Rumor Control
In today's expansive information environment, it can be difficult to separate fact from fiction. Learn and share important facts about CIS and our cybersecurity efforts and help stop inaccurate information from spreading. You can find the facts here.
At CIS, we're one of the few institutions with a more than 20-year track record of sustainability in the cybersecurity industry. Learn all about us in this blog post.
Frequently Asked Questions
How is CIS funded?
The Center for Internet Security (CIS) receives funding through various means, including direct sales of various cybersecurity best practices tools and resources, like CIS SecureSuite Membership and CIS Hardened Images, and cybersecurity services like CIS Endpoint Security Services. CIS also receives funding from various government and non-profit grant programs designed to improve the overall cybersecurity posture of U.S. State, Local, Tribal, and Territorial (SLTT) government organizations. CIS operates the Multi-State Information Sharing and Analysis Centers (MS-ISAC) in a cost-share model including federal funding and CIS funds.
What information does CIS share with the federal government?
Generally, the Cybersecurity and Infrastructure Security Agency (CISA) has visibility into certain data that is derived from sensors/services that are funded via the Cooperative Agreement subject to confidentiality obligations. For example, CISA may request and receive the full set of Albert Network Monitoring and Management data only for those Albert deployments funded via the Cooperative Agreement, which represents approximately 20% of the deployed Albert sensor fleet.
Albert: Roughly 80% of deployed Albert sensors are paid for by U.S. state and local governments. For these SLTT-funded sensors, Albert alert data and Albert NetFlow metadata is shared with Federal partners only with the explicit approval of the individual hosting state or local organization.
The deployment of the remaining Albert sensors is funded by Congressional appropriation through the Multi-State Information Sharing and Analysis Centers (MS-ISAC) to support cyber defense across the U.S. below the federal level. For these CISA-funded sensors, information shared with federal partners is limited to Albert alert data and Albert NetFlow metadata.
NCSR: For the Nationwide Cybersecurity Review (NCSR), CISA currently sees only anonymized data, such as threat data and self-reported maturity scores by sector. To date, this data is anonymized, so there is no organization-specific information included.