September 2018 - Ssr2-review

Barcelona travel email
by Jennifer Bryce Sept. 20, 2018

Sept. 20, 2018

Dear Review Team members, As mentioned on the call today, review team members were sent welcome emails from ICANN Constituency Travel on 17 September. If you did not receive the email please let us know via ssr2-staff(a)icann.org<mailto:ssr2-staff@icann.org>. Thanks, Jennifer -- Jennifer Bryce Senior Reviews Coordinator Internet Corporation for Assigned Names and Numbers (ICANN) Email: jennifer.bryce(a)icann.org Skype: jennifer.bryce.icann www.icann.org

3 2

Clarification requested
by Jennifer Bryce Sept. 20, 2018

Sept. 20, 2018

Dear Denise, We have been asked by the SMEs to provide some clarification on the below questions. As you asked the questions, could you please provide the clarification requested in the bold text below? The full text of the associated recommendations is included at the bottom of this email for reference. Many thanks in advance, Jennifer 1. Regarding recommendation 10, question asked via email<https://mm.icann.org/pipermail/ssr2-review/2017-August/000564.html>: Please provide a summary of the number of complaints and enforcement actions against registries and registrars taken by contractual compliance on the basis of SSR obligations in the past 5 years. Clarification requested: What is meant by the highlighted text? 1. Regarding recommendation 11, question asked via email<https://mm.icann.org/pipermail/ssr2-review/2017-August/000564.html>: How many new gTLD applications were failed (or placed in contention or required to take additional steps) on the basis of the (i) the security and stability review or (ii) the string similarity review. Clarification requested: I am not able to see how failed applications, applications in contentions and applicants that had to take additional steps are related. Is there a common thread between the three? Or are you asking how many applications were impacted by the 2 reviews listed? Are you interested in applications that may have been impacted by these reviews in other ways than the 3 you listed? Recommendation 10: ICANN should continue its efforts to step up contract compliance enforcement and provide adequate resources for this function. ICANN also should develop and implement a more structured process for monitoring compliance issues and investigations. Recommendation 11: ICANN should finalize and implement measures of success for new gTLDs and IDN fast track that expressly relate to its SSR-related program objectives, including measurements for the effectiveness of mechanisms to mitigate domain name abuse. -- Jennifer Bryce Senior Reviews Coordinator Internet Corporation for Assigned Names and Numbers (ICANN) Email: jennifer.bryce(a)icann.org Skype: jennifer.bryce.icann www.icann.org

2 1

Q&As
by Denise Michel Sept. 20, 2018

Sept. 20, 2018

Dear staff: I have a couple requests and questions relating to Q&As<https://docs.google.com/spreadsheets/d/1lFKb5ghbhQgl2klzQChHWT8_Y4WfTL21J9Q….>. 1. When can we expect answers, or an ETA for answers, for outstanding questions? In particular, can we have answers relevant to Recs 1-5 before our next call? 2. In reviewing the answers that have been provided, I see that several answers re-state what was said in the briefing related to the recommendation. While I appreciate the summary (rather than just a link to a meeting recording), the questions were follow-ups to the briefings (note the dates; in some cases the briefings were the genesis for the questions). In addition to referencing statements in the briefings, would you please ask relevant staff to consider the questions and whether more specific answers (with links) could be provided? 3. It would be useful if you would please include relevant Q&As in the material you provide the team in advance of our calls addressing recommendations. Thank you. Denise Denise Michel Director, Domain Name System Strategy & Management Facebook, Inc. denisemichel(a)fb.com<mailto:denisemichel@fb.com>

1 0

Re: [Ssr2-review] [EXT] Re: [ksk-rollover] ICANN board meeting result and the Current status ofKSK-Rollover
by Barrett, Kerry-Ann Sept. 20, 2018

Sept. 20, 2018

Thanks Steve Sincerely, Kerry-Ann On Sep 20, 2018, at 9:58 AM, Steve Conte <steve.conte(a)icann.org<mailto:steve.conte@icann.org>> wrote: Hi all, Please see the formal announcement for the DNS Root KSK Roll here: https://www.icann.org/resources/press-material/release-2018-09-18-en Steve On Sep 17, 2018, at 11:31 AM, Steve Conte <steve.conte(a)icann.org<mailto:steve.conte@icann.org>> wrote: Hi All, The ICANN board met over the weekend at a board workshop and approved a resolution for ICANN to move forward with the roll. There will be a more formal announcement of this once the resolutions are posted later this week and I will forward that once it’s published. However, ksk-rollover list is public, so I felt that it is sufficient to give a heads up. Thanks, Steve Begin forwarded message: From: David Conrad <david.conrad(a)icann.org<mailto:david.conrad@icann.org>> Subject: Re: [ksk-rollover] ICANN board meeting result and the Current status of KSK-Rollover Date: September 17, 2018 at 4:38:10 AM EDT To: Ben Lee <ben.lee(a)hkirc.hk<mailto:ben.lee@hkirc.hk>> Cc: KSK Rollover <ksk-rollover(a)icann.org<mailto:ksk-rollover@icann.org>> Signed PGP part Ben, The Board voted to approve the resolution for ICANN org to move forward with the revised KSK rollover plan. So barring unforeseen circumstances, the KSK-2017-signed ZSK will be used to sign the root zone on 11 October 2018. Regards, -drc On Sep 17, 2018, at 6:26 AM, Ben Lee <ben.lee(a)hkirc.hk<mailto:ben.lee@hkirc.hk>> wrote: I would like to check for the latest status on ICANN root KSK rollover. Is it right the ICANN Board has discussed and approved the current plan on 16 Sep 2018? Does the root KSK rollover is now confirmed to be 11 Oct 2018? Thank you. Best regards, Ben _______________________________________________ ksk-rollover mailing list ksk-rollover(a)icann.org<mailto:ksk-rollover@icann.org> https://mm.icann.org/mailman/listinfo/ksk-rollover _______________________________________________ Ssr2-review mailing list Ssr2-review(a)icann.org<mailto:Ssr2-review@icann.org> https://mm.icann.org/mailman/listinfo/ssr2-review _______________________________________________ Ssr2-review mailing list Ssr2-review(a)icann.org<mailto:Ssr2-review@icann.org> https://mm.icann.org/mailman/listinfo/ssr2-review

1 0

Fwd: [ksk-rollover] ICANN board meeting result and the Current status of KSK-Rollover
by Steve Conte Sept. 20, 2018

Sept. 20, 2018

Hi All, The ICANN board met over the weekend at a board workshop and approved a resolution for ICANN to move forward with the roll. There will be a more formal announcement of this once the resolutions are posted later this week and I will forward that once it’s published. However, ksk-rollover list is public, so I felt that it is sufficient to give a heads up. Thanks, Steve Begin forwarded message: From: David Conrad <david.conrad(a)icann.org<mailto:david.conrad@icann.org>> Subject: Re: [ksk-rollover] ICANN board meeting result and the Current status of KSK-Rollover Date: September 17, 2018 at 4:38:10 AM EDT To: Ben Lee <ben.lee(a)hkirc.hk<mailto:ben.lee@hkirc.hk>> Cc: KSK Rollover <ksk-rollover(a)icann.org<mailto:ksk-rollover@icann.org>> Signed PGP part Ben, The Board voted to approve the resolution for ICANN org to move forward with the revised KSK rollover plan. So barring unforeseen circumstances, the KSK-2017-signed ZSK will be used to sign the root zone on 11 October 2018. Regards, -drc On Sep 17, 2018, at 6:26 AM, Ben Lee <ben.lee(a)hkirc.hk<mailto:ben.lee@hkirc.hk>> wrote: I would like to check for the latest status on ICANN root KSK rollover. Is it right the ICANN Board has discussed and approved the current plan on 16 Sep 2018? Does the root KSK rollover is now confirmed to be 11 Oct 2018? Thank you. Best regards, Ben _______________________________________________ ksk-rollover mailing list ksk-rollover(a)icann.org<mailto:ksk-rollover@icann.org> https://mm.icann.org/mailman/listinfo/ksk-rollover

1 1

Apologies
by Barrett, Kerry-Ann Sept. 20, 2018

Sept. 20, 2018

Dear Team Unfortunately due to something that just arose I won’t be able to attend today. I will undertake to comment on and support anything decision that comes out of the meeting to advance the SSR1 portion. Thanks for understanding Sincerely, Kerry-Ann

2 1

SSR2 - NCSG (NCUC and NPOC) MEETING PLACEHOLDER | ICANN63 Barcelona | 23 October 2018 - time changed to 17:30 CEST (UTC +2)
by MSSI Secretariat Sept. 14, 2018

Sept. 14, 2018

Details TBD.

1 0

Re: [Ssr2-review] Questions and Answers
by Jennifer Bryce Sept. 14, 2018

Sept. 14, 2018

Hi Denise, Yes, the new table contains all of the questions you mention in your email below. This should capture all the questions that have been asked via email or during meetings that relate to SSR1 recommendations and their implementation. As discussed on the call we will add a column to the table to show the source of each request, along with the other additions that were asked for. Please let us know if you have questions about the table or further suggestions. Best, Jennifer From: Ssr2-review <ssr2-review-bounces(a)icann.org> on behalf of Denise Michel <denisemichel(a)fb.com> Date: Thursday, September 13, 2018 at 8:18 AM To: SSR2 <ssr2-review(a)icann.org> Subject: [Ssr2-review] Questions and Answers Hi, Staff. Thank you for creating this new table -- https://docs.google.com/spreadsheets/d/1lFKb5ghbhQgl2klzQChHWT8_Y4WfTL21J9Q… - gid=0<https://docs.google.com/spreadsheets/d/1lFKb5ghbhQgl2klzQChHWT8_Y4WfTL21J9Q…> -- to track the substantive questions SSR2 has asked, and staff’s answers. Could you please confirm that all of the questions that you’ve posted in various places (see my previous email, below) are all contained in this new table? Thanks for your help. Denise Denise Michel Director, Domain Name System Strategy & Management Facebook, Inc. denisemichel(a)fb.com<mailto:denisemichel@fb.com> From: Ssr2-review <ssr2-review-bounces(a)icann.org> on behalf of Denise Michel <denisemichel(a)fb.com> Date: Thursday, August 23, 2018 at 1:09 PM To: SSR2 <ssr2-review(a)icann.org> Subject: [Potential Spoof] [Ssr2-review] FYI SSR1 Implementation Briefings and Questions https://community.icann.org/display/SSR/Briefing+Materials<https://urldefense.proofpoint.com/v2/url?u=https-3A__community.icann.org_di…> (includes following table) SSR1 Subgroup Briefings Briefing Request Status Links Grouping: ICANN Office of the Chief Technology Officer (OCTO) SSR1 - Recs 1, 4, 5, 14, 15, 16, 18, 19, 24, 28 [tick)] Delivered to review team on 14 May 2017 S<https://urldefense.proofpoint.com/v2/url?u=https-3A__community.icann.org_do…>lides<https://urldefense.proofpoint.com/v2/url?u=https-3A__community.icann.org_do…> Meeting Archive<https://urldefense.proofpoint.com/v2/url?u=https-3A__community.icann.org_x_…> Questions<https://urldefense.proofpoint.com/v2/url?u=https-3A__docs.google.com_docume…> Grouping: ICANN Operations & Finance SSR1 - Recs 2, 7, 8, 9, 17, 20, 21, 22 [tick)] Delivered to review team on 25 June 2017 Slides<https://urldefense.proofpoint.com/v2/url?u=https-3A__community.icann.org_pa…> Meeting Archive<https://urldefense.proofpoint.com/v2/url?u=https-3A__community.icann.org_x_…> Questions<https://urldefense.proofpoint.com/v2/url?u=https-3A__docs.google.com_docume…> Grouping: ICANN Compliance SSR1 - Rec 10 [tick)] Delivered to review team on 11 July 2017 Slides<https://urldefense.proofpoint.com/v2/url?u=https-3A__community.icann.org_di…> Meeting Archive<https://urldefense.proofpoint.com/v2/url?u=https-3A__community.icann.org_x_…> Questions<https://urldefense.proofpoint.com/v2/url?u=https-3A__docs.google.com_docume…> Grouping: Risk Management SSR1 - Recs 25 - 27 [tick)] Delivered to review team on 25 July 2017 Slides<https://urldefense.proofpoint.com/v2/url?u=https-3A__community.icann.org_di…> Meeting Archive<https://urldefense.proofpoint.com/v2/url?u=https-3A__community.icann.org_x_…> Questions<https://urldefense.proofpoint.com/v2/url?u=https-3A__docs.google.com_docume…> Grouping: ICANN GDD SSR1 - Recs 11, 12 [tick)] Delivered to review team on 1 August 2017 Slides<https://urldefense.proofpoint.com/v2/url?u=https-3A__community.icann.org_di…> Meeting Archive<https://urldefense.proofpoint.com/v2/url?u=https-3A__community.icann.org_x_…> Questions<https://urldefense.proofpoint.com/v2/url?u=https-3A__docs.google.com_docume…> Grouping: ICANN Policy SSR1 - Recs 6, 13, 23 [info)] Briefing not currently required per Co-Chairs Questions<https://urldefense.proofpoint.com/v2/url?u=https-3A__docs.google.com_docume…> Grouping: ICANN Communications SSR1 - Rec 3 [info)] Briefing not currently required per Co-Chairs Questions<https://urldefense.proofpoint.com/v2/url?u=https-3A__docs.google.com_docume…> https://community.icann.org/display/SSR/Subgroup+%25231+-+SSR1+Review<https://urldefense.proofpoint.com/v2/url?u=https-3A__community.icann.org_di…> (includes following requests for information) Open Actions/Requests *To be provided once reasonable date is determined by appropriate subject-matter expert Item # Source of Request Date of Request Action Item Request Action Owner Anticipated Completion Date* Progress Notes Completed Response Completion Date 167.1 Email<https://urldefense.proofpoint.com/v2/url?u=http-3A__mm.icann.org_pipermail_…> 09 Oct 2017 SSR1 Rec 21: Is there a link to the template described in the staff implementation report? ICANN Org 167.2 Email<https://urldefense.proofpoint.com/v2/url?u=http-3A__mm.icann.org_pipermail_…> 09 Oct 2017 SSR1 Rec 21: Is there a plan for getting public comment on the template prior to using it for publishing information on budget and resource impacts related to SSR events? ICANN Org 167.3 Email<https://urldefense.proofpoint.com/v2/url?u=http-3A__mm.icann.org_pipermail_…> 09 Oct 2017 SSR1 Rec 21: Where is the budgetary information as it pertains to the SSR? And where is the cost benefit analysis for making these decisions? ICANN Org 167.4 Email<https://urldefense.proofpoint.com/v2/url?u=http-3A__mm.icann.org_pipermail_…> 09 Oct 2017 SSR1 Rec 21: Where is the evidence that a more structured internal process has been developed for SSR budgetary considerations? How do these decisions map onto ICANN’s planning framework and process? ICANN Org 167.5 Email<https://urldefense.proofpoint.com/v2/url?u=http-3A__mm.icann.org_pipermail_…> 09 Oct 2017 SSR1 Rec 21: Can ICANN provide an update as to the status of phase two (identifying mechanisms that that provide detailed public information on SSR-related budgets), and the steps still to be taken to ensure this recommendation is properly implemented? ICANN Org 167.6 Email<https://urldefense.proofpoint.com/v2/url?u=http-3A__mm.icann.org_pipermail_…> 09 Oct 2017 SSR1 Rec 22: Recommendation 22 is specifically about the new gTLD program. What documentation, specific to the new gTLD Program, on the organization, budget and resources needed to manage SSR issues in this area is available? ICANN Org 167.7 Email<https://urldefense.proofpoint.com/v2/url?u=http-3A__mm.icann.org_pipermail_…> 09 Oct 2017 SSR1 Rec 22: Since the publication of the SSR1 report, what materials have been published by the SSR team that are specific to the implementation of the new gTLD Program? How has that work been budgeted and resourced? ICANN Org 167.8 Email<https://urldefense.proofpoint.com/v2/url?u=http-3A__mm.icann.org_pipermail_…> 09 Oct 2017 SSR1 Rec 23: Recommendation 23 calls for a mechanism for Working Groups and Advisory Councils to support their decisions in an objective manner that is free from external or internal pressure. Where is such a mechanism documented – specifically regarding the work of SSAC and RSSAC? ICANN Org 167.9 Email<https://urldefense.proofpoint.com/v2/url?u=http-3A__mm.icann.org_pipermail_…> 09 Oct 2017 SSR1 Rec 25: Since the publication of the SSR1 Final Report, what mechanisms have been put into place to incorporate near and long-term risks into a formal, strategic Risk Management Framework for ICANN? ICANN Org 167.10 Email<https://urldefense.proofpoint.com/v2/url?u=http-3A__mm.icann.org_pipermail_…> 09 Oct 2017 SSR1 Rec 25: Since the Board approval of the 2014 Risk Management Framework provided by an external consultant, what further review, consultation or further work has been done on the approved Framework? ICANN Org 167.11 Email<https://urldefense.proofpoint.com/v2/url?u=http-3A__mm.icann.org_pipermail_…> 09 Oct 2017 SSR1 Rec 25: Please provide evidence of briefings to the Board Risk Committee on the risk assessment and proposed mitigation measures, as per Board Resolution dated 21 November 2013 https://features.icann.org/dns-risk-management-framework-report-and-impleme…<https://urldefense.proofpoint.com/v2/url?u=https-3A__features.icann.org_dns…>, and any follow up arising from such briefings. ICANN Org 167.12 Email<https://urldefense.proofpoint.com/v2/url?u=http-3A__mm.icann.org_pipermail_…> 09 Oct 2017 SSR1 Rec 25: What efforts have been made since 2014 to demonstrate that ICANNs risk management framework follows the standards of transparency and community participation, required by the SSR1? ICANN Org 167.13 Email<https://urldefense.proofpoint.com/v2/url?u=http-3A__mm.icann.org_pipermail_…> 09 Oct 2017 SSR1 Rec 25: Please clarify whether the portfolio of the new VP of Enterprise Risk Management extends into risks relating to ICANN's role with regard to the internet's set of unique identifiers, and future threats relating to unique identifiers? ICANN Org 167.14 Email<https://urldefense.proofpoint.com/v2/url?u=http-3A__mm.icann.org_pipermail_…> 09 Oct 2017 SSR1 Rec 25: Is there a final DNS risk assessment document (the linked to document is labelled 'draft') https://www.icann.org/en/system/files/files/dns-risk-consultation-28may14-e…<https://urldefense.proofpoint.com/v2/url?u=https-3A__www.icann.org_en_syste…>, and have there been any updates since 2014? ICANN Org 167.15 Email<https://urldefense.proofpoint.com/v2/url?u=http-3A__mm.icann.org_pipermail_…> 09 Oct 2017 SSR1 Rec 27: The staff report for implementation of SSR1’s Recommendations indicates that this Recommendation is complete. How did staff assess the “comprehensiveness” of the Risk Management Framework to come to this conclusion? ICANN Org 167.16 Email<https://urldefense.proofpoint.com/v2/url?u=http-3A__mm.icann.org_pipermail_…> 09 Oct 2017 SSR1 Rec 27: Please provide details of how the risk management has been staffed since SSR1 recommendations have been adopted by the Board. ICANN Org 146.1 Email<https://urldefense.proofpoint.com/v2/url?u=http-3A__mm.icann.org_pipermail_…> 25 Aug 2017 SSR1 Rec 1-20 General Question: What individual within the ICANN organization holds ultimate responsibility for implementation of SSR1 recommendations? ICANN Org 146.2 Email<https://urldefense.proofpoint.com/v2/url?u=http-3A__mm.icann.org_pipermail_…> 25 Aug 2017 SSR1 Rec 1-20 General Question: How has the responsibility for implementation of SSR1 recommendations flowed down through the organization, in terms of ownership, deliverables, performance objectives, etc.? ICANN Org 146.3 Email<https://urldefense.proofpoint.com/v2/url?u=http-3A__mm.icann.org_pipermail_…> 25 Aug 2017 SSR1 Rec 1-20 General Question: What mechanisms exist within the ICANN organization to provide regular (at least annual) reviews of SSR1 implementation, and to make appropriate adjustments to working practices and responsibilities? ICANN Org 146.4 Email<https://urldefense.proofpoint.com/v2/url?u=http-3A__mm.icann.org_pipermail_…> 25 Aug 2017 SSR1 Rec 1-20 General Question: What measures of success have been adopted within the ICANN organization for implementation of SSR1 recommendations, and how has the community been involved in defining or reviewing such measures? ICANN Org 146.5 Email<https://urldefense.proofpoint.com/v2/url?u=http-3A__mm.icann.org_pipermail_…> 25 Aug 2017 SSR1 Rec 1-20 General Question: How has the ICANN organization ensured that the implementation of SSR1 recommendations are embedded in standard operating procedures? ICANN Org 146.6 Email<https://urldefense.proofpoint.com/v2/url?u=http-3A__mm.icann.org_pipermail_…> 25 Aug 2017 SSR1 Rec 1-20 General Question: The SSR1 Report includes check marks for due dates under “Status of Deliverables” and the accompanying text often does not contain completion dates. Please provide a “due date” and completion date for each deliverable. ICANN Org 146.7 Email<https://urldefense.proofpoint.com/v2/url?u=http-3A__mm.icann.org_pipermail_…> 25 Aug 2017 SSR1 Rec 1: Since the version developed in 2012, what changes have been made to the SSR remit and technical mission statement? Who has made those changes? How has the community been allowed to review and comment on those changes? When were the last changes made to this statement? ICANN Org 146.8 Email<https://urldefense.proofpoint.com/v2/url?u=http-3A__mm.icann.org_pipermail_…> 25 Aug 2017 SSR1 Rec 1: How are the definitions of security, stability and resiliency consistently carried through into key documents, such as strategic plans and agreements with contracted parties? ICANN Org 146.9 Email<https://urldefense.proofpoint.com/v2/url?u=http-3A__mm.icann.org_pipermail_…> 25 Aug 2017 SSR1 Rec 2: Recommendation 2 directs that the definition of ICANN’s SSR remit and limited technical mission should be reviewed in order to maintain consensus and elicit feedback from the Community. Please provide details of reviews and community feedback that have occurred since 2013. ICANN Org 146.10 Email<https://urldefense.proofpoint.com/v2/url?u=http-3A__mm.icann.org_pipermail_…> 25 Aug 2017 SSR1 Rec 2: As ICANN’s SSR remit and limited technical mission statement has evolved, how has comment from the community been incorporated? For instance, is there a summary of the comments on the FY 2014 Framework? Where is this published? ICANN Org 146.11 Email<https://urldefense.proofpoint.com/v2/url?u=http-3A__mm.icann.org_pipermail_…> 25 Aug 2017 SSR1 Rec 3: In what way has ICANN publicized consistent terminology and descriptions related to ICANN’s SSR role and remit? Where are these published? ICANN Org 146.12 Email<https://urldefense.proofpoint.com/v2/url?u=http-3A__mm.icann.org_pipermail_…> 25 Aug 2017 SSR1 Rec 3: What terms related to SSR have been added to the ICANN public glossary? When were they added? ICANN Org 146.13 Email<https://urldefense.proofpoint.com/v2/url?u=http-3A__mm.icann.org_pipermail_…> 25 Aug 2017 SSR1 Rec 4: What accounts for the inconsistencies between the different documents on the ICANN website that describe the nature of the SSR relationships it has within the ICANN community? ICANN Org 146.14 Email<https://urldefense.proofpoint.com/v2/url?u=http-3A__mm.icann.org_pipermail_…> 25 Aug 2017 SSR1 Rec 4: In what way are these documents fulfilling the requirement to provide a single focal point for understanding the interdependencies between organizations? ICANN Org 146.15 Email<https://urldefense.proofpoint.com/v2/url?u=http-3A__mm.icann.org_pipermail_…> 25 Aug 2017 SSR1 Rec 4: What opportunities have there been for community input into the nature/definition of ICANN’s SSR relationships? ICANN Org 146.16 Email<https://urldefense.proofpoint.com/v2/url?u=http-3A__mm.icann.org_pipermail_…> 25 Aug 2017 SSR1 Rec 4:How is the document describing SSR relationships with partner organizations being updated? ICANN Org 146.17 Email<https://urldefense.proofpoint.com/v2/url?u=http-3A__mm.icann.org_pipermail_…> 25 Aug 2017 SSR1 Rec 6: What is the status of the document currently available at: https://www.icann.org/en/system/files/files/draft-rssac-ssac-roles-responsi…<https://urldefense.proofpoint.com/v2/url?u=https-3A__www.icann.org_en_syste…>? ICANN Org 146.18 Email<https://urldefense.proofpoint.com/v2/url?u=http-3A__mm.icann.org_pipermail_…> 25 Aug 2017 SSR1 Rec 6: The recommendation requires that ICANN should seek consensus for this document across both groups. Please provide documentation that this occurred. ICANN Org 146.19 Email<https://urldefense.proofpoint.com/v2/url?u=http-3A__mm.icann.org_pipermail_…> 25 Aug 2017 SSR1 Rec 6: What specific resourcing for RSSAC and SSAC appears in either the ICANN Operating Plan or the most recent budget? ICANN Org 146.20 Email<https://urldefense.proofpoint.com/v2/url?u=http-3A__mm.icann.org_pipermail_…> 25 Aug 2017 SSR1 Rec 7: How are the objectives specific to the SSR Framework documented in either the Operating Plan or the Strategic Plan? ICANN Org 146.21 Email<https://urldefense.proofpoint.com/v2/url?u=http-3A__mm.icann.org_pipermail_…> 25 Aug 2017 SSR1 Rec 7: Where are priorities for SSR activities and initiatives published? ICANN Org 146.22 Email<https://urldefense.proofpoint.com/v2/url?u=http-3A__mm.icann.org_pipermail_…> 25 Aug 2017 SSR1 Rec 7: In what ways have pragmatic cost-benefit and risk analysis informed the choice of priorities (if any)? ICANN Org 146.23 Email<https://urldefense.proofpoint.com/v2/url?u=http-3A__mm.icann.org_pipermail_…> 25 Aug 2017 SSR1 Rec 7: In addition to the ability to comment on draft ICANN budgets and plans, how is the community able to provide input into the objectives, initiatives and activities related to SSR at ICANN? ICANN Org 146.24 Email<https://urldefense.proofpoint.com/v2/url?u=http-3A__mm.icann.org_pipermail_…> 25 Aug 2017 SSR1 Rec 7: The SSR1 Report indicates that ICANN will “improve and publish a process for establishing updated SSR priorities and objectives.” Where has this been published? Was there a mechanism for community review of the process (if so, please provide links)? ICANN Org 146.25 Email<https://urldefense.proofpoint.com/v2/url?u=http-3A__mm.icann.org_pipermail_…> 25 Aug 2017 SSR1 Rec 9: SysTrust certification is referenced in the SSR1 Report as already in place. Please explain how it is claimed to be implementation of SSR1. ICANN Org 146.26 Email<https://urldefense.proofpoint.com/v2/url?u=http-3A__mm.icann.org_pipermail_…> 25 Aug 2017 SSR1 Rec 9: Beside the certifications/audits done for processes in IANA, what certification activities have been assessed or implemented related to SSR? ICANN Org 146.27 Email<https://urldefense.proofpoint.com/v2/url?u=http-3A__mm.icann.org_pipermail_…> 25 Aug 2017 SSR1 Rec 9: For staff working on SSR-related objectives, is there a certification plan in place as part of career/staff development? ICANN Org 146.28 Email<https://urldefense.proofpoint.com/v2/url?u=http-3A__mm.icann.org_pipermail_…> 25 Aug 2017 SSR1 Rec 9: When was the EFQM model implemented within ICANN, and please provide details of how the SSR Framework and standard operating procedures have been evaluated and updated in the light of EFQM adoption to demonstrate process improvements over time. ICANN Org 146.29 Email<https://urldefense.proofpoint.com/v2/url?u=http-3A__mm.icann.org_pipermail_…> 25 Aug 2017 SSR1 Rec 9: Has ICANN ever published a document that would include “a clear roadmap towards certification?” If so, where? Was there a mechanism by which community comment or engagement took place for such a document? ICANN Org 146.30 Email<https://urldefense.proofpoint.com/v2/url?u=http-3A__mm.icann.org_pipermail_…> 25 Aug 2017 SSR1 Rec 10: Please provide a summary of the number of complaints and enforcement actions against registries and registrars taken by contractual compliance on the basis of SSR obligations in the past 5 years. ICANN Org 146.31 Email<https://urldefense.proofpoint.com/v2/url?u=http-3A__mm.icann.org_pipermail_…> 25 Aug 2017 SSR1 Rec 10: To what extent does ICANN measure the incidence and impact of registration abuse and/or malicious conduct by contracted parties? ICANN Org 146.32 Email<https://urldefense.proofpoint.com/v2/url?u=http-3A__mm.icann.org_pipermail_…> 25 Aug 2017 SSR1 Rec 11: What measurements exist, and are used, for the effectiveness of mechanisms to mitigate domain name abuse, as required in recommendation 11? ICANN Org 146.33 Email<https://urldefense.proofpoint.com/v2/url?u=http-3A__mm.icann.org_pipermail_…> 25 Aug 2017 SSR1 Rec 11: Please provide details of the measures of success relating to new gTLDs and IDNs that expressly address SSR related program objectives. The link in the SSR1 Report did not resolve. ICANN Org 146.34 Email<https://urldefense.proofpoint.com/v2/url?u=http-3A__mm.icann.org_pipermail_…> 25 Aug 2017 SSR1 Rec 11: Please provide details of how SSR objectives are explicitly referenced in ICANN’s standard operating procedures, Service Level Agreements and monitoring, emergency back- end registry operators and data escrow, Trademark Clearinghouse, root zone scaling management, DNSSEC-related activities, and Compliance Dept. activities. ICANN Org 146.35 Email<https://urldefense.proofpoint.com/v2/url?u=http-3A__mm.icann.org_pipermail_…> 25 Aug 2017 SSR1 Rec 11: Noting IAG-CCT produced 70 metrics of which a single one (1.13) related to security issues; please provide details of the information gathered according to that metric. The web page of metrics and measures does not include information relating to 1.13. ICANN Org 146.36 Email<https://urldefense.proofpoint.com/v2/url?u=http-3A__mm.icann.org_pipermail_…> 25 Aug 2017 SSR1 Rec 11: The SSR1 Report refers to Specification 11 as applying to all new gTLD registries. Please provide reports on the number and type of security threats reported by registries under their Specification 11 obligations. Please give details of enforcement action(s) taken by ICANN’s contractual compliance department in relation to Specification 11. ICANN Org 146.37 Email<https://urldefense.proofpoint.com/v2/url?u=http-3A__mm.icann.org_pipermail_…> 25 Aug 2017 SSR1 Rec 11:How many new gTLD applications were failed (or placed in contention or required to take additional steps) on the basis of the (i) the security and stability review or (ii) the string similarity review. ICANN Org 146.38 Email<https://urldefense.proofpoint.com/v2/url?u=http-3A__mm.icann.org_pipermail_…> 25 Aug 2017 SSR1 Rec 11: In relation to the IDN ccTLD Fast Track, please give details of any strings that have failed those security and stability checks for security and stability related reasons rather than for consumer confusion – a CCT Review issue. ICANN Org 146.39 Email<https://urldefense.proofpoint.com/v2/url?u=http-3A__mm.icann.org_pipermail_…> 25 Aug 2017 SSR1 Rec 11: Considering staff and community feedback, how effective is the EPSRP mechanism (the second security and stability review in the IDN ccTLD Fast Track) in detecting and preventing stability and security issues other than consumer confusion? ICANN Org 146.40 Email<https://urldefense.proofpoint.com/v2/url?u=http-3A__mm.icann.org_pipermail_…> 25 Aug 2017 SSR1 Rec 11: Are there any updates on the status of Coordinated Vulnerability Disclosure Reporting since 2013? ICANN Org 146.41 Email<https://urldefense.proofpoint.com/v2/url?u=http-3A__mm.icann.org_pipermail_…> 25 Aug 2017 SSR1 Rec 11: Please provide a copy of the report referred to in bullet point 9 of recommendation 11 implementation in the Final Implementation Report. Given that the SSR objectives referred to in the report remain ‘to be defined’ please provide an explanation as to why this recommendation is said to be complete. ICANN Org 146.42 Email<https://urldefense.proofpoint.com/v2/url?u=http-3A__mm.icann.org_pipermail_…> 25 Aug 2017 SSR1 Rec 11: To what extent was the commissioning of the CDAR report, the Root Stability Study Workshop and the new gTLD program security and stability impact triggered by the SSR1 recommendation, and why is the SSR1 Report not referenced in the published materials relating to those initiatives? ICANN Org 146.43 Email<https://urldefense.proofpoint.com/v2/url?u=http-3A__mm.icann.org_pipermail_…> 25 Aug 2017 SSR1 Rec 12: In what way have the recommendations contained in the paper, “Identifier System Attack Mitigation Methodology,” been integrated into contracts, agreements and MoUs as envisioned by SSR1 recommendation 12? ICANN Org 146.44 Email<https://urldefense.proofpoint.com/v2/url?u=http-3A__mm.icann.org_pipermail_…> 25 Aug 2017 SSR1 Rec 12: Is there a central, up-to-date resource to see how the ISSSR team, and other professionals in the SSR field, have worked with SOs and ACs to identify additional, targeted best-practices for their constituents? Are there pointers to or records of those engagements? ICANN Org 146.45 Email<https://urldefense.proofpoint.com/v2/url?u=http-3A__mm.icann.org_pipermail_…> 25 Aug 2017 SSR1 Rec 12: What are some examples of significant MoUs with international entities that have SSR-practices embedded within them? ICANN Org 146.46 Email<https://urldefense.proofpoint.com/v2/url?u=http-3A__mm.icann.org_pipermail_…> 25 Aug 2017 SSR1 Rec 12: Is the only place where ICANN has documented work on recommendations for web application protection and development of resources for security awareness in the report from the 4th Global DNS Stability, Security and Resiliency Symposium? ICANN Org 146.47 Email<https://urldefense.proofpoint.com/v2/url?u=http-3A__mm.icann.org_pipermail_…> 25 Aug 2017 SSR1 Rec 12: Has there been a Global DNS Stability, Security and Resiliency Symposium since 2014? ICANN Org 146.48 Email<https://urldefense.proofpoint.com/v2/url?u=http-3A__mm.icann.org_pipermail_…> 25 Aug 2017 SSR1 Rec 13: In what way are the resources on the ICANN Security Awareness Resource Locator supposed to help Supporting Organizations secure collaborative community assets? ICANN Org 146.49 Email<https://urldefense.proofpoint.com/v2/url?u=http-3A__mm.icann.org_pipermail_…> 25 Aug 2017 SSR1 Rec 13: Have any recent steps been taken to encourage SOs and ACs to produce and publish best practices repositories for SSR-related information? Is the 2012 information on the ccTLD website the most recent example of SSR-related information published by a Supporting Organization? ICANN Org 146.50 Email<https://urldefense.proofpoint.com/v2/url?u=http-3A__mm.icann.org_pipermail_…> 25 Aug 2017 SSR1 Rec 14: When is the Annual Report for FY 2016-2017 going to be published as a community resource? ICANN Org 146.51 Email<https://urldefense.proofpoint.com/v2/url?u=http-3A__mm.icann.org_pipermail_…> 25 Aug 2017 SSR1 Rec 14: In the ICANN Engagement Interface, are all the SSR-Related outreach activities recorded or listed? ICANN Org 146.52 Email<https://urldefense.proofpoint.com/v2/url?u=http-3A__mm.icann.org_pipermail_…> 25 Aug 2017 SSR1 Rec 15: Is there any record of the methodology in the Coordinated Vulnerability Disclosure Document ever being invoked since 2013? ICANN Org 146..53 Email<https://urldefense.proofpoint.com/v2/url?u=http-3A__mm.icann.org_pipermail_…> 25 Aug 2017 SSR1 Rec 15: Are there any statistics available for the processes identified in the Coordinated Vulnerability Disclosure Document? ICANN Org 146.54 Email<https://urldefense.proofpoint.com/v2/url?u=http-3A__mm.icann.org_pipermail_…> 25 Aug 2017 SSR1 Rec 15: Are there any metrics or statistics available for ICANN’s engagement with operators and trusted community entities on DNS security threats and mitigation techniques? ICANN Org 146.55 Email<https://urldefense.proofpoint.com/v2/url?u=http-3A__mm.icann.org_pipermail_…> 25 Aug 2017 SSR1 Rec 16: What public engagement was done for the creation of the Frameworks and Annual Reports? ICANN Org 146.56 Email<https://urldefense.proofpoint.com/v2/url?u=http-3A__mm.icann.org_pipermail_…> 25 Aug 2017 SSR1 Rec 16: Is there a record showing how Community participation and input into the SSR Framework was incorporated? ICANN Org 146.57 Email<https://urldefense.proofpoint.com/v2/url?u=http-3A__mm.icann.org_pipermail_…> 25 Aug 2017 SSR1 Rec 16: Are the documents that used to be called Frameworks, now to be SSR Annual Reports? If so, what is the community engagement mechanism being used for the Annual Reports? ICANN Org 146.58 Email<https://urldefense.proofpoint.com/v2/url?u=http-3A__mm.icann.org_pipermail_…> 25 Aug 2017 SSR1 Rec 16: The implementation report specifically mentions capability building initiatives that would affect greater engagement in the development of the SSR Frameworks or Annual Reports. What initiatives have taken place? Who has participated? How have they expanded participation and input into the SSR Framework development process? ICANN Org 146.59 Email<https://urldefense.proofpoint.com/v2/url?u=http-3A__mm.icann.org_pipermail_…> 25 Aug 2017 SSR1 Rec 17: What is an example of a more structured internal process for showing how activities and initiatives relate to specific strategic goals, objectives and priorities in the SSR Framework? Has this been incorporated into the internal “At Task” system or other internal management systems? ICANN Org 146.60 Email<https://urldefense.proofpoint.com/v2/url?u=http-3A__mm.icann.org_pipermail_…> 25 Aug 2017 SSR1 Rec 17: Are there any statistics available for the processes identified in the Coordinated Vulnerability Disclosure Document? ICANN Org 146.61 Email<https://urldefense.proofpoint.com/v2/url?u=http-3A__mm.icann.org_pipermail_…> 25 Aug 2017 SSR1 Rec 17: Are there any metrics or statistics available for ICANN’s engagement with operators and trusted community entities on DNS security threats and mitigation techniques? ICANN Org 146.62 Email<https://urldefense.proofpoint.com/v2/url?u=http-3A__mm.icann.org_pipermail_…> 25 Aug 2017 SSR1 Rec 19: In ICANN’s Portfolio Management system, the only SSR-related activity that appears is KSK Rollover. Is there another place where SSR-activities are tracked so that the community can see progress on current year activities (for instance the KPI Dashboard seems to be entirely related to the OCTO’s work with the technical and public safety communities)? ICANN Org 146.63 Email<https://urldefense.proofpoint.com/v2/url?u=http-3A__mm.icann.org_pipermail_…> 25 Aug 2017 SSR1 Rec 20: Provide documentation of, and links to, mechanisms that have been used since 2012 to provide more detailed public information on SSR-related budgets and expenditures across multiple ICANN departments ICANN Org 146.64 Email<https://urldefense.proofpoint.com/v2/url?u=http-3A__mm.icann.org_pipermail_…> 25 Aug 2017 SSR1 Rec 20: Have any after-event reports (for relevant threats) been published that include budget and resource impacts related to managing the event? What would be an example of this kind of after-event-report? ICANN Org 101.1 Plenary Meeting 21<https://urldefense.proofpoint.com/v2/url?u=https-3A__community.icann.org_di…> 01 Aug 2017 Rec 11: What was happening in the 5 years between when the recommendation was approved by the Board and when a draft consultant report was posted in April 2017? ICANN Org 101.2 Plenary Meeting 21<https://urldefense.proofpoint.com/v2/url?u=https-3A__community.icann.org_di…> 01 Aug 2017 Rec 11: On the status and deliverables of Rec 11 it says that ICANN has implemented measures of success for the gTLDs, but we haven’t seen how you’ve implemented measures of success for new gTLDs and IDNs. That’s the first check mark, but what we’ve been provided with is a draft report of some ideas that you could do. How is that considered full implementation of this recommendation? ICANN Org 101.5 Plenary Meeting 21<https://urldefense.proofpoint.com/v2/url?u=https-3A__community.icann.org_di…> 01 Aug 2017 Rec. 11: The SSR1 review team called out a number of activities that were operational and within staff’s purview and contained in the SSR framework and called for implementation of measurements and metrics. Was that work done and is it captured anywhere? To clarify, as part of the SSR1 report related to rec 11, the SSR1 review team noted ICANN administration of the new gTLD Program, IDN program, significant SSR related issues that are in the framework. They called for more specific goals, measurements and impact assessment. Was that work done and is it captured somewhere else? ICANN Org Clarity requested via email<https://urldefense.proofpoint.com/v2/url?u=http-3A__mm.icann.org_pipermail_…>. Awaiting input from Review Team. 101.6 Plenary Meeting 21<https://urldefense.proofpoint.com/v2/url?u=https-3A__community.icann.org_di…> 01 Aug 2017 Rec. 11: Is there more information on the steps that ICANN has taken in the past five years to facilitate data access and activities that involved other entities that had ownership or responsibilities on related activities? ICANN Org Clarity requested via email<https://urldefense.proofpoint.com/v2/url?u=http-3A__mm.icann.org_pipermail_…>. Awaiting input from Review Team. 101.7 Plenary Meeting 21<https://urldefense.proofpoint.com/v2/url?u=https-3A__community.icann.org_di…> 01 Aug 2017 Rec 11: Broadly, in looking at the dashboard for rec 11 and all the checkmarks including operational items, it’s really unclear how staff defined and measured success related to SSR. It’s hard to see how the basic sprit of this recommendation was implementation, especially with an idea paper from a consultant. But in terms of the last 5 years and what staff did to implement, it’s unclear. Can you gather more information and provide more clarity and facts? ICANN Org 101.8 Plenary Meeting 21<https://urldefense.proofpoint.com/v2/url?u=https-3A__community.icann.org_di…> 01 Aug 2017 Rec 12: With regards to establishing best practices and integrating these into agreements to which ICANN enters: It’s linked to a paper that raises a whole host of issues and addresses proposed activities but it’s unclear how that then relates to integrating those into agreements into which ICANN has entered over the past 5 years. Can you provide more specific information on how best practices are reflected in agreements that ICANN has entered into? ICANN Org 101.9 Plenary Meeting 21<https://urldefense.proofpoint.com/v2/url?u=https-3A__community.icann.org_di…> 01 Aug 2017 Rec 12: ‘Addressing SSR practices in MOUs’ links to a page that holds all of the MOUs. Can you provide some quantification of SSR-related practices in MOUs and more information on which ones contain SSR-related practices, which practices they contain, and how all that’s tracked or the implementation is assessed? ICANN Org Clarity requested via email<https://urldefense.proofpoint.com/v2/url?u=http-3A__mm.icann.org_pipermail_…>. Awaiting input from Review Team. 101.11 Plenary Meeting 21<https://urldefense.proofpoint.com/v2/url?u=https-3A__community.icann.org_di…> 01 Aug 2017 Rec 12: Which sections of the revised new gTLD registry agreement does OCTO staff feel advance SSR best practices and objectives? ICANN Org Completed Actions/Requests Item # Source of Request Date of Request Action Item Request Action Owner Anticipated Completion Date* Progress Notes Completed Response Completion Date 101.10 Plenary Meeting 21<https://urldefense.proofpoint.com/v2/url?u=https-3A__community.icann.org_di…> 01 Aug 2017 Rec 12: Is there any quantification or more detailed information on what the working relationship with the APWG has yielded? ICANN Org Question answered via email<https://urldefense.proofpoint.com/v2/url?u=http-3A__mm.icann.org_pipermail_…>. 09 Aug 2017 101.3 Plenary Meeting 21<https://urldefense.proofpoint.com/v2/url?u=https-3A__community.icann.org_di…> 01 Aug 2017 Rec 11: Do you think it is ICANN staff’s responsibility to gather, analyze and publish this data or do you feel that it’s ICANN’s responsibility to facilitate others to do that? ICANN Org Question answered during the call. See meeting record<https://urldefense.proofpoint.com/v2/url?u=https-3A__community.icann.org_di…>. 01 Aug 2017 101.4 Plenary Meeting 21<https://urldefense.proofpoint.com/v2/url?u=https-3A__community.icann.org_di…> 01 Aug 2017 Rec 11: In a commercialized world of DNS service provision where data is considered to be a corporate asset, do you feel that either ICANN or the community at large have access to meaningful metrics? I cite the barriers that exist on information on root servers. Is this a barrier to the entire objective, that access to data appears to be challenging? ICANN Org Geoff Huston (asker) clarified that he feels this is a question for the review team to answer, not ICANN Org. 01 Aug 2017 101.12 Plenary Meeting 21<https://urldefense.proofpoint.com/v2/url?u=https-3A__community.icann.org_di…> 01 Aug 2017 Rec 12: What has changed after the implementation of Rec#12 as compared with the past? ICANN Org Question answered during the call. See meeting record<https://urldefense.proofpoint.com/v2/url?u=https-3A__community.icann.org_di…>. 01 Aug 2017 https://community.icann.org/display/SSR/Tracking+Tool<https://urldefense.proofpoint.com/v2/url?u=https-3A__community.icann.org_di…> (I don’t know if this page is duplicative or requests/questions are included above?)

2 1

Call summary: SSR2 13 September
by Jennifer Bryce Sept. 13, 2018

Sept. 13, 2018

Dear all, Please find attached the plenary call report for SSR2 meeting #43, 13 September at 14:00 UTC. Note one decision was flagged for editing. Eric, could you please clarify the amended wording you proposed to the below? Decision: SSR2 to include DNS Root KSK roll process in relation to organizational risk management (ICANN SSR) and post-mortem of the KSK roll (DNS SSR). (Decision to be clarified by review team). These high-level notes are designed to help SSR2 Review Team members navigate through the content of the call. They are not meant to be a substitute for the recording or transcript, which are posted on the wiki at: https://community.icann.org/x/AAKNBQ . The transcript usually becomes available 5 - 7 business days after the meeting. Best, Jennifer -- Jennifer Bryce Senior Reviews Coordinator Internet Corporation for Assigned Names and Numbers (ICANN) Email: jennifer.bryce(a)icann.org Skype: jennifer.bryce.icann www.icann.org

1 0

FW: Imminent SSR issue
by Scott McCormick Sept. 13, 2018

Sept. 13, 2018

Hi All, I sent this to the list last week and didn’t get any responses. Did anyone see this? CC excom to make sure this is seen and on our radar. V/r, -Scott From: Scott McCormick <smccormick(a)kvantcorp.com> Date: Thursday, August 30, 2018 at 11:26 AM To: Ssr2-review <ssr2-review-bounces(a)icann.org> Subject: Imminent SSR issue Hi all, An issue that I’ve been keeping my eye on and is an imminent SSR issue is the DNS KSK roll. There are varying points of view, with the two outer views being 1) roll it 2) do not. There is plenty of room for debate on this, however SSAC produced report 102 https://www.icann.org/en/system/files/files/sac-102-en.pdf where several dissents, one being Verisign, which being a root operator I weigh their input on this matter. Verisign’s comments being the only statistical data that has been presented in comments on the DNS KSK roll has some valid concerns. https://mm.icann.org/pipermail/comments-ksk-rollover-restart-01feb18/attach… If I missed others data that has been posted on this please enlighten me. This issue should be a priority for us as a team. Look forward to hearing any comments on this. V/r, -Scott Scott McCormick Mobile 443.691.2013

3 2