Cybersecurity Policy Report, Cyber Info-Sharing Legislation Clears House as Part of Defense Authorization Bill, (Jul 23, 2026)
Legislation that would reauthorize a 2015 law at the core of U.S. cyber defenses cleared the House yesterday as part of the National Defense Authorization Act (NDAA) for fiscal year 2027.
The NDAA (H.R. 8800, 119th Cong. (2026)), which was approved by a vote of 216-212, would reauthorize the Cybersecurity Information Sharing Act of 2015 (CISA 2015) through 2035.
CISA 2015 provides legal protections for private-sector entities that report cyber attacks and other incidents to the federal government. The law is due to expire Sept. 30. The House NDAA includes the text of the Widespread Information Management for the Welfare of Infrastructure and Government Act (HR 5079), which would reauthorize CISA 2015 and update some of the law’s provisions to reflect changes in technology and cybersecurity practices since 2015.
HR 5079 cleared the House Homeland Security Committee last September (CPR, Sept. 3, 2025), but its inclusion in the NDAA gives it a better chance of becoming law.
HR 5079’s sponsor, Rep. Andy Ogles (R., Tenn.), chairman of the House Homeland Security Committee’s cybersecurity & infrastructure protection subcommittee, also successfully offered an amendment to the NDAA that would prohibit the Department of Defense from purchasing information technology products from providers that have “operations, subsidiaries, or personnel located in a country of concern,” including China, Iran, North Korea, or Russia.
Another amendment adopted by the House and sponsored by Rep. Troy Nehls (R., Texas) would require DoD to quickly identify systems that can be protected by quantum-resistant encryption. It would give DoD’s “portfolio acquisition executives” 45 days to conduct “a narrow, expeditious review” of its encrypted systems “to determine whether it is feasible and practicable” to deploy cryptographic protections that can withstand quantum-enabled cyber attacks (CPR, June 30).
The amendments offered by Reps. Ogles and Nehls were adopted by voice vote as part of a block of amendments.
The underlying text of the NDAA would, among other things, require DoD to establish a “centralized Department-wide program” to find and fix AI (artificial intelligence) systems that endanger DoD’s cyber defenses or otherwise pose a threat (CPR, May 27).
The Senate’s attempts to begin debate on its version of the NDAA (S 4784) have been blocked by Democrats who object to President Trump’s military actions in Iran and the cost of those operations.
News: FederalLegislation DataSecurity