Oversight of the Cybersecurity Act of 2015

The Cybersecurity Information Sharing Act of 2015 (CISA) encourages private companies to voluntarily share information about cyber threats with each other and the Government. CISA broadly authorizes the Federal Government to share Unclassified cyber threat indicators (CTI) and defensive measures (DM) technical data that indicates how networks have been attacked, and how such attacks have been successfully detected, prevented, or mitigated. The law accounts for its impacts on privacy and civil liberties by requiring that companies scrub personal information before sharing cyber threats. CISA also addresses the risks of misuse by the Federal Government or the private sector by only extending liability protections for companies and entities who participate in cybersecurity information sharing if that information sharing is done in accordance with CISA requirements. CISA is not a silver-bullet solution to cybersecurity challenges, but increasing the speed and quality of bilateral information flows of CTIs and DMs is essential for developing a holistic approach to cyber defense.