Internet Systems Consortium (ISC) Due Diligence

Run due diligence on Internet Systems Consortium (ISC): check compliance and get alerts when suppliers change.

United States · www.isc.org · 16 vendors

Internet Systems Consortium (ISC) is a non-profit organization dedicated to developing software and offering services in support of the Internet infrastructure. It develops and distributes open-source internet networking software packages like BIND (DNS) and Kea DHCP, and operates the F-Root server, one of the 13 Internet root name servers.

Resilience scores

Technology vendors

Services catalogue

1 service in catalogue across 1 category; runs on 16 sub-vendors.

Insights

Last updated 2026-10-23 · revision 6

16 direct vendors, 196 subvendors

Direct vendors by controlling owner country (sample)

Subvendors by controlling owner country (sample)

Compliance

3 in-scope frameworks identified; showing 3.

GDPR (source) — No public evidence

Evidence: https://www.isc.org/privacy

SOC 2 (source) — No public evidence

Evidence: https://www.isc.org/support, https://www.isc.org/f-root

ISO 27001 (source) — No public evidence

Evidence: https://kb.isc.org/docs/aa-00861, https://www.isc.org/f-root

Financials

Three-year financials

Financial Resilience Score: 5/10

ISC operates as a small, stable, mission-driven 501(c)(3) non-profit at the core of global Internet infrastructure. Its recurring revenue model — built on annual software support contracts for BIND 9 and Kea DHCP — provides meaningful predictability, and its low capital intensity (primarily personnel costs across ~45 staff) keeps the cost structure lean and manageable. The organization's technical reputation, ubiquity of its software, and the mission-critical nature of DNS and DHCP infrastructure create a durable demand signal for its support services. However, ISC's financial resilience is structurally constrained by its small scale, with total revenue likely in the low single-digit millions of USD annually. The open-source free-rider dynamic — where the vast majority of BIND 9 and Kea users pay nothing — means revenue depends entirely on a small fraction of users voluntarily purchasing support contracts, a fragile conversion model. Revenue is also highly concentrated in just two software products, and the EOL of ISC DHCP introduces transition risk as customers may migrate to competitors rather than Kea DHCP. Competitive pressure from well-funded commercial vendors such as Infoblox and BlueCat, which offer integrated appliance-based DNS/DHCP solutions with managed services, poses a meaningful displacement risk in enterprise environments. Key-person and talent risk is elevated given the small, highly specialized team. Without confirmed access to Form 990 net asset data, the adequacy of ISC's financial reserves cannot be assessed, adding further uncertainty to the resilience score. Overall, ISC's resilience is moderate: its mission alignment, recurring contract revenue, and technical moat provide a stable foundation, but its small scale, open-source monetization challenges, product concentration, and unverified reserve position prevent a higher score.

Key strengths: Recurring annual software support contract revenue for BIND 9 and Kea DHCP, Low capital intensity — cost base is primarily personnel (salaries of ~45 engineers and support staff), Mission-critical software with deep global market penetration (BIND 9 is the world's most widely deployed DNS software), Non-profit status provides tax-exempt benefits and freedom from shareholder profit pressure, Strong technical reputation — ISC engineers have authored or co-authored over 100 Internet RFCs, Globally distributed team across 15 countries reduces single-country operational risk, Deliberate product modernization strategy (ISC DHCP EOL → Kea DHCP migration)

Risk factors: Small scale with revenue likely in low single-digit millions USD — limited financial buffer against shocks, Open-source free-rider problem: vast majority of users pay nothing; revenue depends on a small conversion fraction, High revenue concentration in two products: BIND 9 and Kea DHCP, ISC DHCP EOL transition risk — customers may migrate to commercial competitors rather than Kea, Competitive pressure from commercial DNS/DHCP vendors (Infoblox, BlueCat) offering integrated managed solutions, Key-person and talent risk in a small, highly specialized engineering team, No confirmed financial reserve data — adequacy of net assets cannot be assessed, Dependency on IANA/ICANN arrangements for F-Root operations, subject to policy changes

Revenue by geography

Revenue by product/service

Workforce by country

Signed-in users can see whether their own company is exposed to this vendor's disruption, plus the full sub-vendor list and country breakdowns, every in-scope compliance framework plus gaps and next steps, and alerts when any of it changes.

View the full interactive report