A key cybersecurity law that enables federal agencies and private companies to share threat information is set to expire on December 11, forcing Congress to decide whether to renew, modify, or let the Cybersecurity Information Sharing Act of 2015 (CISA) lapse entirely.