Chartered Institute of Information Security
A member-governed professional body and learned society focused on advancing the professionalism of information security practitioners.
Last updated August 26, 2026
AI crawler reads
No AI crawler has read this profile since Oct 28, 2026.
Overview
The Chartered Institute of Information Security, commonly known as CIISec, is a United Kingdom-based independent, not-for-profit professional body and learned society for people working in information security and information assurance. It was established in 2006 by information security professionals and originally operated under the name Institute of Information Security Professionals, or IISP. The organization later adopted the Chartered Institute of Information Security name as part of its development as a focal point for the profession. CIISec's central purpose is to improve the professionalism of information security practitioners and, through that work, strengthen the information security industry. It provides a membership structure intended to recognize professional competence, practical experience and continuing development. Unlike qualifications that primarily test theoretical knowledge, CIISec membership levels are competency-based: applicants are assessed on the breadth and depth of their knowledge, their experience and their ability to apply professional skills in practice. The institute presents full membership as a professional benchmark for information security practitioners. The institute's membership includes individuals from industry, academia and government, with more than 10,000 members represented globally according to the referenced overview. Its work is therefore aimed at a broad professional community rather than a single commercial technology segment. CIISec's activities include professional recognition, skills definition, accreditation and the promotion of common standards for information security roles. Its principal objective is to provide a universally recognized focal point for the information security profession. A major contribution has been the CIISec Skills Framework, developed in 2007 through cooperation among private-sector and public-sector organizations, academic institutions and security leaders. The framework describes the competencies expected of information security and information assurance professionals and can be used to support role definition, professional development and assessment. It also helped establish a structured basis for discussing the knowledge, skills and experience required across different security roles. CIISec has worked with public bodies and other specialist organizations on formal professional certification. In 2012, the institute was involved in a consortium with CREST and Royal Holloway, University of London to provide certification for UK government information assurance professionals. The work was associated with the government's investment in cyber security and with the information assurance function then known as CESG, which later became part of the National Cyber Security Centre. The consortium was subsequently appointed by the NCSC as one of the certification bodies for the Certified Cyber Professional assured service, assessing individuals against the relevant skills framework. CIISec is governed by its members and has an elected board of directors. It maintains offices in Evesham, Worcestershire, and Southwark, London, with its principal headquarters in Evesham, near the cyber-security centers associated with Cheltenham and Malvern. The institute remains an active professional organization rather than a conventional product company: its principal offerings are membership, competency recognition, skills frameworks, professional development and participation in certification schemes.
History
CIISec was established in the United Kingdom in 2006 by information security professionals seeking to strengthen professional recognition and create a clearer focal point for the developing information security profession. It initially operated as the Institute of Information Security Professionals, abbreviated IISP. The organization was conceived as an independent and not-for-profit body governed by its members, rather than as a commercial security vendor or a training provider tied to a particular technology supplier. In 2007, the institute developed the CIISec Skills Framework. The framework was created through collaboration among public-sector and private-sector organizations, academic contributors and senior security practitioners. Its purpose was to describe the range of competencies expected of professionals working in information security and information assurance. By organizing the profession around skills and capability, the framework provided a basis for employers, practitioners and assessors to discuss job requirements and professional development in more consistent terms. The institute's professional model emphasized demonstrated competence. CIISec membership grades were designed to recognize a person's knowledge, experience and ability to perform information security work, rather than relying only on completion of a written examination. This competency-based approach became a central part of the institute's identity and helped distinguish it from organizations whose primary role is to issue knowledge-based qualifications. In 2012, CIISec participated in a consortium with CREST and Royal Holloway, University of London to support certification for UK government information assurance professionals. The initiative formed part of broader government investment in cyber security and was connected with the UK information assurance authority then known as CESG. CIISec contributed professional skills and competency definitions, while the wider government framework enabled formal assessments against recognized information assurance skill levels. The work was significant because it linked a professional institute's competency model with an official national certification process. During the same period, the IISP worked with e-skills UK to align professional skills standards in information security. The institute also engaged with industry discussions about professional recognition, changing technology and the capabilities needed by security teams. These activities broadened its role beyond membership administration into standards development and professional representation. The organization later became known as the Chartered Institute of Information Security. Under the CIISec identity, it continued its focus on professional standards, membership, competency assessment and collaboration with government and industry. Its membership expanded to include practitioners from industry, academia and government around the world, with the referenced overview describing a community of more than 10,000 individuals. CIISec has offices in Evesham, Worcestershire, and Southwark, London. Its main headquarters are in Evesham, close to the cyber-security centers around Cheltenham and Malvern. The institute is run by its members through an elected board of directors. Its continuing role is to provide a professional home for information security practitioners, promote consistent skills standards and support trusted assessment of professional capability. It remains a membership-based professional body and learned society, not a publicly listed company or a conventional security-product brand.
- 2012
Government information assurance certification consortium
[1]CIISec joined CREST and Royal Holloway, University of London in a consortium appointed to support certification of UK government information assurance professionals.
- 2012
Professional standards alignment
[1]The IISP worked with e-skills UK to align professional skills standards for information security.
- 2007
CIISec Skills Framework developed
[1]The institute created a competency framework for information security and information assurance roles through cooperation among industry, government, academia and security leaders.
- 2006
Institute established
[1]Information security professionals established the organization in the United Kingdom as the Institute of Information Security Professionals.
Adoption of the Chartered Institute of Information Security name
[1]The organization subsequently adopted the Chartered Institute of Information Security name and the CIISec abbreviation.
Products and positioning
CIISec positions itself as an independent, member-governed professional authority for information security and information assurance. Its distinctive emphasis is on demonstrated competence and practical experience, rather than solely on examination-based or knowledge-based qualifications. It serves as a convening body for practitioners from business, government and academia while also contributing to formal UK cyber-professional standards.
Professional membership · 2006
CIISec Membership
CIISec membership provides professional recognition for information security practitioners. Membership grades are competency-based and take account of a candidate's knowledge, breadth and depth of experience, and demonstrated ability to operate professionally. The offering is intended to provide a common benchmark for individuals, employers and the wider security profession.
Skills framework · 2007
CIISec Skills Framework
The CIISec Skills Framework describes competencies expected across information security and information assurance roles. Developed with contributions from industry, government, academia and security leaders, it can support role design, career development, skills assessment and communication between employers and practitioners.
Professional certification · 2012
Certified Cyber Professional assessment
CIISec participates in the assessment ecosystem for the UK's Certified Cyber Professional assured service. Working with partner organizations and the National Cyber Security Centre framework, the activity assesses practitioners against defined cyber-security skills and competency requirements.
Brand decisions
2012
Partner with specialist and academic organizations on government certificationStrategyBackground
The UK government was investing in cyber security and sought structured certification for information assurance professionals.
Action taken
CIISec joined CREST and Royal Holloway, University of London in a consortium appointed to assess professionals against government-linked information assurance skills requirements.
Aftermath
The partnership connected CIISec's professional competency work with the UK's formal cyber-professional certification infrastructure.
2007
Adopt a competency-based professional frameworkStrategyBackground
The institute sought to establish a broadly applicable professional standard for information security practitioners across industry, government and academia.
Action taken
It developed the CIISec Skills Framework to describe the competencies required in information security and information assurance roles.
Aftermath
The framework became a foundation for professional development, membership recognition and later assessment activity.
Recent events
- 2012
CIISec consortium appointed for UK government cyber-professional certification[1]
Other · Product launch
A consortium involving CIISec, CREST and Royal Holloway, University of London was appointed to assess information security professionals for a UK government certification program associated with the national cyber-security authority.
- 2012
IISP and CREST announce new UK cyber-security skills certification[1]
Product launch · Other
The predecessor organization, the Institute of Information Security Professionals, worked with CREST on a UK government-related certification initiative designed to formalize professional skills and assessment in information assurance.
- 2012
IISP and e-skills UK align information-security professional standards[1]
Other
The IISP and e-skills UK announced work to align professional skills standards in information security, supporting greater consistency in how roles and competencies were described.
Sources2 sources
Cite this profile: Cite the canonical profile. /brand-wiki/chartered-institute-of-information-security · Editorial policy · How profiles are compiled