6 U.S.C. § 1505 — Protection from liability

(a) Monitoring. A private entity cannot be sued, and any such case must be promptly dismissed, for monitoring an information system^* and information under section 1503(a) when the monitoring follows this subchapter. (b) Sharing or receipt. A private entity cannot be sued, and any such case must be promptly dismissed, for sharing or receiving a cyber threat indicator^* or defensive measure^* under section 1503(c) if (1) the sharing or receipt follows this subchapter; and (2) when the indicator or measure is shared with the Federal Government, it is shared consistently with section 1504(c)(1)(B), and the sharing or receipt occurs after the earlier of (A) the date the interim policies and procedures and guidelines are submitted to Congress under section 1504(a)(1) and (b)(1), or (B) 60 days after December 18, 2015. (c) Construction. Nothing in this subchapter creates (1) (A) a duty to share a cyber threat indicator or defensive measure, or (B) a duty to warn or act because one was received; or (2) undermines or limits an otherwise applicable common-law or statutory defense.