In all honestly I do not see what the concern over this law has been about. It doesn't expand the (terrible) surveillance powers but just allows network operators to do what they have been doing anyway (e.g. CloudFlare's WTF and cloudsourced DDoS protection), and share data that you reasonably should expect to be shared.

What is concerning is what the law may be twisted to "authorize" (see patriotic act and mass metadata), but on the surface of it I really don't see concern about CISA.