Thanks very much for your feedback about the ICANN RFI regarding High Security Top Level Domains. We would greatly appreciate having you or someone from TRUSTe speak to our Advisory Group on a conference call, December 15. We normally schedule the call at 9:00 am Pacific time/ noon, East Coast time. But we could adjust the time of the call if needed.
(ICANN, as you may know, is headquartered there in California.)
As we finalize our recommendations to ICANN, the input, thinking and views of TRUSTe on these points would help us:
-how your seal programs work (at a high level)
-how you and others at TRUSTe interpreted our RFI - in particular, how it is different from your current programs.
-what would be the ideal way for ICANN to initiate this type of program
The concept we are exploring for ICANN would be a voluntary program for Top Level Domain owners and possibly for registries and registrars as well. We want Top Level Domain owners who have invested in higher standards of security to be able to differentiate themselves in some way.
As further explanation, so far, the interested parties for the RFI who have contacted ICANN are all auditors. And to the disappointment of our Advisory Group, these audit groups have no interest in administering or overseeing a seal program, although they are interested in being "evaluators". Your response that the RFI seemed to be a pure security audit function seems consistent. So we feel we have missed something or perhaps have not approached this the best way.
Please feel free to call me with any questions or to discuss in more detail.
Ms. Lynn Goodendorf, CIPP, CISSP
Good Security Consulting LLC
-------- Original Message --------
Subject: Re: ICANN RFI on High Security Zone Verification Program
From: Kevin Trilli <ktrilli@truste.com>
Date: Mon, November 29, 2010 10:45 am
To: Craig Schwartz <craig.schwartz@icann.org>
Cc: Fran Maier <fran@truste.com>, "lynn@goodsecurityconsulting.com"
<lynn@goodsecurityconsulting.com>, Chris Babel <cbabel@truste.com>
Thanks for follow-up and apologies to Lynn and you for our delayed response.
The proposal for the RFI represents a pretty significant shift of our business towards a purer security audit functionality which requires a different strategic direction for TRUSTe.
As such we are not going to respond to the RFI.
As Lynn and I spoke, we are happy to help the committee with any info we could provide on running a commercial trustmark. Please let us know if we can help you.
Thank you for your consideration.