Keep up with the latest cybersecurity threats, newly discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.
The CIS Benchmarks Community Consensus Process
The CIS Benchmarks are unique for many reasons. None compare to the community consensus process that forms their hardening guidance. Learn how to get involved.
November 8, 2022
3 Min Read
The Center for Internet Security (CIS) recently celebrated 20 years of bringing confidence to the connected world with consensus-based security guidance. The first CIS Benchmark was released in 2000.
Today, there are more than 100 CIS Benchmarks configuration guidelines across 25+ product vendor families. Without community participation, we would not have CIS Benchmarks, as the community is at the heart of what drives development and consensus across industries and technologies.
What Is a CIS Benchmark?
CIS Benchmarks cover operating systems, servers, cloud, mobile devices, desktop software, and network devices. The PDF versions are available to download at no cost from the CIS website, and additional file formats (XCCDF, Word, Excel, etc.) are available to CIS SecureSuite Members.
CIS Benchmarks are unique in the following ways:
Developed through a community consensus process
Provide vendor-neutral, technology-specific recommendations
Provide the necessary steps to configure a system
Recognized as an industry standard and referenced specifically by PCI DSS, FISMA, and more, as a way to be compliant with those standards
Map to the CIS Controls
Although a number of factors have led the CIS Benchmarks to be trusted guidelines for a variety of industries, the way they are developed is also important. The CIS Benchmarks are created through a unique community consensus process on CIS WorkBench, our development platform.
Guidance Driven by Community Consensus
The CIS Benchmarks Communities on CIS WorkBench are open to anyone who wants to contribute to the development of Benchmark best practices. The communities are made up of subject-matter experts, vendors, technical writers, and CIS SecureSuite Members from around the world. Together with CIS, these volunteers develop, review, and maintain the CIS Benchmarks. Each community brings real-world experience and expertise to the process to ensure we are addressing the most prevalent security for various technologies.
CIS team members and volunteer subject-matter experts (SMEs) are key to creating the initial content, which is the foundation for the continued development and publication of the CIS Benchmark. Technical writers, testers, and contributors all play a role in the process, reviewing recommendations and determining the best solutions through discussions. Vendors are also welcome to participate.
Learn more about volunteer roles.
Why You Should Get Involved
Volunteers have the opportunity to be part of a large network of professionals and help shape security. Those who make significant contributions are recognized in the final published CIS Benchmark document.
The CIS Benchmark Development Process
CIS depends on our community and partners to assist in developing and maintaining the CIS Benchmarks. Using CIS WorkBench, tickets and discussion threads are established to continue dialogue until a consensus has been reached on proposed recommendations and the working drafts.
The typical development process:
The initial development process defines the scope of the Benchmark and subject-matter experts begin the discussion, creation, and testing process of working drafts.
After the initial draft is completed, we announce availability of the draft and invite folks to join the community to review, test, and provide feedback. This is the consensus process.
All of the feedback that’s received is reviewed by the CIS lead for the community along with the subject-matter experts. They discuss and adjust the CIS Benchmark as necessary. This ensures the recommendations are complete and represent comprehensive guidance.
Once all feedback has been reviewed and addressed, CIS makes a final call for participation in the community. The final review period lasts an average of two weeks, allowing for a final review of the CIS Benchmark before publishing.
Any final feedback is addressed.
Once consensus has been reached in the CIS Benchmark community, the final CIS Benchmark is published and made publicly available online.
Join a Community Today!
Why not join the CIS Benchmarks Community and lend your expertise?
Learn more here.
You May Also Like
More Insights
