Congress quietly extends cybersecurity law without reviewing privacy safeguards
S. 1337 — Cybersecurity Information Sharing Extension Act · Filed by Gary Peters (D-MI) · 4 cosponsors · Introduced Apr 8, 2025 · Referred to committee
Your members of Congress
Enter a ZIP to see where your representative and both senators stood on this bill.
Looked up on this device — your ZIP is never stored on our servers.
What it does
This bill extends the sunset date of the Cybersecurity Act of 2015 by ten years, from 2025 to 2035. It keeps in place the existing framework for voluntary sharing of cybersecurity threat information between private companies and the federal government without changing the underlying rules or protections.
Why we flagged it
The bill is a straightforward procedural extension of an existing statute. It does not create new policy, alter the substantive framework, or introduce novel mechanisms — it simply postpones the expiration date of the Cybersecurity Act of 2015 by ten years.
What the text implies
- The extension occurs without a reauthorization hearing or substantive review of the 2015 Act's effectiveness, privacy safeguards, or liability protections — the bill assumes the existing framework remains fit for purpose through 2035.
- Companies participating in the voluntary information-sharing program face no new transparency or accountability requirements; the extension preserves existing liability shields and safe harbors without clarifying their scope or limits.
The full analysis lists 3 implications of this text.
Who stands to gain
technology and cybersecurity companies (beneficiaries of liability protections under the 2015 Act); critical infrastructure operators (beneficiaries of threat-intelligence access)