IC Oversight & Policy — 2026-07-27

House Passes FY2027 NDAA 216-212 With Cybersecurity Information Sharing Act Extended Through 2035 and New Adversary Platform Risk Assessments

BLUFPaul's public blocking condition and the Senate draft's silence on CISA reauthorization make conference retention of the House's decade-long liability shield unlikely in the enacted FY2027 NDAA.

The House passed the fiscal 2027 NDAA 216-212 on July 22, a $1.15 trillion Pentagon policy bill that drew support from only a handful of Democrats 1. The bill reauthorizes the Cybersecurity Information Sharing Act of 2015, which shields companies from liability for sharing cyberthreat data with the federal government 123. Inside Cybersecurity and The Record report the extension running through fiscal 2035, while GovInfoSecurity reports the provision extends the law through 2036 123. Amendments added to the bill include a 72-hour breach-reporting mandate for "operationally critical contractors" from Rep. Nick Begich and Kat Cammack's measure directing a Pentagon assessment of risks from "foreign adversary-controlled digital platforms" 2. The Senate's NDAA draft contains no matching CISA 2015 extension, and Senate Homeland Security Chairman Rand Paul has said he will block long-term reauthorization unless it bars CISA from countering online disinformation 13.

Analysis
The House-passed liability shield is a marker, not a settled outcome: it must survive conference against a Senate draft with no matching provision, and Senate Homeland Security Chairman Rand Paul has committed to blocking long-term renewal unless it bars CISA from disinformation-related work, a precondition tied to an agency function the statute itself does not govern. Moderate confidence rests on the clarity of Paul's stated position against the absence of any visible Senate counter-proposal or leadership signal on resolving the mismatch. Two primary, independently reported accounts and a trade-press summary corroborate the vote and the extension's mechanics without evidence of pooled wire reporting, though outlets diverge on the reauthorization's sunset year. The near party-line 216-212 vote plausibly reflects opposition to unrelated NDAA provisions like military-force constraints rather than any partisan split over the information-sharing extension itself, meaning the decade-long liability shield's fate now turns on whether conferees can bridge Paul's disinformation demand.

3 sources

Extension of CISA 2015 info-sharing protections passes as part of House's defense bill - The Record from Recorded Future News
House adds provisions on info-sharing requirements, artificial intelligence programs to fiscal 2027 NDAA - Inside Cybersecurity
US House Votes to Extend Cyber Sharing Law for 10 Years - GovInfoSecurity (ISMG)