Cybersecurity Act of 2015: Scope, Sharing Rules, and Liability

The Cybersecurity Act of 2015 is a federal law that lets private companies monitor their own networks for cyber threats and share technical threat information with each other and with the federal government, backed by liability protection when they follow the law’s rules. Congress passed it as Division N of the Consolidated Appropriations Act, 2016 to clear away the wiretap, privacy, and contract-law worries that had kept businesses from exchanging attack data.¹ The Act was originally set to expire in September 2025, but Congress has extended it, and it now runs through September 30, 2026.²

Is the Law Still in Effect?

Yes, for now. The original statute carried a ten-year sunset that would have ended the sharing framework on September 30, 2025.³ After that date passed, Congress moved through several short-term extensions before settling on a longer one. Section 5008 of the Consolidated Appropriations Act, 2026 pushed the expiration to September 30, 2026.² Nothing about the substance of the law changed. If Congress does not act again before that date, the sharing authorizations, liability shield, and privacy conditions all lapse.

What Information the Law Covers

The Act’s protections attach to two defined categories of data. Anything outside them falls back on ordinary law.

Cyber Threat Indicators

A cyber threat indicator is information needed to describe or identify a digital threat. The statutory definition is deliberately broad and reaches the full lifecycle of an attack: suspicious reconnaissance activity, techniques for exploiting vulnerabilities, evidence of unauthorized remote control, and the damage a breach caused, including what was stolen.⁴ In practice, that includes malicious code samples, attacker IP addresses, and the specific methods intruders used to break in.

Defensive Measures

A defensive measure is any technique, tool, or procedure applied to a network or its data to detect, prevent, or reduce a known or suspected threat.⁵ Firewall signatures that block known attack patterns, automated rules that quarantine suspicious files, and monitoring configurations all fit.

Permission to Monitor and Share

The core authorization lives in 6 U.S.C. § 1503. A private entity may monitor its own information systems for cybersecurity purposes, and may monitor another organization’s systems with that organization’s written consent. Any non-federal entity may share cyber threat indicators or defensive measures with any other non-federal entity or with the federal government for a cybersecurity purpose.⁶

The statute says this permission applies “notwithstanding any other provision of law.” That phrase is the whole engine of the framework. It overrides conflicting rules in other federal and state statutes, which is what companies had been waiting for. The attack data was already sitting in their logs. What had been missing was a lawyer’s assurance that turning it over would not draw a suit.

The Privacy Scrubbing Requirement

Sharing comes with a hard condition. Before transmitting a cyber threat indicator, the sharing organization must review it, either manually or through an automated technical process, and remove any information that the entity knows at the time of sharing to be personally identifying and unrelated to the cybersecurity threat.⁶

The “knows at the time of sharing” language sets the bar. It does not demand a forensic sweep of every field. Embedded personal data the entity does not realize is there will not by itself blow the compliance line. But if a malicious email sample carries a customer’s name and Social Security number that have nothing to do with the technical threat, those details must come out before the sample leaves. Most of the compliance work under the Act clusters here, and skipping it puts the liability protection at risk.

How Sharing With the Federal Government Works

The Department of Homeland Security, through the Cybersecurity and Infrastructure Security Agency (CISA), runs the Automated Indicator Sharing (AIS) system. Under 6 U.S.C. § 1504, the Secretary of Homeland Security must maintain a capability that accepts threat indicators from any entity, strips personal information automatically, and distributes the data in real time to relevant federal agencies.⁷

AIS uses two open standards, STIX for formatting the data and TAXII for machine-to-machine transmission. Participants connect through a compatible client, either commercial or built in-house.⁸ Once an organization submits an indicator, the information can reach federal cybersecurity teams and other AIS participants within minutes. The government side performs a second pass of personal-information scrubbing before redistribution.

How the Government Can Use Shared Data

Federal agencies do not have a free hand with information that comes in through this channel. Section 1504(d)(5) confines their use, retention, and disclosure of cyber threat indicators to a closed list of purposes:⁷

Cybersecurity purposes, including protecting networks and responding to incidents.
Identifying cybersecurity threats and their sources, or identifying security vulnerabilities.
Responding to specific threats of death, serious bodily harm, or serious economic harm, including terrorism and weapons of mass destruction.
Investigating or preventing serious threats to minors, including sexual exploitation.
Investigating fraud, identity theft, espionage, and trade-secret theft when those offenses arise from a qualifying cybersecurity threat.

Any use outside those categories is prohibited. A company sharing details of a ransomware incident is not inadvertently handing the government a resource for unrelated investigations.

Liability Protection for Participants

The liability shield in 6 U.S.C. § 1505 is what makes companies willing to use the framework at all. No cause of action lies against a private entity for monitoring its own systems under the Act, or for sharing or receiving cyber threat indicators and defensive measures, so long as the activity complies with the Act’s requirements. Courts must promptly dismiss any such claim.⁹

Two conditions govern the shield. The sharing or monitoring must be conducted in accordance with the subchapter, which means the privacy scrubbing rules were followed and the sharing went through proper channels. When the recipient is the federal government, the data must flow through the mechanism described in § 1504, meaning the AIS portal or an equivalent approved channel.⁹

A common misreading: the statute does not name “gross negligence” or “willful misconduct” as express exceptions. What it says is that nothing in the Act limits existing common-law or statutory defenses. If an entity acts recklessly or intentionally mishandles data, the conduct is not “in accordance with this subchapter,” and the shield simply does not attach. The practical result is much the same as an express carveout, but the mechanism is different. An organization that ignores the scrubbing rule, or shares data for a purpose that is not cybersecurity, will not find cover in § 1505.

Rules for Federal Agencies’ Own Networks

The Act does more than authorize sharing between the private sector and the government. Title II of Division N, the Federal Cybersecurity Enhancement Act of 2015, sets rules for the security of the government’s own systems. DHS must deploy and maintain intrusion detection and prevention capabilities that executive-branch agencies are required to use, monitoring traffic to and from agency information systems and blocking cybersecurity risks in real time.¹⁰ The Department of Defense, national security systems, and intelligence community elements are not covered, since they run under separate frameworks.

Under 6 U.S.C. § 1523, each agency must also identify its sensitive and mission-critical data, assess who has access, encrypt data at rest and in transit, and require multi-factor authentication for remote access and privileged accounts.¹¹

1
Congress.gov. H.R.2029 – Consolidated Appropriations Act, 2016
2
CISA. Final Procedures Related to the Receipt of Cyber Threat Indicators and Defensive Measures by the Federal Government
3
Congress.gov. S.754 – Cybersecurity Information Sharing Act of 2015
4
Office of the Law Revision Counsel. 6 USC 650 – Definitions
5
Legal Information Institute. Defensive Measure – 6 USC 1501(7)(A)
6
Office of the Law Revision Counsel. 6 USC 1503 – Authorizations for Preventing, Detecting, Analyzing, and Mitigating Cybersecurity Threats
7
Office of the Law Revision Counsel. 6 USC 1504 – Sharing of Cyber Threat Indicators and Defensive Measures With the Federal Government
8
CISA. How Automated Indicator Sharing (AIS) Works
9
Office of the Law Revision Counsel. 6 USC 1505 – Protection From Liability
10
Office of the Law Revision Counsel. 6 USC 663 – Federal Intrusion Detection and Prevention System
11
Office of the Law Revision Counsel. 6 USC 1523 – Federal Cybersecurity Requirements