The Operational Technology Cyber Coalition (OTCC) has joined 34 critical infrastructure organizations in urging U.S. congressional leaders to include a ten-year reauthorization of the Cybersecurity Information Sharing Act of 2015 (CISA 2015) in the final Fiscal Year 2027 National Defense Authorization Act (NDAA). The law enables voluntary sharing of cyber threat indicators and defensive measures between private-sector organizations and the federal government, providing liability protections and legal certainty for participating organizations.
In a Nov. 1 letter to the leaders of the House and Senate Armed Services Committees, the organizations backed Section 1706 of H.R. 8800, the House version of the NDAA, which would extend the law through 2035. CISA 2015 is scheduled to expire Dec. 11, 2026.
“For the past decade, CISA 2015 has been a foundation of how the private sector and government work together on cybersecurity,” OTCC detailed. “The law enables the voluntary sharing of cyber threat indicators and defensive measures between companies and with the federal government, and it provides the liability protections and legal certainty that make organizations willing to share in the first place.”
OTCC observed the law is particularly important for operational technology (OT) environments, where exploited industrial control system vulnerabilities can disrupt physical operations across electricity grids, drinking water systems and manufacturing facilities.
It added that “Sharing is especially important in operational technology environments. When a vulnerability in an industrial control system is exploited, the consequences can reach well beyond data, disrupting the physical operations that power the grid, treat drinking water, and keep manufacturing lines running. Timely, actionable threat intelligence gives OT owners and operators a better chance of seeing an attack coming and stopping it before it causes harm.”
The letter was co-signed by a broad coalition of industry groups, including the Aerospace Industries Association, Airlines for America, Alliance for Automotive Innovation, Alliance for Critical Infrastructure, Alliance for Digital Innovation, American Bankers Association, American Chemistry Council, American Fintech Council, American Fuel and Petrochemical Manufacturers, American Hotel and Lodging Association, American Petroleum Institute, American Public Power Association (APPA), Bank Policy Institute, Business Roundtable, Business Software Alliance, CTIA, Cybersecurity Coalition, and Edison Electric Institute.
Other signatories included the Electronic Transactions Association, Equity Markets Association, Healthcare Leadership Council, Information Technology Industry Council, the Institute of International Bankers, Interstate Natural Gas Association of America, National Association of Manufacturers, National Retail Federation, National Rural Electric Cooperative Association, National Rural Water Association, National Technology Security Coalition (NTSC), NCTA – The Internet & Television Association, Operational Technology Cybersecurity Coalition, Securities Industry and Financial Markets Association, TechNet, U.S. Chamber of Commerce, and USTelecom – The Broadband Association.
The letter was also copied to Senate Majority Leader John Thune, Senate Democratic Leader Chuck Schumer, House Speaker Mike Johnson, and House Democratic Leader Hakeem Jeffries.
The coalition warned that artificial intelligence is accelerating the identification and exploitation of software vulnerabilities, reducing the time defenders have to respond while making sophisticated cyber capabilities cheaper and more accessible. It argued that timely threat intelligence sharing, supported by the legal protections under CISA 2015, is essential to helping critical infrastructure owners and operators keep pace with evolving threats.
OTCC urged Congress to retain the 10-year reauthorization provision in the final NDAA, warning that a short-term extension or a lapse would put at risk the legal certainty needed for continued information sharing. A 10-year reauthorization, the group said, would give critical infrastructure owners, operators, and the companies that support them the stability they need to keep sharing threat information.
“The case for a long-term reauthorization has only grown more urgent. Recent incidents have demonstrated that advanced AI systems can identify and exploit software vulnerabilities at machine speed, collapsing the window between the discovery of a weakness and its use in an attack,” according to the letter. “AI tools are also making sophisticated cyber capabilities cheaper, faster and easier to use, allowing threats to spread and adapt in real time. In this environment, the speed and breadth with which defenders share information determines whether they keep pace with adversaries. That speed depends on the legal certainty CISA 2015 provides.”
It added that a “long-term reauthorization of CISA 2015 is essential to our national security. We appreciate your leadership on this important issue and urge you to include these critical protections in the final conference agreement.”
The OTCC letter added, “We appreciate the Armed Services Committees’ leadership on this issue and urge Congress to include these protections in the final NDAA.”
Back in September, the OTCC proposed a framework to address a critical national security gap exposed by recent cyberattacks on critical infrastructure, highlighting the persistent inconsistency in cybersecurity maturity across the federal government’s Sector Risk Management Agencies (SRMAs). The proposed model would allow the Office of the National Cyber Director (ONCD) to evaluate SRMAs annually on a 1-to-5 scale across domain expertise, policies, risk assessments, incident response, and cross-sector coordination, with particular focus on operational technology (OT) environments.
