OTCC joins call to reauthorize CISA 2015 in the FY2027 NDAA
The Cybersecurity Information Sharing Act of 2015 (CISA 2015) is set to expire on December 11, 2026. To keep that from happening, OTCC joined 34 organizations from across critical infrastructure in a November 1 letter urging the leaders of the House and Senate Armed Services Committees to include a long-term reauthorization in the final Fiscal Year 2027 National Defense Authorization Act (NDAA).
The letter supports Section 1706 of H.R. 8800, the House version of the NDAA, which would extend CISA 2015 for 10 years, through 2035. As the House and Senate work to reconcile their versions of the bill, we’re asking conferees to keep that provision in the final agreement.
Why CISA 2015 matters
For the past decade, CISA 2015 has been a foundation of how the private sector and government work together on cybersecurity. The law enables the voluntary sharing of cyber threat indicators and defensive measures between companies and with the federal government, and it provides the liability protections and legal certainty that make organizations willing to share in the first place.
That sharing is especially important in operational technology environments. When a vulnerability in an industrial control system is exploited, the consequences can reach well beyond data, disrupting the physical operations that power the grid, treat drinking water, and keep manufacturing lines running. Timely, actionable threat intelligence gives OT owners and operators a better chance of seeing an attack coming and stopping it before it causes harm.
Why now
The case for a long-term reauthorization has only grown more urgent. AI systems can now identify and exploit software vulnerabilities at machine speed, shrinking the window between when a weakness is discovered and when it’s used in an attack. AI tools are also making sophisticated cyber capabilities cheaper and easier to use. In that environment, how quickly defenders can share information determines whether they keep pace with adversaries, and that speed depends on the legal certainty CISA 2015 provides.
A short-term extension or a lapse would put that certainty at risk. A 10-year reauthorization would give critical infrastructure owners, operators, and the companies that support them the stability they need to keep sharing.
We appreciate the Armed Services Committees’ leadership on this issue and urge Congress to include these protections in the final NDAA.
Read the full letter here:
Comments