Information sharing has seemed like the “holy grail” of federal cyber policy: sought after but elusive, especially to those who think it will solve their problems. At a time of increased regulation and looming mandates for incident reporting and collaboration, the United States is looking at how to improve information sharing. In 2015, Congress passed, and President Obama signed the Cybersecurity Information Sharing Act (CISA 2015), which included protections for information voluntarily shared with the federal government. As policymakers look to do more on cyber, CISA 2015 appears largely overlooked, while the Government Accountability Office (GAO) confirms that more work remains to be done by some key players that otherwise are moving toward regulation.