U.S. House approves NDO limits, extends CISA

The U.S. House of Representatives passed the NDO Fairness Act, ending permanent non-disclosure orders by limiting their duration and requiring stronger judicial justification, while a separate funding resolution extended the 2015 Cybersecurity Information Sharing Act and other cybersecurity authorities through Dec. 11. At the same time, Congress continued advancing bills on health data, network security and the handling of minors' information.

What changed with the NDO Fairness Act?

H.R. 6048 was approved on Aug. 31, 2026, by the House under suspension of the rules and by voice vote. According to the Congressional Record, the measure limits non-disclosure orders to 90 days, with the option to renew them if an emergency persists, and requires prosecutors to justify in writing, with specific facts, why secrecy must continue.

Microsoft described the reform as a set of stricter standards for orders that prevent technology providers from telling customers about law enforcement access to emails, messages and other personal data in the cloud. The company said the change strengthens user rights and trust in services, but does not eliminate NDOs when they are needed for an investigation.

What is the scope of the new secrecy rules?

The technical and legal analysis cited by The Capitol Wire says the Stored Communications Act reform sets a 90-day limit for general investigations and up to one year in child exploitation cases. That same reading says courts will have to issue written findings based on articulable facts about risks to life, destruction of evidence or flight.

The proposal also explicitly gives electronic service providers the right to challenge NDOs, with an automatic 72-hour stay. In addition, the government must notify the customer within five business days after expiration, include a copy of the order and details of the investigation, and the Attorney General must submit annual reports on the use of these orders and their impact on the press.

What happens with CISA 2015 and other cybersecurity authorities?

The House approved a temporary funding resolution that extends the 2015 Cybersecurity Information Sharing Act, the Federal Cybersecurity Enhancement Act and the Technology Modernization Fund through Dec. 11. Federal News Network, MeriTalk and Nextgov agree that this is a continuing resolution meant to avoid a government shutdown and buy time for a new reauthorization or a broader overhaul.

The extension leaves the cybersecurity information-sharing law on a short continuity window, with no substantive changes to obligations for private entities. Later coverage notes that CISA 2015 was set to expire on Sept. 30 and that the new date only keeps it in force for the temporary funding period, preserving regulatory uncertainty for companies that rely on those cooperation frameworks with the U.S. government.

What other bills are moving in parallel?

The House Subcommittee on Commerce, Manufacturing and Trade is set to mark up six bills on technology threats, including H.R. 4950, the Data BRIDGE Act, and H.R. 7294, the AI for Secure Networks Act. Democratic leadership documents describe the latter as a proposal to encourage the use of artificial intelligence to strengthen communications network security.

The RESET Act was also placed on the agenda for a September markup scheduled for Tuesday at 10:15 a.m. ET. One critical analysis says the text does not impose an explicit age verification requirement, but leaves it to platforms to decide how to identify users under 16. Once those accounts are closed, the platforms would generally have to delete personal data, with a 90-day window to request a portable copy.

On health, Paubox's analysis of the S. 3097 Health Information Privacy Reform Act says the bill directs the Secretary of Health and Human Services, in consultation with the FTC, to issue regulations on privacy, security and breach notification for a new category of applicable health information. That category would cover identifiable data about physical or mental health, care or payments, even if it was never created or received by a provider, health plan, employer or clearinghouse, which would for the first time bring wellness apps, fitness trackers and symptom services closer to HIPAA-like standards.