CISA 2015 reauthorization gains White House backing, hits Rand Paul roadblock

The Senate's pre-dawn Aug. 8 passage of a continuing resolution that carries CISA 2015 protections through Dec. 10 buys time. But the real fight is over whether the 119th Congress delivers the long-term reauthorization industry has spent two years lobbying for, or whether Rand Paul forces the whole thing onto the short-term treadmill.

The House moved first and more ambitiously. Homeland Security Chairman Andrew Garbarino's WIMWIG Act (reauthorizing CISA 2015 through fiscal 2035 with updates addressing AI, supply chain threats, and operational technology) was folded into the House NDAA and passed July 22 on a 216-212 vote. The White House formally backed reauthorization in its statement of administration policy on the NDAA, the first time the Trump administration has publicly committed to extending the law.

That commitment matters. CISA 2015 isn't a regulatory program, it's the legal backbone for voluntary threat-intelligence sharing between the private sector and DHS. Without it, contractors and critical infrastructure operators lose liability and antitrust protections when they share cyber threat indicators and defensive measures. The law also carries a FOIA exemption that keeps shared data out of public records requests. Letting it lapse Oct. 1 doesn't make information sharing illegal, but it removes the safe harbor that makes corporate counsel comfortable authorizing it.

What Rand Paul wants

Paul cancelled a Sept. 18 markup of his own draft reauthorization bill after industry groups panned it, then blocked ranking member Gary Peters's attempt to pass a clean 10-year extension on the floor. The Paul draft would have made "significant changes" to the law, per Inside Cybersecurity's reporting, the kind of changes that the IT Sector Coordinating Council and Business Roundtable have spent months arguing against.

"Industry's preference is for a long-term reauthorization," one source told Inside Cybersecurity. But another industry source conceded that short-term extensions are more likely with Paul chairing the Homeland Security committee. The consensus among stakeholders: a clean 10-year reauthorization can probably get through the Senate if Paul allows it to move. Garbarino's WIMWIG, with its AI and supply-chain additions, faces longer odds.

The Oct. 1 clock

The CR extending protections to Dec. 10 passed the Senate but the House version, passed July 21, doesn't include a CISA 2015 extension. That means the Dec. 10 date isn't yet locked, House and Senate have to reconcile their CRs, and the House could strip the CISA language. If it does, the lapse hits Oct. 1.

ITI's John Miller put it plainly: "Any lapse in these authorities will likely disrupt critical information sharing activities nationwide, significantly weaken U.S. cybersecurity defenses, and empower malicious actors with new opportunities to exploit vulnerabilities." For the practitioner, the calculus is simpler, if the protections lapse, your legal department probably tells you to stop sharing until they're back. That's the chill.