Center for Internet Security


The Center for Internet Security is a 501 nonprofit organization, formed in October, 2000. Its mission is to "identify, develop, validate, promote, and sustain best practice solutions for cyber defense and build and lead communities to enable an environment of trust in cyberspace". The organization is headquartered in East Greenbush, New York, with members including large corporations, government agencies, and academic institutions.
CIS employs a closed crowdsourcing model to identify and refine effective security measures, with individuals developing recommendations that are shared with the community for evaluation through a consensus decision-making process. At the national and international level, CIS plays an important role in forming security policies and decisions by maintaining the CIS Controls and CIS Benchmarks, and hosting the Multi-State Information Sharing and Analysis Center.

Program areas

CIS has several program areas, including MS-ISAC, CIS Controls, CIS Benchmarks, CIS Communities, and CIS CyberMarket. Through these program areas, CIS works with a wide range of entities, including those in academia, the government, and both the private sector and general public to increase their online security by providing them with products and services that improve security efficiency and effectiveness.

Multi-State Information Sharing and Analysis Center (MS-ISAC)

The Multi-State Information Sharing and Analysis Center is a "round-the-clock cyber threat monitoring and mitigation center for state and local governments" operated by CIS as a partnership with the Office of Cybersecurity and Communications in the United States Department of Homeland Security. MS-ISAC was established in late 2002, and officially launched in January 2003, by William F. Pelgrin, then Chief Security Officer of the state of New York. Beginning from a small group of participating states in the Northeast, MS-ISAC came to include all 50 U.S. States and the District of Columbia, as well as U.S. Territorial, Tribal, and Local governments. In order to facilitate its expanding scope, in late 2010, MS-ISAC "transitioned into a not-for-profit status under the auspices of the Center for Internet Security." The transition was facilitated by CIS having "an established reputation for providing cybersecurity resources to the public and private sectors".
MS-ISAC "helps government agencies combat cyberthreats and works closely with federal law enforcement", and is designated by DHS as a key cyber security resource for the nation's State, Local, Territorial, and Tribal governments. The MS-ISAC 24x7 cyber security operations center performs network monitoring, issues early cyber threat warnings and advisories, and performs vulnerability identification and mitigation as well as incident response.
The main objectives of MS-ISAC are described as follows:
The Elections Infrastructure Information Sharing and Analysis Center, as established by the Election Infrastructure Subsector Government Coordinating Council, is a critical resource for cyber threat prevention, protection, response and recovery for the nation's state, local, territorial, and tribal election offices. The EI-ISAC is operated by the Center for Internet Security, Inc.
The mission of the EI-ISAC is to improve the overall cybersecurity posture of SLTT election offices, through collaboration and information sharing among members, the U.S. Department of Homeland Security and other federal partners, and private sector partners are the keys to success. The EI-ISAC provides a central resource for gathering information on cyber threats to election infrastructure and two-way sharing of information between and among public and private sectors in order to identify, protect, detect, respond and recover from attacks on public and private election infrastructure. And the EI-ISAC comprises representatives from SLTT election offices and contractors supporting SLTT election infrastructure.

CIS Controls and CIS Benchmarks

CIS Controls and CIS Benchmarks provide global standards for internet security, and are a recognized global standard and best practices for securing IT systems and data against attacks. CIS maintains "The CIS Controls", a popular set of 20 security controls "which map to many compliance standards", and are applicable to the Internet of things. Through an independent consensus process, CIS Benchmarks provide frameworks to help organizations bolster their security. CIS offers a variety of free resources, which include "secure configuration benchmarks, automated configuration assessment tools and content, security metrics and security software product certifications".
The CIS Controls advocate "a defense-in-depth model to help prevent and detect malware". A May 2017 study showed that "on average, organizations fail 55% of compliance checks established by the Center for Internet Security", with more than half of these violations being high severity issues. In March 2015, CIS launched CIS Hardened Images for Amazon Web Services, in response to "a growing concern surrounding the data safety of information housed on virtual servers in the cloud". The resources were made available as Amazon Machine Images, for six "CIS benchmarks-hardened systems", including Microsoft Windows, Linux and Ubuntu, with additional images and cloud providers added later. CIS released Companion Guides to CIS Controls, recommendations for actions to counter cybersecurity attacks, with new guides having been released in October and December 2015. In April 2018, CIS launched an information security risk assessment method for to implement CIS Controls, called CIS RAM which is based upon the risk assessment standard by the DoCRA Council.
CIS Benchmarks are a collaboration of the Consensus Community and CIS SecureSuite members. The Consensus Community is made up of experts in the field of IT security who use their knowledge and experience to help the global Internet community. CIS SecureSuite members are made up of several different types of companies ranging in size, including government agencies, colleges and universities, nonprofits, IT auditors and consultants, security software vendors and other organizations. CIS Benchmarks and other tools that CIS provides at no cost allow IT workers to create reports that compares their system security to universal consensus standard. This fosters a new structure for internet security that everyone is accountable for that is shared by top executives, technology professionals and other internet users throughout the globe. Further, CIS provides internet security tools with a scoring feature that rates the configuration security of the system at hand. For example, CIS provides SecureSuite members with access to CIS-CAT Pro, a "cross-platform Java app" which scans target systems and "produces a report comparing your settings to the published benchmarks". This is intended to encourage and motivate users to improve the scores given by the software, which bolsters the security of their internet and systems. The universal consensus standard that CIS employs draws upon and uses the accumulated knowledge of skillful technology professionals. Since internet security professionals volunteer in contributing to this consensus, this reduces costs for CIS and makes it cost effective.

CIS CyberMarket

CIS CyberMarket is a "collaborative purchasing program that serves U.S. State, Local, Tribal, and Territorial government organizations, nonprofit entities, and public health and education institutions to improve cybersecurity through cost-effective group procurement". The intent of the CIS CyberMarket is to combine the purchasing power of governmental and nonprofit sectors to help participants improve their cybersecurity condition at a lower cost than they would have been able to attain on their own. The program assists with the "time intensive, costly, complex, and daunting" task of maintaining cybersecurity by working with the public and private sectors to bring their partners cost-effective tools and services. The combined purchasing opportunities are reviewed by domain experts.
There are three main objectives of the CIS CyberMarket:
CIS CyberMarket, like the MS-ISAC, serves government entities and non-profits in achieving greater cyber security. On its "resources" page, multiple newsletters and documents are available free of charge, including the "Cybersecurity Handbook for Cities and Counties".

CIS Communities

CIS Communities are "a volunteer, global community of IT professionals" who "continuously refine and verify" CIS best practices and cybersecurity tools. To develop and structure its benchmarks, CIS uses a strategy in which members of the organization first form into teams. These teams then each collect suggestions, advice, official work and recommendations from a few participating organizations. Then, the teams analyze their data and information to determine what the most vital configuration settings are that would improve internet system security the most in as many work settings as possible. Each member of a team constantly works with their teammates and critically analyzes and critiques a rough draft until a consensus forms among the team. Before the benchmark is released to the general public, they are available for download and testing among the community. After reviewing all of the feedback from testing and making any necessary adjustments or changes, the final benchmark and other relevant security tools are made available to the public for download through the CIS website. This process is so extensive and is so carefully executed that thousands of security professionals across the globe participate in it. According to ISACA, "during the development of the CIS Benchmark for Sun Microsystems Solaris, more than 2,500 users downloaded the benchmark and monitoring tools."

Participating organizations

The organizations that participated in the founding of CIS in October, 2000 include ISACA, the American Institute of Certified Public Accountants, the Institute of Internal Auditors, the International Information Systems Security Certification Consortium and the SANS Institute. CIS has since grown to have hundreds of members with varying degrees of membership, and cooperates and works with a variety of organizations and members at both the national and international levels. Some of these organizations include those in both the public and private sectors, government, ISACs and law enforcement.