US organisations share threat indicators every day, but the legal protections for that sharing depend on a 2015 statute that has lapsed twice and now runs on short extensions. The Cybersecurity Information Sharing Act of 2015 (CISA 2015, codified at 6 U.S.C. 1501 and following) authorises private entities to monitor their own systems, operate defensive measures and share cyber threat indicators, and it attaches liability, antitrust, disclosure and privilege protections to sharing done in line with its rules. This guide explains what the Act protects, the duty to strip personal information first, how to apply it when the indicator is a leaked API key, token or other machine credential, and where the reauthorisation stands as of 10 November 2026. It is written for security, threat intelligence and legal teams who run sharing programmes. Note the name clash: in this guide "CISA 2015" means the Act, and "the CISA agency" means the Cybersecurity and Infrastructure Security Agency.
Key takeaways
- The current sunset is 11 December 2026. The Office of the Law Revision Counsel text of 6 U.S.C. 1510 shows the subchapter effective through 11 December 2026, as amended in 2026, after lapses in late 2025 and early 2026.
- Protection follows compliance. The liability shield in 6 U.S.C. 1505 covers sharing and monitoring conducted in accordance with the subchapter, so a sharing process that skips the personal information review can lose it.
- Remove personal information before you share. Section 1503(d)(2) requires removal of information not directly related to the threat that the sharer knows identifies a specific person, by manual review or a technical capability.
- Share the fingerprint, not the secret. For leaked machine credentials, the useful indicator is usually the exposure context, attacker infrastructure and a non-reversible identifier, not the live secret value. This is our recommendation, not a statutory rule.
- Plan for a lapse. Information obtained before a sunset date stays governed by the Act, but sharing during a gap may not get its protections, so keep contracts and alternative legal bases ready.
Reauthorisation status as of November 2026
CISA 2015 was passed as Title I of the Cybersecurity Act of 2015 with a ten year life. The Congressional Research Service and law firm summaries describe the history below. We checked the sunset date and amending public laws on the official US Code site and congress.gov; the lapse dates come from two independent secondary sources that agree.
| Date | Event | Source |
|---|---|---|
| 18 December 2015 | Subchapter takes effect | 6 U.S.C. 1510 (OLRC) |
| 30 September 2025 | Original ten year sunset reached during the government shutdown | Davis Wright Tremaine; American Public Power Association |
| November 2025 | Temporary renewal to 30 January 2026 in the Continuing Appropriations and Extensions Act, 2026 (H.R. 5371, Pub. L. 119-37, enacted 12 November 2025) | congress.gov bill status; Congressional Research Service; American Public Power Association |
| Early 2026 | Short lapse, then the FY2026 Consolidated Appropriations Act extends it to 30 September 2026 (Pub. L. 119-75) | 6 U.S.C. 1510 amendment notes (OLRC); Congressional Research Service |
| September 2026 | Continuing resolution extends it into December 2026 (Pub. L. 119-103) | 6 U.S.C. 1510 amendment notes (OLRC); Federal News Network; MeriTalk |
| 11 December 2026 | Current sunset in the US Code text | 6 U.S.C. 1510 (OLRC) |
Long term reauthorisation bills have been introduced, and reporting in September 2026 described the Senate route as blocked over free speech concerns. We do not know whether a multi year reauthorisation will pass before 11 December 2026. Check congress.gov and the US Code before relying on any date in this table. Section 1510 also states that actions taken and information obtained before the sunset date remain governed by the subchapter.
What the Act authorises and protects
The structure is easier to work with when you map each protection to its section. All rows below are from the US Code text published by the Office of the Law Revision Counsel and the joint DHS and Department of Justice guidance for non-federal entities.
| Provision | Section | What it does | Condition that matters |
|---|---|---|---|
| Monitoring | 1503(a) | A private entity may monitor its own information systems for cybersecurity purposes | Systems of others only with written consent |
| Defensive measures | 1503(b) | May operate defensive measures on its own systems | Others' systems only with written consent |
| Sharing | 1503(c) | Non-federal entities may share and receive indicators and defensive measures | Honour lawful restrictions the sharer attaches |
| Personal information removal | 1503(d)(2) | Remove information not directly related to the threat that identifies a specific person | Manual review or a technical capability, before sharing |
| Antitrust exemption | 1503(e) | Sharing for cybersecurity purposes is not an antitrust violation | Section 1507(e): does not permit price fixing, market allocation or boycotts |
| No privilege waiver | 1504(d)(1) | Sharing with the federal government does not waive privilege or trade secret protection | Applies to sharing under the subchapter |
| Proprietary designation | 1504(d)(2) | Sharer may mark information as commercial, financial and proprietary | Mark it at the time of sharing |
| Disclosure exemption | 1504(d)(3) | Exempt from FOIA and similar state, tribal and local disclosure laws | Information shared with the federal government |
| Regulatory use limits | 1504(d)(5) | Governments may not use the information to regulate lawful activity | Narrow exception for rules aimed at preventing cyber threats |
| Liability protection | 1505(a), (b) | Suits over monitoring or compliant sharing are to be promptly dismissed | Sharing with the federal government must go through the DHS capability in 1504(c) |
| No duty to share | 1505(c) | Creates no duty to share, warn or act | Existing defences remain |
The DHS and DOJ guidance (April 2024 update) summarises how these apply by recipient: private entities get liability protection for sharing with each other and for sharing with the federal government through DHS channels, and the antitrust exemption applies to sharing among private entities. The guidance describes itself as assistance, not authority. For how the communities that use these protections work, see the ISACs and Information Sharing Communities Guide.
The personal information duty in practice
The duty sits with the sharer, not with the agency receiving the data. The DHS and DOJ guidance gives examples that help set a review standard.
- Usually shareable: IP addresses probing for an unpatched vulnerability, domains and IPs used for botnet command and control, malicious email characteristics, file hashes, URLs, malware samples and descriptions of exfiltrated file types.
- Usually removed: the names and individually identifying parts of recipient email addresses, the medical condition of a phishing target, and named targets where a role such as "senior management" would do.
- Treat with care: data covered by other laws, such as health records under HIPAA, education records under FERPA, consumer and credit data under FCRA, financial data under Gramm-Leach-Bliley and children's data under COPPA, is unlikely to be directly related to a threat.
- Edge case the guidance names: a compromised individual email account may itself be directly related to the threat when detection depends on it.
The guidance does not discuss passwords, API keys or tokens by name. Our reading, which you should confirm with counsel, is that the same test applies: share what defenders need to detect the threat, and remove what identifies a person without helping detection.
Sharing leaked credentials and NHI indicators
Leaked secrets are among the most useful indicators a security team holds, because the same key often appears in many places and the infrastructure that tests it is reused. They are also the most dangerous to share carelessly, because the indicator is itself a working credential. The table below is NHI Mgmt Group's recommended handling, not a statutory list.
| Artefact | Share? | How |
|---|---|---|
| Live secret value (API key, token, password) | No, except to the issuer for revocation | Revoke first; send the value only through the issuer's reporting channel |
| Non-reversible identifier | Yes | Key ID, public prefix or a salted hash agreed with the community |
| Exposure location | Yes, once removed or reported | Repository URL, paste site, package name and version, commit time |
| Attacker infrastructure using the key | Yes | Source IPs, user agents, ASN, timing, as STIX observables |
| Owner identity (developer name, personal email) | Usually no | Replace with role or team unless directly related to the threat |
| Defensive measure | Yes | Detection rule or query for use of the identifier |
Revocation comes before sharing. The Leaked Credential Response Playbook covers rotation and scoping; the Threat Intelligence for Identity and NHI Guide covers which identity indicators are worth collecting. For machine formats, the AIS service uses STIX and TAXII 2.1; see the STIX and TAXII Guide.
Choosing a sharing route
| Route | What the sources describe | When to choose it |
|---|---|---|
| AIS (CISA agency) | Free machine to machine exchange over a TAXII 2.1 capability; requires Terms of Use, a PKI certificate from a Federal Bridge Certificate Authority and an interconnection agreement | You produce indicators at volume and want federal channel liability protection |
| Web form or email to the CISA agency | Listed DHS channels in the DHS and DOJ guidance | Occasional, high value indicators |
| ISAC or ISAO | Guidance says sharing with these organisations can also be protected | Sector peers are the main audience |
| Direct peer to peer | Private to private sharing under 1503(c) | Bilateral incident coordination with a supplier or customer |
Small organisations: joining a sector ISAC is usually simpler than an AIS connection. Large organisations: run both, with one review pipeline feeding each. If sharing could touch privileged incident material, read the Legal Privilege in Incident Response Guide before setting up the workflow.
How to implement a compliant sharing programme
- Name an owner and a legal reviewer. Threat intelligence owns the content; legal approves the procedure once, not each indicator.
- Write the review standard. Turn the DHS and DOJ examples into a short list of fields to strip or generalise, including credential owner names and personal email addresses.
- Automate the removal. Use a technical capability in the sharing pipeline that drops or masks fields such as email local parts and free text, and log what it removed.
- Revoke before share. For credential indicators, block publication until the revocation ticket is closed.
- Mark and restrict. Apply proprietary designations and TLP or handling restrictions at the point of sharing.
- Pilot with one route. Start with your ISAC or AIS receive only, then enable submission after a month of reviewed samples.
- Prepare for lapse. Keep NDAs and information sharing agreements that stand without the Act, and a decision rule for whether to pause federal submissions during a gap.
- Roll back if needed. If a review failure is found, recall or revise the indicator through the same channel and record the correction.
Measuring the programme
- Review coverage: share of outbound indicators that passed the personal information check (target 100 percent).
- Revoke to share time: median hours from credential revocation to indicator release.
- Corrections: number of shared items recalled for personal information or accuracy each quarter.
- Inbound value: received indicators that produced a detection or block.
- Lapse readiness: share of sharing partners covered by an agreement that does not depend on the Act.
Common failure patterns
- Posting the live key: sharing a working credential in an indicator feed spreads the exposure the sharer meant to contain.
- Raw phishing emails forwarded whole: recipient names and addresses go out with the sample, against the removal duty.
- Assuming every channel is protected: federal sharing outside the DHS capability does not carry the 1505(b) liability protection.
- Ignoring the sunset: teams that treated the Act as permanent had no position ready during the late 2025 lapse.
- Treating antitrust cover as unlimited: the exemption excludes price fixing, market allocation and boycotts, so commercial talk in a sharing forum is still risky.
Framework mapping
| Framework | Reference | Link to this topic |
|---|---|---|
| NIST CSF 2.0 | ID.RA-02 | Threat intelligence received from information sharing forums |
| NIST CSF 2.0 | RS.CO-03 | Information shared with designated external stakeholders |
| NIST CSF 2.0 | GV.OC-03 | Legal requirements, including privacy and civil liberties, understood |
| NIST SP 800-53 Rev 5 | PM-15, PM-16 | Security groups and associations; threat awareness programme |
| NIST SP 800-53 Rev 5 | SI-5 | Security alerts, advisories and directives |
Practitioner checklist
- Record the current sunset date (11 December 2026 at the time of writing) and set a review reminder two weeks before it.
- Document which sharing routes you use and which protections each route carries.
- Adopt a written personal information removal standard based on the DHS and DOJ examples.
- Add an automated removal step and log its output.
- Require credential revocation before any credential indicator is shared.
- Share identifiers and context, never live secret values, outside the issuer's channel.
- Mark proprietary information and handling restrictions at the time of sharing.
- Keep sharing agreements that work if the Act lapses again.
Standards and references
- Office of the Law Revision Counsel: 6 U.S.C. Chapter 6, Subchapter I, Cybersecurity Information Sharing
- DHS and DOJ: Guidance to Assist Non-Federal Entities to Share Cyber Threat Indicators and Defensive Measures (April 2024 update)
- CISA: Automated Indicator Sharing
- Congressional Research Service: The Cybersecurity Information Sharing Act of 2015, Expiring Provisions
- Davis Wright Tremaine: Congress Extends CISA 2015 Through September 2026
- Federal News Network: CR extends cyber info sharing law through December
- Congress.gov: H.R. 5371, Continuing Appropriations and Extensions Act, 2026 (Pub. L. 119-37)
- American Public Power Association: CISA 2015 extended through January 30, 2026
- MeriTalk: Senate passes stopgap funding bill extending key tech programs
Related NHI Mgmt Group resources: ISACs and Information Sharing Communities Guide · STIX and TAXII Guide · Leaked Credential Response Playbook · CIRCIA Incident Reporting Guide. This guide summarises the Cybersecurity Information Sharing Act of 2015 and is not legal advice.