 30th.
Legislative Challenges
The CISA 2015 statute expired briefly last year, leaving federal agencies without visibility into private sector threat data. Congress patched it with a temporary extension through September 30th. The House's NDAA now proposes a ten-year renewal through the Widespread Information Management for the Welfare of Infrastructure and Government Act, but Senator Rand Paul has vowed to block any reauthorization unless CISA (the agency, created in 2018) is prohibited from counter-disinformation work. This demand is stalling progress.
Meanwhile, the Senate's NDAA draft doesn't include the extension. Even if floor amendments add it, the provision must survive conference committee negotiations between chambers.
Implications for Threat Intel Programs
Legal protection gaps are creating vendor and partner friction. Your threat intelligence sharing agreements with federal partners rely on CISA 2015's liability protections. When the statute lapsed last year, some organizations paused automated threat feeds to DHS and sector-specific agencies while legal teams reviewed exposure. Temporary extensions don't solve this: vendors and insurance carriers want certainty before they approve data-sharing architectures.
The legislative vehicle matters more than the policy. CISA 2015 reauthorization appeared in last year's House Homeland Security Committee markup but never reached a floor vote. It resurfaced in May's bipartisan AI legislative package with a 2035 extension, which gained no traction. Attaching it to the NDAA is strategic: defense policy bills are must-pass legislation. But that calculus only works if both chambers agree, and right now they don't.
Agency-statute confusion is muddying the debate. Senator Paul's objection conflates CISA the law (2015, about threat data sharing) with CISA the agency (created 2018, part of DHS). His demand to restrict the agency's disinformation work has nothing to do with the statute's threat intelligence provisions. This confusion is delaying reauthorization and forcing practitioners to explain the difference to boards and executive teams who read the headlines.
Pentagon cyber reorganization is splitting House and Senate priorities. The Senate's NDAA draft would merge the Pentagon's CIO role with the assistant secretary of defense for cyber policy into a single "undersecretary of Defense for cyber, information, and networks" within two years. The House version calls only for a "review and realignment" of cyber roles. This organizational tension reflects broader uncertainty about who owns offensive cyber operations, a question that affects how defense contractors structure their security programs and compliance attestations.
What This Means for Your Team
If you're a GRC leader at a critical infrastructure operator or a defense contractor, you're managing three concurrent risks:
First, your threat intelligence sharing posture is operating on borrowed time. Automated feeds to DHS, sector ISACs, and the Cybersecurity and Infrastructure Security Agency depend on liability protections that expire September 30th. If reauthorization fails, you'll need legal review of every data-sharing agreement to assess exposure under state privacy laws and contractual indemnification clauses.
Second, your board or executive team may not understand why this matters. CISA 2015 isn't a compliance mandate like the General Data Protection Regulation or NIST SP 800-171. It's an enabler: it creates safe harbor for voluntary sharing. But when your CISO explains why threat feeds went dark or why incident response coordination with federal partners slowed, you'll need a clearer narrative than "Congress didn't renew a law."
Third, your vendor and partner ecosystems are watching the same calendar. If you're negotiating threat intelligence platform contracts, managed security services, or ISAC memberships, vendors are pricing in regulatory uncertainty. Expect shorter contract terms, higher indemnification requirements, or carve-outs for federal data sharing until reauthorization passes.
Action Items by Priority
Immediate (before September 30th):
Review every threat intelligence sharing agreement that relies on CISA 2015 protections. Flag contracts with DHS, FBI, and sector-specific agencies. Ask your legal team: if the statute lapses again, what's our exposure? Do we need board-level approval to continue sharing, or can we operate under existing vendor indemnification?
Map your automated threat feeds. Which systems push indicators of compromise, malware signatures, or vulnerability data to federal partners? Document the business justification for each feed so you can make triage decisions if legal counsel recommends pausing data flows.
Short-term (Q3 2025):
Prepare a one-page explainer for your board or executive team on the difference between CISA the statute and CISA the agency. Use plain language: "The 2015 law lets us share threat data with the government without getting sued. The 2018 agency is part of DHS and coordinates national cybersecurity. Senator Paul's objection to the agency's work is blocking renewal of the law." You'll need this if reauthorization fails and you're explaining operational changes.
Engage your trade association or ISAC on legislative advocacy. If you're in financial services, healthcare, or energy, your sector ISAC is tracking this. Ask what they're hearing from Hill staff about amendment prospects in the Senate and whether conference committee negotiations are likely to preserve the House language.
Medium-term (Q4 2025 and beyond):
Stress-test your incident response plan for scenarios where federal coordination is slower or legally riskier. If CISA 2015 lapses permanently, your Computer Security Incident Response Team may need to rely more heavily on private sector threat intelligence platforms and peer-to-peer sharing through ISACs. Review your retainer agreements with forensics firms and outside counsel to confirm they can operate without federal data-sharing channels.
Evaluate whether your threat intelligence program needs to shift from real-time automated sharing to manual, case-by-case legal review. That's not ideal, but it's a fallback position if liability protections disappear. Document the operational cost: how much slower is your detection and response when you can't pull federal threat feeds automatically?
