§1505 Protection From Liability

Summary

Private companies cannot be sued in court for monitoring their information systems and information under section 1503(a) if they follow the rules in this subchapter. They also cannot be sued for sharing or receiving a cyber threat indicator or defensive measure under section 1503(c) if the sharing or receipt follows this subchapter. If the indicator or defensive measure is shared with the Federal Government, it must follow section 1504(c)(1)(B) and happen after the earlier of when interim policies and procedures are sent to Congress under section 1504(a)(1) and guidelines are sent under section 1504(b)(1), or the date that is 60 days after December 18, 2015. Nothing here creates a legal duty to share cyber threat information, to warn others, or to act on received information. It also does not limit other legal defenses that might otherwise apply.