Congress quietly extends cybersecurity data-sharing law for a decade

What it does

This bill extends the Cybersecurity Information Sharing Act of 2015 (CISA) by ten years, moving its expiration date from September 30, 2025 to September 30, 2035. It also retroactively applies this extension to October 1, 2025, and renames the law the 'Protecting America from Cyber Threats Act.' The extension allows the federal government and private companies to continue sharing cybersecurity threat information under the existing legal framework.

Why we flagged it

The bill's sole operative function is a ten-year reauthorization of an existing cybersecurity information-sharing regime. It is a routine extension of expiring statutory authority, not a new policy or structural change.

What the text implies

• Retroactive effective date (Oct 1, 2025) means the law was technically expired for one day; retroactive application erases that gap and validates any information-sharing that occurred during that window without new statutory authority.
• Renaming from 'Cybersecurity Information Sharing Act' to 'Protecting America from Cyber Threats Act' is cosmetic but may signal a shift in framing—from information-sharing as the mechanism to threat-protection as the stated purpose, potentially broadening justifications for data collection.
• The extension runs through 2035 without sunset review, meaning Congress will not revisit CISA's liability protections, data-minimization standards, or privacy safeguards for a decade unless a new bill is introduced.

Section numbers refer to the bill text the analysis read — linked under Primary records below.

Who it affects

Citizens benefit from continued cybersecurity threat-sharing that may improve national defense against cyberattacks. However, CISA's liability protections for companies sharing data—even inaccurate or overbroad data—remain in place, potentially allowing surveillance overreach or privacy violations without legal recourse for individuals harmed by misuse of shared information.

Who stands to gain

• Technology and telecommunications companies (continued liability protection for data-sharing)
• Cybersecurity service providers (continued market for threat-intelligence products)

Named in the bill

Cybersecurity Information Sharing Act of 2015 (CISA), Protecting America from Cyber Threats Act, Department of Homeland Security, Title XXII of the Homeland Security Act of 2002, Private sector (technology, telecom, critical infrastructure)

Where it stands

15 cosponsors: 8 Republicans, 6 Democrats, 1 Independents.

• Oct 7, 2025 — Introduced · Congress.gov: “Introduced in Senate”

Dates and quoted wording are Congress.gov's action record; the timeline shows status changes, not every procedural step.

Money around this bill

29 lobbying clients named this bill on 41 disclosure filings across 3 quarters, Dec 2025 to Jun 2026. Those filings disclosed $66,448,000 in lobbying spend. A filing names 12 bills on average, so that figure is what each filing reported, not a share belonging to this bill.

More lobbying clients named this bill than 98% of bills with at least one filing.

Gary Peters, the sponsor, reported $-186,100 in PAC receipts in the 2026 cycle.

• Chamber of Commerce of the U.S.A. — $34,910,000 on 2 filings
• Business Roundtable Inc — $6,950,000 on 1 filing
• American Bankers Association — $5,210,000 on 2 filings
• Boeing Company — $2,770,000 on 1 filing
• National Association of Manufacturers — $2,730,000 on 1 filing

Lobbying Disclosure Act filings through Jul 20, 2026. A filing shows who paid to lobby on a bill it names, not what changed.