Consequences of CISA Expiration: Cyber Regulation Experts Weigh In

The Importance of CISA 2015 Protections

• 🛡️ The Cybersecurity Information Sharing Act of 2015 (CISA) provides foundational protections for voluntary cyber security information sharing between the private sector and the government.
• 🤝 These protections include liability protections and antitrust protections, fostering increased collaboration not only within industries but also across different sectors.
• 📉 Expiration of CISA would mean a walk-back of gains made in collective defense and could lead to companies being reluctant to share critical threat information.

Enhancing CISA for Future Threats

• 📈 Experts suggest that CISA should be reauthorized with enhancements based on lessons learned over the past decade to improve its effectiveness.
• 💡 CISA's existing authorities, such as the CPAC Authority, can be better utilized to structure comment processes and engage stakeholders more effectively without undue delays.
• 🌐 The law has spurred the growth of information sharing organizations (ISACs), which are structured around its provisions; its expiration would necessitate significant restructuring and loss of critical time.

Information Sharing vs. Incident Reporting

• 🔍 Information sharing focuses on ongoing threats, tactics, techniques, and procedures (TTPs) to enable collective defense against evolving adversary actions.
• 📊 Incident reporting, while also valuable, occurs after a risk is known and helps identify patterns, socialize information broadly, and inform government priorities and policy.
• ✅ Both sharing and reporting are crucial but require robust protections to ensure government can effectively ingest and utilize the information without burdening defenders.

The Monumental Cost of CISA's Expiration

• ⚠️ Allowing CISA to expire would be monumental in its negative impact, causing companies to be extremely cautious about what they submit.
• 🔒 The loss of protections would undermine national security by potentially halting or significantly slowing down information sharing that has previously prevented threats and incidents.