A Key Cyber Info-Sharing Law Nears Sunset: K–12 Leaders Brace for a Blind Spot

What’s happening in Congress

• Senate: A bipartisan bill from Sens. Mike Rounds and Gary Peters would extend CISA 2015 to 2035 with minimal changes.
• House: Committees are weighing reauthorization; members caution that “modernization” debates (e.g., AI) shouldn’t delay a clean renewal before the deadline.

Why a lapse matters for districts

• Legal cover fades: Without safe-harbor protections, some private partners may share fewer indicators with schools and states.
• ISACs feel the squeeze: Budget pressure (e.g., a recent $10M cut cited for MS-ISAC) plus a legal gray zone could slow bulletins schools depend on.

30-day readiness checklist for K–12 (regardless of D.C. timing)

1. Confirm your intel pipelines: Ensure active membership with MS-ISAC/EI-ISAC (or sector hubs) and verify which inboxes/APIs receive advisories.
2. Name an “indicator owner”: Assign who triages alerts within one hour and who pushes mitigations to SIS/LMS, IdP, and email security. 
3. Scrub & share safely: Re-train staff on removing PII when reporting incidents; align to TLP tagging used by your state/ISAC partners.
4. Run a mini-drill: Simulate an indicator → blocklist update → staff notification → parent comms. Capture timestamps and evidence for insurers/boards.
5. Document plan B: If feeds slow, pre-agree alternates (state SOC, vendor MDR, peer districts) and extend log retention to preserve forensics.
   

Where CyberNut fits

Districts are pairing intel with execution: CyberNut turns state/ISAC advisories into micro-lessons for staff, launches targeted phishing simulations reflecting fresh lures, and updates incident playbooks so the first hour is rehearsed—not improvised. The result: fewer risky clicks, faster containment, and better audit trails even if federal sharing rules wobble. (Program design aligned to current ISAC/agency practices reported in GovTech.)

Bottom line: Whether Congress opts for a clean extension or a rewrite, schools can’t pause. Keep your sharing pipes open, your verification habits tight, and your drills on the calendar. If the lights flicker in D.C., your local muscle memory is the back-up generator.