The U.S. House Committee on Homeland Security convened on May 16, 2025, to discuss the reauthorization of the Cybersecurity Information Sharing Act (CISA), emphasizing the critical role of small and medium-sized businesses in national cybersecurity. The meeting highlighted the increasing vulnerability of these businesses to cyber threats, particularly from state actors like China, Iran, and North Korea.

Committee members underscored that a significant portion of the nation’s critical infrastructure is housed within smaller enterprises, which often lack the resources to defend against sophisticated cyber attacks. One poignant example shared during the meeting involved a small concrete distribution company that faced a crippling ransomware attack, leading to its closure. This incident illustrated the dire consequences that inadequate cybersecurity can have on local businesses and the economy.

The discussion also focused on the need for CISA to adapt to the evolving cyber threat landscape. Members called for a thorough review of the definitions and frameworks within the act to ensure they reflect current technological realities and the types of attacks businesses face today. Suggestions included enhancing the sharing of threat information and improving the definitions of cyber threat indicators and defensive measures.

As the committee moves forward with the reauthorization process, the emphasis remains on strengthening CISA to better support not only large organizations but also the vast number of small businesses that are essential to the nation’s infrastructure and economy. The meeting concluded with a consensus on the importance of maintaining a robust workforce at CISA to effectively engage with these smaller entities and bolster national cybersecurity efforts.