CISQ
CISQ is a not-for-profit standards organization, managed as a program of Object Management Group, that develops open international standards for automated measurement of software size and structural quality from source code, serving enterprises, government agencies, and software vendors globally.
- Company typePrivate
- Founded2010
- HeadquartersNeedham, United States
- Headcount1,001–5,000
- GTM typeB2B
- OfferingServices
What CISQ does
CISQ (Consortium for Information & Software Quality) is an international not-for-profit standards development organization that establishes open, automatable standards for measuring software size and structural quality directly from source code. Founded in 2010 by the Object Management Group (OMG) and Carnegie Mellon University's Software Engineering Institute (SEI), CISQ enables enterprises, government agencies, and software vendors to objectively quantify the operational risk and cost of ownership of software-intensive systems. The organization operates as a program of OMG, a 501(c)(6) tax-exempt entity, and submits its specifications to OMG and ISO for adoption as international standards.
The product portfolio is a family of standards rather than a software product. Sizing standards include Automated Function Points (also ISO 19515:2019) and Automated Enhancement Points for productivity and maintenance sizing. The ISO/IEC 5055:2021 code-quality standard covers four characteristics — Reliability, Security, Performance Efficiency, and Maintainability — by detecting specific Common Weakness Enumeration (CWE) entries. The Automated Technical Debt Measure (V2 released November 2023) translates detected defects into corrective-maintenance cost estimates. The Automated Source Code Data Protection Measure (August 2022) is aligned to GDPR, CCPA, ISO 27001, and NIST frameworks. Active prospects include a joint CISQ-OMG Software Bill of Materials exchange specification, DevOps flow measures, and an Automated Source Code Resource Sustainability Measure. Standards are implemented commercially by third-party static analysis vendors such as CAST and Synopsys, positioning CISQ as a protocol-and-ruleset layer rather than a tool vendor.
Commercially, CISQ is funded through tiered annual sponsorship: USD 25,000 for Large Industry sponsors (companies with annual revenue above USD 50M), USD 10,000 for Small Industry sponsors, and USD 5,000 for Not-for-Profit, Academic, and Government sponsors. Sponsors receive working group participation, a Governing Board seat, and co-branded marketing benefits (webcasts, press releases, directory placements); the underlying standards are open and freely available. The customer base spans G2000 IT executives, independent software vendors, systems integrators, and government/regulatory bodies, with named adoptions by the U.S. Department of Defense, U.S. Army, U.S. Air Force, U.S. Department of State, GSA, BNY Mellon, Manulife, Telefonica, BMW, Cognizant, Tech Mahindra, Generali, CGI, and Northrop Grumman.
CISQ firmographics
Firmographics- Name
- CISQ
- Legal name
- Object Management Group, Inc.
- Website
- https://it-cisq.org
- Company type
- Private
- Founded year
- 2010
- Operating status
- Operating
- Headcount range
- 1,001–5,000 employees
- Short description
- CISQ is a not-for-profit standards organization, managed as a program of Object Management Group, that develops open international standards for automated measurement of software size and structural quality from source code, serving enterprises, government agencies, and software vendors globally.
- Ownership category
- akta.pro rank
CISQ industry classification
Industry- Product category
- Software Quality Standards
- NAICS
- Software Publishers (51321), Software Publishers (5132)
- SIC
- Services-Prepackaged Software (7372)
- akta.pro primary industry
- IT Governance, Risk & Compliance (IT GRC) Platforms (HDAEALAK)
Keywords
Where CISQ is headquartered
LocationHeadquarters
- HQ city
- Needham
- HQ country
- United States
- HQ region
- North America
Offices1 record
Markets served
CISQ business model
Business model- GTM type
- B2B
- Offering type
- Services
- Cost components
- Personnel, Technology or R&D
Revenue model
- Sponsorship Fees: CISQ operates as a not-for-profit IT leadership group funded primarily through corporate sponsorship fees. Sponsorship tiers include Large Industry ($25,000/year for companies with annual revenue >$50M), Small Industry ($10,000/year for revenue <$50M), and Not-for-profit/Academic/Government ($5,000/year). Sponsors receive working group participation, governing board seats, marketing benefits including webcasts and press releases.
Pricing tiers
| Model | Billing | Price |
|---|---|---|
| Subscription | Annual | Large Industry Sponsor - Annual membership for companies with annual revenue >$50M |
| Subscription | Annual | Small Industry Sponsor - Annual membership for companies with annual revenue <$50M |
| Subscription | Annual | Not-for-Profit, Academic, Government Sponsor |
Go-to-market motion1 record
Distribution channels3 records
Marketing channels9 records
CISQ product offering
Product offeringCore offering
CISQ is a not-for-profit IT leadership consortium that develops international, open-source standards for automating the measurement of software size and structural quality directly from source code. Its portfolio includes software sizing standards (Automated Function Points, Automated Enhancement Points), ISO 5055 code quality standards covering Reliability, Security, Performance Efficiency, and Maintainability, technical debt and data protection measures, and emerging standards for DevOps flow metrics, SBOM exchange, and resource sustainability. Implementation is delivered through third-party static analysis tool vendors such as CAST and Synopsys.
Product overview
CISQ (Consortium for Information & Software Quality) is a not-for-profit standards organization that develops international standards for automating the measurement of software size and structural quality from source code. Rather than a single software product, CISQ offers a portfolio of complementary standards specifications: Software Sizing Standards (Automated Function Points, Automated Enhancement Points) for measuring software size; Code Quality Standards organized around ISO 5055 covering Reliability, Security, Performance Efficiency, and Maintainability (each comprising specific CWEs to detect); the Automated Technical Debt Standard for estimating remediation costs; the Automated Source Code Data Protection Measure for privacy regulations; and emerging standards for DevOps productivity measurement and Software Bill of Materials. These standards are submitted to OMG and ISO for international approval, and implemented by third-party tool vendors (such as CAST and Synopsys) through static analysis technology.
Differentiator
Problem solved
Functional benefit
Companies that use CISQ
Customer profileNamed customers14 records
Segments4 records
Ideal customer profiles4 records
CISQ technology and API
TechnologyTechnology focussed No
API detail
- Has API
- No
- API docs
- API detail
Core technology
AI maturity
App detail
Feature8 records
CISQ partnerships and signals
Strategic signalPartnerships
Twelve partnerships are on record, tiered core and minor.
- Object Management Group (OMG)coreOMG co-founded CISQ in 2010 and manages the CISQ program. CISQ specifications are submitted to OMG for approval as international standards. OMG is an international, open membership, not-for-profit technology standards consortium.
- Software Engineering Institute (SEI) at Carnegie Mellon UniversitycoreSEI co-founded CISQ in 2010 along with OMG. Dr. Paul Nielsen serves as Director and CEO of SEI on the CISQ Governing Board.
- MITREcoreMITRE is a key partner contributing to SBOM standards development. Robert Martin, Senior Principal Engineer in Cyber Security Partnerships at MITRE, chairs the CISQ SBOM working group. MITRE maintains the Common Weakness Enumeration (CWE) repository used by CISQ standards.
- CASTcoreCAST is a founder/sponsor of CISQ. Rado Nikolov, EVP and CMO at CAST, serves on the CISQ Governing Board. CAST contributed to development of code quality standards and supports them in their static analysis tools.
- AFCEA Washington DC ChapterminorArmed Forces Communications and Electronics Association Washington DC Chapter focuses on DoD, intelligence community, national security, and military health agencies.
- Trustworthy Software Initiative (TSI)minorTSI is a UK government-supported public good initiative with mission to 'Make Software Better' through the Trustworthy Software Framework (TSF).
- IT Acquisition Advisory Council (IT-AAC)minorIT-AAC is a public/private 'do tank' working to transform how government acquires and manages IT and Cyber solutions. Architect of FITARA.
- IAOPminorIAOP is an association for professionals in outsourcing and global business services. Strategic partnership announced March 2018.
- CMMC Center of ExcellenceminorIT-AAC sponsored and hosted public-private partnership for coordination on Cybersecurity Maturity Model Certification requirements for defense industrial base.
- Puppet by PerforcecorePuppet joined CISQ as a Cornerstone Sponsor in September 2023. Chris Ganacoplos was added to the CISQ Governing Board representing Puppet. Puppet provides the State of DevOps and State of Open-Source Software reports.
- SynopsyscoreSynopsys is a sponsor and supporter of CISQ. Joe Jarzombek, Director for Government and Critical Infrastructure Programs at Synopsys, serves on the CISQ Advisory Board.
- International Function Point User Group (IFPUG)coreCISQ AFP standard is based on IFPUG Function Point Counting Guidelines. IFPUG is the largest and most active community for Function Point software sizing.
Scale indicators2 records
Recent moves6 records
Expansion highlights6 records
CISQ competitors and assessment
Company assessmentDirect peers
- CAST Software: CAST is a co-founding sponsor of CISQ and the principal commercial implementer of CISQ's automated source code quality standards in its CAST Highlight and CAST Imaging static-analysis tools. CAST translates CISQ's open standards into commercial SaaS offerings, making it the most direct commercialization peer of CISQ's IP.
- Object Management Group (OMG): OMG co-founded CISQ in 2010 and manages the program. OMG operates the international standards approval pipeline that turns CISQ specifications into published standards; CISQ's positioning is inextricable from OMG's broader standards-body role, making OMG the closest structural peer.
- IFPUG (International Function Point Users Group): IFPUG is the longest-standing non-profit standards community for software sizing whose function-point methodology CISQ's Automated Function Points standard (ISO 19515:2019) is built on. It operates a similar member-funded, standards-development non-profit model and serves overlapping software-measurement buyers.
- OWASP Foundation: OWASP is a not-for-profit open-source community producing widely adopted application security standards (OWASP Top 10, ASVS, SAMM) that overlap with CISQ's Security Code Quality Standard and data-protection measures. Both run member/sponsor-funded models producing freely available security standards for enterprise and government buyers.
Broad incumbents
- Synopsys (Software Integrity Group): Synopsys is a CISQ sponsor and advisory-board member, and operates the Coverity static-analysis suite and Black Duck software composition analysis products that overlap directly with CISQ's code-quality, security, and SBOM standards. As a much larger public company, Synopsys sits in the same application quality and supply-chain risk niche CISQ serves.
- ISACA: ISACA is a larger global non-profit membership organization for IT governance, risk, and assurance professionals that publishes COBIT and other frameworks relevant to CISQ's GRC buyer segment. It is the established incumbent in IT governance standards that CISQ's ISO 5055 measures plug into.
- ISO/IEC JTC1/SC7: ISO/IEC JTC1/SC7 is the international standards committee that produces ISO 5055 and ISO 19515, the standards CISQ originated. SC7 is the umbrella body through which CISQ's IP becomes global, making it the institutional peer in the standards-publishing value chain.
Emerging players
- Software Improvement Group (SIG): SIG sits on CISQ's governing board and provides commercial code-quality benchmarking services built on ISO 5055-aligned measures. SIG is a niche emerging vendor that commercializes CISQ-derived standards into enterprise advisory and SaaS benchmarking offerings.
- SonarSource (SonarQube): SonarSource is a competing static-analysis vendor whose SonarQube and SonarCloud products overlap with CISQ code-quality and security standards, with growing adoption in DevOps tooling. Its mission of measuring source-code quality positions it as an adjacent but increasingly competitive tool layer to CISQ-aligned measures.
Others
- Carnegie Mellon Software Engineering Institute (SEI): SEI co-founded CISQ in 2010 and remains a research and standards advisor; SEI also produces authoritative frameworks (CMM/CMMI, CERT) that compete with and complement CISQ's quality and security standards. SEI is an adjacent enabler for CISQ rather than a direct commercial competitor.
Market position
Strengths5 records
Weaknesses5 records
Competitive moat6 records
Key risks5 records
Key highlights6 records
Customer concentration
CISQ social profiles
Digital presenceCISQ compliance and trust
Trust signalCompliance1 record
CISQ financial estimates
Financial estimateRevenue estimate
Valuation estimate
CISQ leadership team
Management profileNumber of profiles
Profiles4 records
CISQ funding detail
Funding detailFunding overview
Funding rounds
Investors
Funding detail is available on the Subscription and Enterprise plan.Contact sales →
CISQ M&A and investment
M&A and investmentM&A
Investments
M&A and investment is available on the Subscription and Enterprise plan.Contact sales →
Frequently asked questions about CISQ
What does CISQ do?
CISQ is a not-for-profit IT leadership consortium that develops international, open-source standards for automating the measurement of software size and structural quality directly from source code. Its portfolio includes software sizing standards (Automated Function Points, Automated Enhancement Points), ISO 5055 code quality standards covering Reliability, Security, Performance Efficiency, and Maintainability, technical debt and data protection measures, and emerging standards for DevOps flow metrics, SBOM exchange, and resource sustainability. Implementation is delivered through third-party static analysis tool vendors such as CAST and Synopsys.
Is CISQ a public or private company?
CISQ is a private company. It is classified as nonprofit foundation owned and is currently operating.
When was CISQ founded?
CISQ was founded in 2010. It employs 1,001 to 5,000 people.
Where is CISQ based?
CISQ is headquartered in Needham, United States, in the North America region.
How does CISQ make money?
One revenue line is on record: sponsorship Fees.
Who are CISQ's main competitors?
Direct peers on record are CAST Software, Object Management Group (OMG), IFPUG (International Function Point Users Group) and OWASP Foundation. Broad incumbents are Synopsys (Software Integrity Group), ISACA and ISO/IEC JTC1/SC7. Emerging players are Software Improvement Group (SIG) and SonarSource (SonarQube). Carnegie Mellon Software Engineering Institute (SEI) is listed as an others.
Does CISQ have an API?
No public API is recorded for CISQ.
What industry is CISQ in?
CISQ's product category is Software Quality Standards. Its primary akta.pro industry code is HDAEALAK, IT Governance, Risk & Compliance (IT GRC) Platforms. Its NAICS code is 51321 and its SIC code is 7372.