The Cybersecurity and Infrastructure Security Agency doesn’t have any plans in place for continuing a threat information-sharing program should a 2015 law that laid the groundwork for its creation expire Wednesday, according to a new watchdog report.
The inspector general report points to yet more potential complications for threat data exchanges between industry and the government should the 2015 Cybersecurity Information Sharing Act, known as CISA 2015, lapse. Already, private-sector groups and cyber professionals have been sounding alarms about what would happen if the law’s legal safeguards disappear — something that’s now almost certain to happen after Tuesday’s expiration deadline is set to transpire without action from Congress.
The IG report takes a look at the Automated Indicator Sharing (AIS) program that the Department of Homeland Security established in the year after passage of CISA 2015. The voluntary program was designed to allow the exchange of machine-readable cyber threat indicators (CTIs), like malicious IP addresses, and defensive measures (DMs), defined as activity that protects information systems against cyber threats.
According to the IG, CISA (the agency) has not finalized plans for continued use of the program in the event of the expiration of the 2015 law.
“Without finalizing this plan, CISA could be hindered in how it shares information on cyber threats, which would reduce its ability to protect the Nation’s critical infrastructure from cyber threats,” the report, dated Sept. 26, states.
While creation of the AIS program was one of the most direct outcomes of the passage of CISA 2015, many industry groups do not consider it the most important impact of the law, instead focusing on the legal protections it provides. Still, the IG report details how much activity the AIS program is involved in: 10 million cyber threat indicators shared in 2024.
That figure also points to weaknesses within the program, however, according to the IG. The 10 million indicators is a big jump from the prior calendar year, when the number was 1 million.
“Although the number of CTIs and DMs increased in 2024, CISA continues to rely on a small number of partners to share information,” the report states. “CISA officials attributed recent increases in shared CTIs and DMs to a private-sector partner’s significant contribution. In 2024, this private-sector partner added more than 4 million CTIs and DMs to each of the Federal and public collections — accounting for 89 percent of the public collection and 83 percent of the Federal collection.”
The report doesn’t identify that private-sector partner. An earlier report attributed a steep drop in the sharing of cyber threat indicators to an unnamed federal partner withdrawing from the program.
“CISA’s overreliance on information shared by specific participants may lead to inconsistent results and prevent long-term program growth if top contributing partners stop participating,” the report reads.
There were only 18 federal participants in 2024 in all, and 87 non-federal participants. That’s an increase from last year in both cases, but a fall from the 2020 peak of 304 total participants. Some of those participants, though, are industry-specific information sharing and analysis centers that might include hundreds of organizations.
CISA’s response to the IG’s findings left the program’s future uncertain should the 2015 law expire, according to the report.
“Program officials stated that although CISA continues to be committed to sharing CTIs and DMs in an automated, unclassified machine-readable format such as AIS, the decision on whether to maintain the capability will be based on available resources and leadership’s priorities,” the report states. “CISA officials said if the Act were to expire, they would analyze the value of AIS, including the average operational cost of $1 million per month and a likely reduction in CTI and DM volume, to determine whether resources could be redirected from other agency priorities to support AIS.”
CISA referred requests for comment to the agency’s response contained within the report.
“It is important for readers of this report to understand that automated threat intelligence and information sharing with our global partners and stakeholders remains a priority for CISA, and that there are no immediate or near-term plans to discontinue the Automated Information Sharing [sic] service, regardless of the status of the Cybersecurity Act of 2015,” reads the response from Madhu Gottumukkala, the acting director of CISA. “Subject to available appropriations, CISA remains authorized to operate Automated Information Sharing irrespective of the possible sunset of the Cybersecurity Information Sharing Act of 2015 on September 30, 2025, and CISA will continue to modernize and evolve Automated Information Sharing to meet the needs of its partners and stakeholders.”
