U.S. House approves NDO limits, extends CISA

Update Sept. 6, 2026: The House of Representatives passed the NDO Fairness Act of 2025 and sent it to the Senate. The bill sets tighter limits on nondisclosure orders, while the temporary extension of CISA 2015 remains in effect through Dec. 11.

The U.S. House of Representatives passed the NDO Fairness Act, ending so-called permanent nondisclosure orders by limiting how long they can remain in place and requiring stronger judicial justification. In a separate funding resolution, lawmakers extended the Cybersecurity Information Sharing Act of 2015 and other cybersecurity authorities through Dec. 11. Congress also continued advancing bills on health data, network security and the treatment of minors’ information.

What changed with the NDO Fairness Act?

H.R. 6048 passed the House on Aug. 31, 2026, by suspension of the rules and voice vote. According to the Congressional Record and an analysis cited by The Capitol Wire, the measure limits nondisclosure orders to 90 days in general investigations and up to one year in child exploitation cases, and it requires written judicial findings based on specific facts.

Microsoft described the change as a tougher set of standards for orders that prevent technology providers from telling customers about law enforcement access to emails, messages and other personal cloud data. The company said the change strengthens user rights and trust in services, but does not eliminate NDOs when they are needed for an investigation.

What do the new secrecy rules cover?

The technical and legal analysis cited by The Capitol Wire says the reform to the Stored Communications Act sets a 90-day limit for general investigations and up to one year in child exploitation cases. The same analysis says courts will have to issue written findings based on articulable facts showing risks to life, destruction of evidence or flight.

The proposal also explicitly gives electronic service providers the right to challenge NDOs, with an automatic 72-hour stay. In addition, the government must notify the customer within five business days after expiration, with a copy of the order and details of the investigation, and the Justice Department will have to file annual reports on the use of these orders and their impact on the media.

What happens to CISA 2015 and other cybersecurity authorities?

The House approved a temporary funding resolution that extends the Cybersecurity Information Sharing Act of 2015, the Federal Cybersecurity Enhancement Act and the Technology Modernization Fund through Dec. 11. Federal News Network, MeriTalk and Nextgov agree that it is a continuing resolution meant to avoid a government shutdown and buy time for a new reauthorization or broader reform.

The extension leaves the cyber information-sharing law in a short continuity window, with no substantive changes to obligations for private entities. Later coverage noted that CISA 2015 was set to expire on Sept. 30, and that the new date only keeps it alive for the temporary funding period, preserving regulatory uncertainty for companies that rely on those cooperation frameworks with the U.S. government.

What other bills are moving in parallel?

The House Subcommittee on Commerce, Manufacturing and Trade plans to mark up six bills on tech threats, including H.R. 4950, the Data BRIDGE Act, and H.R. 7294, the AI for Secure Networks Act. Democratic leadership documents describe the latter as an effort to encourage the use of artificial intelligence to strengthen communications network security.

The RESET Act was also included on the agenda for a markup scheduled for a Tuesday in September at 10:15 a.m. ET. A critical analysis says the text does not impose explicit age verification, but leaves platforms to decide how to identify users under 16, and that once those accounts are closed they must generally delete personal data, with a 90-day window to request a portable copy.

On health, Paubox’s analysis of S. 3097, the Health Information Privacy Reform Act, says the bill directs the Secretary of Health and Human Services, in consultation with the FTC, to issue rules on privacy, security and breach notification for a new category of applicable health information. That category would cover identifiable data on physical or mental health, care or payments, even if it was never created or received by a provider, health plan, employer or clearinghouse. For the first time, that would bring wellness apps, fitness trackers and symptom services closer to HIPAA-like standards.