United States of America: Applicability of Cybersecurity Information Sharing Act of 2015 including data protection regulation extended until 30 January 2026

On 12 November 2025, the Cybersecurity Information Sharing Act of 2015 (CISA), which was scheduled to expire unless reauthorised by Congress, was extended until 30 January 2026 by the implementation of the Continuing Appropriations, Agriculture, Legislative Branch, Military Construction and Veterans Affairs, and Extensions Act, 2026. Its expiration would also terminate the Law’s data protection provisions, including the requirement for private entities to remove personal information not directly related to cybersecurity threats before sharing, as well as federal obligations for privacy review, oversight, and audit.