# CISA 2015 Liability Protections Sunset

- **Artifact ID:** CHQ-SCA-2026-004
- **Canonical source ID:** CHQ-J-2026-004
- **Version:** v1.0
- **Status:** ISSUED
- **Public record:** https://record.cybersecurityhq.com/assessments/chq-sca-2026-004
- **Machine-record SHA-256:** `0e5317f036e761b077c1b8649fc19751a152764a1020a8d25449cc014fc9ff88`

## Complete structured record

```json
{
  "id": "CHQ-J-2026-004",
  "title": "CISA 2015 Liability Protections Sunset",
  "status": "ISSUED",
  "issuance_date": "2026-01-23",
  "version": "v1.0",
  "judgment_type": "TEMPORAL",
  "classification_tag": "CISA Liability Protection Sunset",
  "decision_surfaces_safe": [
    "Incident Disclosure Timing Defense",
    "Breach Causality Attribution (Organizational)"
  ],
  "decision_surfaces_unsafe": [
    "Sworn Technical Assertion (Personal)",
    "Individual Accountability Insulation",
    "Insurance Coverage Disputes",
    "Transactional Security Representation Defense",
    "Retroactive Liability Claims for Pre-Sunset Sharing",
    "International or Non-U.S. Jurisdictions",
    "Private Contractual Disputes Between Sharing Parties"
  ],
  "load_bearing_assumptions": [
    {
      "id": "A1",
      "label": "Statutory Reversion",
      "type": "LOAD-BEARING",
      "text": "Expiration of CISA liability protections restores the pre-2015 liability baseline absent replacement statutory authority."
    },
    {
      "id": "A2",
      "label": "Decision-Time Liability Determination",
      "type": "LOAD-BEARING",
      "text": "Liability exposure for threat information sharing is governed by the statutory environment in effect at the time of decision execution."
    },
    {
      "id": "A3",
      "label": "Scope-Limited Applicability",
      "type": "LOAD-BEARING",
      "text": "The judgment applies only to sharing activities that were contemporaneously treated as within CISA's protected scope prior to sunset."
    },
    {
      "id": "A4",
      "label": "Temporal Salience",
      "type": "CONTEXTUAL",
      "text": "The CISA sunset constitutes a meaningful transitional marker for decision timing during an initial post-sunset period."
    }
  ],
  "core_judgment": "For organizational decisions to share threat information made on or after January 30, 2026, the expiration of CISA liability protections restores the liability exposure baseline that existed prior to 2015, absent replacement statutory protection.",
  "observability_conditions": [
    {
      "number": 1,
      "title": "Decision Execution Timing Evidence",
      "text": "The judgment applies only to threat information sharing decisions executed on or after January 30, 2026, as evidenced by the time at which sharing activity was performed or enabled.\nFor ongoing or automated sharing mechanisms, each discrete transmission or materially renewed authorization is treated as a decision execution subject to the statutory environment in effect at that time.\nEvidence of execution timing must exist independent of post-sunset characterization or retrospective intent claims."
    },
    {
      "number": 2,
      "title": "Statutory Environment Evidence",
      "text": "The applicable liability baseline is determined exclusively by statutory protections in force at the time of decision execution.\nClaims of replacement or equivalent protection must be supported by affirmative statutory authority applicable to the specific sharing activity.\nCustomary practice, regulatory guidance, contractual terms, or industry norms do not constitute replacement statutory protection for purposes of this judgment."
    },
    {
      "number": 3,
      "title": "CISA Scope Classification Evidence",
      "text": "This judgment applies only to sharing activities that were contemporaneously classified or treated by the organization as falling within CISA's protected sharing scope prior to sunset.\nPost-hoc assertions that an activity \"would have qualified\" absent contemporaneous classification do not qualify.\nSharing activities that were never treated as CISA-covered are outside the applicability of this judgment."
    }
  ],
  "boundary_of_safe_citation": "This judgment governs the liability environment applicable to organizational threat information sharing decisions following the CISA sunset.\n\nIt must not be cited to:\n• Establish personal testimony defensibility\n• Validate or condemn sharing decisions\n• Interpret insurance policy coverage\n• Assert retroactive loss of protection for pre-sunset sharing\n• Apply outside U.S. statutory jurisdiction\n\nCitation outside the defined safe decision surfaces risks temporal inversion or misapplication of statutory scope.",
  "retirement_triggers": [
    {
      "number": 1,
      "title": "Replacement Statutory Protection Enacted",
      "text": "Enactment of federal legislation restoring or expanding liability protections for threat information sharing equivalent to or broader than CISA's original scope."
    },
    {
      "number": 2,
      "title": "Judicial Determination of Continued Protection",
      "text": "Authoritative judicial rulings determining that CISA liability protections survive the statutory sunset through interpretation, regulatory continuation, or constitutional grounds."
    },
    {
      "number": 3,
      "title": "Regulatory Safe Harbor with Liability Effect",
      "text": "Establishment of a formal federal regulatory safe harbor carrying liability protection equivalent to statutory authority for the sharing activity in question."
    },
    {
      "number": 4,
      "title": "Mandatory Temporal Reassessment",
      "text": "This judgment must undergo formal reassessment for continued utility 24 months after issuance, and at 12-month intervals thereafter."
    },
    {
      "number": 5,
      "title": "Temporal Normalization",
      "text": "Upon reassessment, the judgment must be retired if the post-sunset liability environment no longer constitutes a meaningful analytical distinction for decision timing or attribution, and the pre-2015 baseline has become the unremarkable default rather than a reversion condition."
    }
  ]
}
```