Center for Internet Security

Center for Internet Security
Name	Center for Internet Security
Formation	2000
Type	Nonprofit
Status	501(c)(3)
Headquarters	East Greenbush, New York
Region served	International
Leader title	CEO

Center for Internet Security is a nonprofit organization focused on enhancing cybersecurity readiness and resilience across public sector, private sector, and critical infrastructure communities. It develops consensus-based best practices, manages technical benchmarking tools, and operates information sharing initiatives that support digital defense, incident response, and risk management. The organization engages with standards bodies, regulatory agencies, and technology vendors to translate policy objectives into operational controls and measurable configurations.

History

Founded in 2000, the organization emerged amid heightened attention from National Security Agency, Department of Defense, Federal Bureau of Investigation, Department of Homeland Security, and Office of Management and Budget stakeholders seeking coordinated cybersecurity guidance. Early work intersected with initiatives led by President Bill Clinton administration-era efforts and later with policy shifts under Presidency of George W. Bush and Presidency of Barack Obama. It contributed to high-profile programs alongside Multi-State Information Sharing and Analysis Center, SANS Institute, Internet Engineering Task Force, International Organization for Standardization, and National Institute of Standards and Technology. Over time, the group expanded from technical configuration checklists to enterprise controls, evaluation frameworks, and an expanded global footprint interacting with entities such as European Union Agency for Cybersecurity, United Kingdom National Cyber Security Centre, Australian Cyber Security Centre, and multinational corporations like Microsoft, Amazon Web Services, and Google.

Governance and Funding

Governance is overseen by a board of directors drawn from academia, industry, and public-sector institutions including representatives from Massachusetts Institute of Technology, Carnegie Mellon University, Stanford University, IBM, Cisco Systems, Verizon Communications, and state chief information security officers associated with National Governors Association. Funding sources encompass philanthropic grants from organizations such as Bill & Melinda Gates Foundation and contracts or cooperative agreements with agencies including United States Department of Homeland Security and United States Cyber Command, along with membership fees from corporate partners like Intel Corporation and Dell Technologies. The governance model aligns with nonprofit oversight practices comparable to American Red Cross and United Way while maintaining advisory councils similar to those of Council on Foreign Relations.

Programs and Services

Service offerings include configuration benchmarks, risk assessment tools, technical hardening guides, and incident response resources used by entities including Microsoft Azure, Amazon Web Services, Google Cloud Platform, Oracle Corporation, and managed security service providers like FireEye and Symantec. Operational programs mirror activities of Public-Private Partnership frameworks found in collaborations between Department of Defense and industry and support information sharing events akin to those hosted by Black Hat USA and DEF CON. The organization operates platforms for community defense, benchmarking tooling comparable to OpenSCAP and integrates with standards such as Common Vulnerabilities and Exposures and Common Vulnerability Scoring System adopted by MITRE Corporation. Training and assessment services are delivered alongside academic partners such as University of California, Berkeley and Georgia Institute of Technology.

CIS Controls and Benchmarks

The organization's flagship outputs—widely known technical controls and secure configuration benchmarks—are designed to be implementable by enterprises, utilities, and government agencies including Federal Aviation Administration, Energy Information Administration, Department of Health and Human Services, and state health departments. Controls are mapped to frameworks such as NIST SP 800-53, ISO/IEC 27001, COBIT, and compliance regimes influenced by laws like Health Insurance Portability and Accountability Act and Sarbanes–Oxley Act. Benchmarks cover products from Microsoft Windows, Red Hat Enterprise Linux, Apple macOS, Cisco IOS, Juniper Networks, and virtualization platforms produced by VMware, Inc. and Citrix Systems. Measurement and scoring practices draw on methodologies similar to those used by Center for Internet Security Controls Assessment, Federal Risk and Authorization Management Program, and commercial audit providers like Deloitte and PwC.

Partnerships and Collaborations

Collaborative networks include alliances with international agencies such as North Atlantic Treaty Organization, United Nations Office on Drugs and Crime, and regional organizations including Asia-Pacific Economic Cooperation and African Union. Industry partnerships have been formed with cloud providers Amazon Web Services, Microsoft, and Google as well as security vendors like CrowdStrike, Palo Alto Networks, and Checkpoint Software Technologies. Academic and research collaborations involve institutions such as Massachusetts Institute of Technology, Stanford University, University of Oxford, and ETH Zurich. Engagements with standards bodies include International Organization for Standardization, Internet Engineering Task Force, Institute of Electrical and Electronics Engineers, and National Institute of Standards and Technology.

Impact and Criticism

Adoption of the controls and benchmarks has been cited in guidance for critical infrastructure sectors overseen by Federal Energy Regulatory Commission, Securities and Exchange Commission, Food and Drug Administration, and state-level cybersecurity strategies promoted by National Association of State Chief Information Officers. Impact is visible in reduced attack surface reporting by enterprises audited by KPMG and Ernst & Young and in case studies from utilities and healthcare systems responding to incidents such as those studied after the WannaCry ransomware attack. Criticism focuses on perceived commercial influence from corporate partners including Microsoft and Amazon Web Services and debates over alignment with prescriptive controls versus risk-based approaches advocated by entities like RAND Corporation and Brookings Institution. Others have raised concerns about scalability for small and medium enterprises similar to critiques aimed at PCI Security Standards Council and complexity compared to sector-specific guidance from Centers for Disease Control and Prevention.

Category:Non-profit organizations