Request for Extension on the Cybersecurity Information Sharing Act (Joint Trades)

Summary

SIFMA, Alliance for Digital Innovation, American Bankers Association (ABA), American Public Power Association, Bank Policy Institute (BPI), Business Roundtable, Business Software Alliance, Edison Electric Institute (EEI), Independent Community Bankers of America (ICBA), Information Technology Industry Council (ITI), Institute of International Bankers (IIB), National Rural Electric Cooperative Association (NRECA), and the Operational Technology Cybersecurity Coalition provided comments to Congress requesting to extend the Cybersecurity Information Sharing Act before its September 30 expiration date.

Excerpt

September 4, 2025

Via Electronic Mail

The Honorable John Thune

Majority Leader

U.S. Senate

Washington, DC 20510

The Honorable Charles Schumer

Minority Leader

U.S. Senate

Washington, DC 20510

The Honorable Mike Johnson

Speaker

U.S. House of Representatives

Washington, D.C. 20515

The Honorable Hakeem Jeffries

Minority Leader

U.S. House of Representatives

Washington, D.C. 201515

Dear Majority Leader Thune, Minority Leader Schumer, Speaker Johnson, and Minority Leader Jeffries:

As the fall session begins, we urge Congress to extend the September 30, 2025 expiration date for the Cybersecurity Information Sharing Act. ¹ This bipartisan legislation, passed in the wake of the 2015 OPM breach, provides a voluntary information sharing framework that has been instrumental in strengthening our collective defense against increasingly sophisticated and severe cybersecurity threats.

Over the past ten years, the public-private communication channels established by the law have enhanced our ability to quickly respond to significant cyber incidents and mitigate associated national security risks. Moreover, because the vast majority of critical infrastructure is privately owned, the law has better positioned government partners to confront emerging cyber threats. Similarly, the law’s antitrust exemption and affiliated protections enable private companies to share cyber threat indicators—an authority cyber personnel have come to rely upon to fortify security measures and protect customer data. Consistent with the clear privacy and confidentiality expectations articulated in the law, this sharing is limited to only the actionable information security personnel need to improve cyber preparedness.

The opportunity to extend these authorities comes at a critical time. Nation-state cyber adversaries continue to target U.S. critical infrastructure and are prepositioning to conduct potentially more disruptive attacks in the future—the Salt Typhoon campaign being the latest example. ² Federal agencies maintain volumes of sensitive information and are therefore similarly attractive targets. In the past five years alone, hackers accessed the networks of nine federal agencies during the SolarWinds incident, ³ unclassified documents at the Treasury Department during the BeyondTrust breach, ⁴ and most recently approximately 148,000 emails after compromising the Office of the Comptroller of the Currency. ⁵

The current cyber threat landscape highlights the need for consistent public-private collaboration—of which information sharing is a central component. Without the protections codified by this statute, businesses may be less willing to share cyber threat information for fear of legal exposure. Any chilling effect on this information exchange directly benefits the nation-state attackers and cybercriminals seeking to degrade U.S. economic and national security interests. Thank you for your leadership on this important issue and we are committed to working with you to preserve these key national security authorities.

Sincerely,

Alliance for Digital Innovation

American Bankers Association

American Public Power Association

Bank Policy Institute

Business Roundtable

Business Software Alliance

Edison Electric Institute

Independent Community Bankers of America

Information Technology Industry Council

Institute of International Bankers

National Rural Electric Cooperative Association

Operational Technology Cybersecurity Coalition

Securities Industry and Financial Markets Association