Cybersecurity Information Sharing Act of 2015

The Act authorises private entities to monitor their own information systems, operate defensive measures and share cyber threat indicators and defensive measures with each other and with the federal government, mainly through the DHS capability. It requires removal of personal information not directly related to a threat before sharing, sets privacy and civil liberties guidelines, and gives liability protection, antitrust exemptions and FOIA exemptions for sharing done under the Act.

It is the legal basis for most voluntary private-to-government cyber threat sharing in the United States.

Use it when sharing threat indicators with US agencies or peers, or assessing liability protection for that sharing.

Private entities and federal and non-federal government bodies sharing cyber threat information.

The Act carried a sunset date of 30 September 2025 (section 111); check whether it has been extended before relying on it. The supplied PDF is the whole Consolidated Appropriations Act, 2016; the Act is in Division N, Title I. Read the official PDF on this page for the operative text.

Section 102 → 104 → 105 → 106 → 111.