The Consensus Process at Work As a user driven organization, CIS is always in need of qualified and motivated individuals to help us do our work. Below are some common questions we get from people who are interested in learning more about our development process and how they can get involved. How are the CIS Benchmarks developed? Can I get involved? How can I fit this into my busy schedule? What Benchmarks are currently in release and which ones are under development? Are there any consensus teams or projects that need more help than others? How are the CIS Benchmarks developed? The CIS Benchmarks are developed by teams of information security experts from the public, private, and academic sectors. Most development teams communication takes place via e-mail. Conference calls are held periodically to discuss in depth technical issues. The phases of the Benchmark development process are as follows: Initial Benchmark draft --> Core team consensus --> CIS members consensus --> Public release --> Maintenance of "broad end-user consensus" through periodic updates. The objective is to provide consensus configuration Benchmarks that are user originated, continuously updated, and globally accepted. Participation by you and you colleagues is the key to success. Click Here for a flowchart depicting the Benchmark development process. Can I get involved? The consensus effort is an opportunity for CIS members to contribute their technical input and to learn from the many others who participate. CIS maintains a special web page where the names of individuals and organizations that have volunteered their time are listed. Click Here to view that page. If you are interested in learning more about how to get involved in the CIS Benchmark development process, please contact Blake Frantz by by email at bfrantz@cisecurity.org How can I fit this into my busy schedule? You need not participate in the conference calls to be a productive member of the team. You are free to contribute as little or as much of your time as you wish. Because most of the discussion takes place via e-mail, you can submit your feedback and responses when it is convenient for you to do so. What Benchmarks are currently in release and which ones are under development? Click Here to see the list of Benchmarks currently in public release. New Benchmarks and Scoring Tools in development: Apache Tomcat Xen Server Office 2003/2007 Active Work Is Now Underway To Update These Previously Released Benchmarks: SuSE Mac OS X Leopard Vmware ESX Server Oracle 11g New Benchmarks and Benchmark Updates planned for 2008: Web Browser - New PostgreSQL - New MS SharePoint - New Office XP 2007 - New Juniper JunOS - New Citrix - New Palm/Windows Mobile Handhelds - New VoIP - New Banner - New Print Devices - New Sybase - New OS400 - New Slackware - Update AIX - update BIND - update Are there any consensus teams that need more help than others? CIS, along with MITRE and several industry and end user partners, are currently involved in the creation of an XCCDF/OVAL Editor tool. We are in need of Java developers to assist with this project. Click Here for more information and to learn how you can get involved.

© 2005, the Center for Internet Security.