September 2018 - Ssr2-review

Agenda: SSR2 meeting 13 September
by Jennifer Bryce Sept. 13, 2018

Sept. 13, 2018

Dear SSR2 Review Team, Please see below for the suggested agenda for the Thursday 13 September plenary meeting at 14:00 UTC. The meeting slides are attached. 1.Welcome, roll call, SOI updates a) Staff to highlight rec. 16 in CCT report for team 2.Barcelona update from staff & confirm if any team members have not yet heard from constituency travel team 3.Finalize comms/outreach plan 4.KSK rollover - what does the team need to look in to? 5.Review of SSR1 recommendations a) Review table of outstanding questions b) Discuss SSR1 recommendations 6.AOB 7.Confirm action items / decisions reached Best, Jennifer -- Jennifer Bryce Senior Reviews Coordinator Internet Corporation for Assigned Names and Numbers (ICANN) Email: jennifer.bryce(a)icann.org Skype: jennifer.bryce.icann www.icann.org

4 4

Questions and Answers
by Denise Michel Sept. 13, 2018

Sept. 13, 2018

Hi, Staff. Thank you for creating this new table -- https://docs.google.com/spreadsheets/d/1lFKb5ghbhQgl2klzQChHWT8_Y4WfTL21J9Q… - gid=0<https://docs.google.com/spreadsheets/d/1lFKb5ghbhQgl2klzQChHWT8_Y4WfTL21J9Q…> -- to track the substantive questions SSR2 has asked, and staff’s answers. Could you please confirm that all of the questions that you’ve posted in various places (see my previous email, below) are all contained in this new table? Thanks for your help. Denise Denise Michel Director, Domain Name System Strategy & Management Facebook, Inc. denisemichel(a)fb.com<mailto:denisemichel@fb.com> From: Ssr2-review <ssr2-review-bounces(a)icann.org> on behalf of Denise Michel <denisemichel(a)fb.com> Date: Thursday, August 23, 2018 at 1:09 PM To: SSR2 <ssr2-review(a)icann.org> Subject: [Potential Spoof] [Ssr2-review] FYI SSR1 Implementation Briefings and Questions https://community.icann.org/display/SSR/Briefing+Materials<https://urldefense.proofpoint.com/v2/url?u=https-3A__community.icann.org_di…> (includes following table) SSR1 Subgroup Briefings Briefing Request Status Links Grouping: ICANN Office of the Chief Technology Officer (OCTO) SSR1 - Recs 1, 4, 5, 14, 15, 16, 18, 19, 24, 28 [(tick)] Delivered to review team on 14 May 2017 S<https://urldefense.proofpoint.com/v2/url?u=https-3A__community.icann.org_do…>lides<https://urldefense.proofpoint.com/v2/url?u=https-3A__community.icann.org_do…> Meeting Archive<https://urldefense.proofpoint.com/v2/url?u=https-3A__community.icann.org_x_…> Questions<https://urldefense.proofpoint.com/v2/url?u=https-3A__docs.google.com_docume…> Grouping: ICANN Operations & Finance SSR1 - Recs 2, 7, 8, 9, 17, 20, 21, 22 [(tick)] Delivered to review team on 25 June 2017 Slides<https://urldefense.proofpoint.com/v2/url?u=https-3A__community.icann.org_pa…> Meeting Archive<https://urldefense.proofpoint.com/v2/url?u=https-3A__community.icann.org_x_…> Questions<https://urldefense.proofpoint.com/v2/url?u=https-3A__docs.google.com_docume…> Grouping: ICANN Compliance SSR1 - Rec 10 [(tick)] Delivered to review team on 11 July 2017 Slides<https://urldefense.proofpoint.com/v2/url?u=https-3A__community.icann.org_di…> Meeting Archive<https://urldefense.proofpoint.com/v2/url?u=https-3A__community.icann.org_x_…> Questions<https://urldefense.proofpoint.com/v2/url?u=https-3A__docs.google.com_docume…> Grouping: Risk Management SSR1 - Recs 25 - 27 [(tick)] Delivered to review team on 25 July 2017 Slides<https://urldefense.proofpoint.com/v2/url?u=https-3A__community.icann.org_di…> Meeting Archive<https://urldefense.proofpoint.com/v2/url?u=https-3A__community.icann.org_x_…> Questions<https://urldefense.proofpoint.com/v2/url?u=https-3A__docs.google.com_docume…> Grouping: ICANN GDD SSR1 - Recs 11, 12 [(tick)] Delivered to review team on 1 August 2017 Slides<https://urldefense.proofpoint.com/v2/url?u=https-3A__community.icann.org_di…> Meeting Archive<https://urldefense.proofpoint.com/v2/url?u=https-3A__community.icann.org_x_…> Questions<https://urldefense.proofpoint.com/v2/url?u=https-3A__docs.google.com_docume…> Grouping: ICANN Policy SSR1 - Recs 6, 13, 23 [(info)] Briefing not currently required per Co-Chairs Questions<https://urldefense.proofpoint.com/v2/url?u=https-3A__docs.google.com_docume…> Grouping: ICANN Communications SSR1 - Rec 3 [(info)] Briefing not currently required per Co-Chairs Questions<https://urldefense.proofpoint.com/v2/url?u=https-3A__docs.google.com_docume…> https://community.icann.org/display/SSR/Subgroup+%25231+-+SSR1+Review<https://urldefense.proofpoint.com/v2/url?u=https-3A__community.icann.org_di…> (includes following requests for information) Open Actions/Requests *To be provided once reasonable date is determined by appropriate subject-matter expert Item # Source of Request Date of Request Action Item Request Action Owner Anticipated Completion Date* Progress Notes Completed Response Completion Date 167.1 Email<https://urldefense.proofpoint.com/v2/url?u=http-3A__mm.icann.org_pipermail_…> 09 Oct 2017 SSR1 Rec 21: Is there a link to the template described in the staff implementation report? ICANN Org 167.2 Email<https://urldefense.proofpoint.com/v2/url?u=http-3A__mm.icann.org_pipermail_…> 09 Oct 2017 SSR1 Rec 21: Is there a plan for getting public comment on the template prior to using it for publishing information on budget and resource impacts related to SSR events? ICANN Org 167.3 Email<https://urldefense.proofpoint.com/v2/url?u=http-3A__mm.icann.org_pipermail_…> 09 Oct 2017 SSR1 Rec 21: Where is the budgetary information as it pertains to the SSR? And where is the cost benefit analysis for making these decisions? ICANN Org 167.4 Email<https://urldefense.proofpoint.com/v2/url?u=http-3A__mm.icann.org_pipermail_…> 09 Oct 2017 SSR1 Rec 21: Where is the evidence that a more structured internal process has been developed for SSR budgetary considerations? How do these decisions map onto ICANN’s planning framework and process? ICANN Org 167.5 Email<https://urldefense.proofpoint.com/v2/url?u=http-3A__mm.icann.org_pipermail_…> 09 Oct 2017 SSR1 Rec 21: Can ICANN provide an update as to the status of phase two (identifying mechanisms that that provide detailed public information on SSR-related budgets), and the steps still to be taken to ensure this recommendation is properly implemented? ICANN Org 167.6 Email<https://urldefense.proofpoint.com/v2/url?u=http-3A__mm.icann.org_pipermail_…> 09 Oct 2017 SSR1 Rec 22: Recommendation 22 is specifically about the new gTLD program. What documentation, specific to the new gTLD Program, on the organization, budget and resources needed to manage SSR issues in this area is available? ICANN Org 167.7 Email<https://urldefense.proofpoint.com/v2/url?u=http-3A__mm.icann.org_pipermail_…> 09 Oct 2017 SSR1 Rec 22: Since the publication of the SSR1 report, what materials have been published by the SSR team that are specific to the implementation of the new gTLD Program? How has that work been budgeted and resourced? ICANN Org 167.8 Email<https://urldefense.proofpoint.com/v2/url?u=http-3A__mm.icann.org_pipermail_…> 09 Oct 2017 SSR1 Rec 23: Recommendation 23 calls for a mechanism for Working Groups and Advisory Councils to support their decisions in an objective manner that is free from external or internal pressure. Where is such a mechanism documented – specifically regarding the work of SSAC and RSSAC? ICANN Org 167.9 Email<https://urldefense.proofpoint.com/v2/url?u=http-3A__mm.icann.org_pipermail_…> 09 Oct 2017 SSR1 Rec 25: Since the publication of the SSR1 Final Report, what mechanisms have been put into place to incorporate near and long-term risks into a formal, strategic Risk Management Framework for ICANN? ICANN Org 167.10 Email<https://urldefense.proofpoint.com/v2/url?u=http-3A__mm.icann.org_pipermail_…> 09 Oct 2017 SSR1 Rec 25: Since the Board approval of the 2014 Risk Management Framework provided by an external consultant, what further review, consultation or further work has been done on the approved Framework? ICANN Org 167.11 Email<https://urldefense.proofpoint.com/v2/url?u=http-3A__mm.icann.org_pipermail_…> 09 Oct 2017 SSR1 Rec 25: Please provide evidence of briefings to the Board Risk Committee on the risk assessment and proposed mitigation measures, as per Board Resolution dated 21 November 2013 https://features.icann.org/dns-risk-management-framework-report-and-impleme…<https://urldefense.proofpoint.com/v2/url?u=https-3A__features.icann.org_dns…>, and any follow up arising from such briefings. ICANN Org 167.12 Email<https://urldefense.proofpoint.com/v2/url?u=http-3A__mm.icann.org_pipermail_…> 09 Oct 2017 SSR1 Rec 25: What efforts have been made since 2014 to demonstrate that ICANNs risk management framework follows the standards of transparency and community participation, required by the SSR1? ICANN Org 167.13 Email<https://urldefense.proofpoint.com/v2/url?u=http-3A__mm.icann.org_pipermail_…> 09 Oct 2017 SSR1 Rec 25: Please clarify whether the portfolio of the new VP of Enterprise Risk Management extends into risks relating to ICANN's role with regard to the internet's set of unique identifiers, and future threats relating to unique identifiers? ICANN Org 167.14 Email<https://urldefense.proofpoint.com/v2/url?u=http-3A__mm.icann.org_pipermail_…> 09 Oct 2017 SSR1 Rec 25: Is there a final DNS risk assessment document (the linked to document is labelled 'draft') https://www.icann.org/en/system/files/files/dns-risk-consultation-28may14-e…<https://urldefense.proofpoint.com/v2/url?u=https-3A__www.icann.org_en_syste…>, and have there been any updates since 2014? ICANN Org 167.15 Email<https://urldefense.proofpoint.com/v2/url?u=http-3A__mm.icann.org_pipermail_…> 09 Oct 2017 SSR1 Rec 27: The staff report for implementation of SSR1’s Recommendations indicates that this Recommendation is complete. How did staff assess the “comprehensiveness” of the Risk Management Framework to come to this conclusion? ICANN Org 167.16 Email<https://urldefense.proofpoint.com/v2/url?u=http-3A__mm.icann.org_pipermail_…> 09 Oct 2017 SSR1 Rec 27: Please provide details of how the risk management has been staffed since SSR1 recommendations have been adopted by the Board. ICANN Org 146.1 Email<https://urldefense.proofpoint.com/v2/url?u=http-3A__mm.icann.org_pipermail_…> 25 Aug 2017 SSR1 Rec 1-20 General Question: What individual within the ICANN organization holds ultimate responsibility for implementation of SSR1 recommendations? ICANN Org 146.2 Email<https://urldefense.proofpoint.com/v2/url?u=http-3A__mm.icann.org_pipermail_…> 25 Aug 2017 SSR1 Rec 1-20 General Question: How has the responsibility for implementation of SSR1 recommendations flowed down through the organization, in terms of ownership, deliverables, performance objectives, etc.? ICANN Org 146.3 Email<https://urldefense.proofpoint.com/v2/url?u=http-3A__mm.icann.org_pipermail_…> 25 Aug 2017 SSR1 Rec 1-20 General Question: What mechanisms exist within the ICANN organization to provide regular (at least annual) reviews of SSR1 implementation, and to make appropriate adjustments to working practices and responsibilities? ICANN Org 146.4 Email<https://urldefense.proofpoint.com/v2/url?u=http-3A__mm.icann.org_pipermail_…> 25 Aug 2017 SSR1 Rec 1-20 General Question: What measures of success have been adopted within the ICANN organization for implementation of SSR1 recommendations, and how has the community been involved in defining or reviewing such measures? ICANN Org 146.5 Email<https://urldefense.proofpoint.com/v2/url?u=http-3A__mm.icann.org_pipermail_…> 25 Aug 2017 SSR1 Rec 1-20 General Question: How has the ICANN organization ensured that the implementation of SSR1 recommendations are embedded in standard operating procedures? ICANN Org 146.6 Email<https://urldefense.proofpoint.com/v2/url?u=http-3A__mm.icann.org_pipermail_…> 25 Aug 2017 SSR1 Rec 1-20 General Question: The SSR1 Report includes check marks for due dates under “Status of Deliverables” and the accompanying text often does not contain completion dates. Please provide a “due date” and completion date for each deliverable. ICANN Org 146.7 Email<https://urldefense.proofpoint.com/v2/url?u=http-3A__mm.icann.org_pipermail_…> 25 Aug 2017 SSR1 Rec 1: Since the version developed in 2012, what changes have been made to the SSR remit and technical mission statement? Who has made those changes? How has the community been allowed to review and comment on those changes? When were the last changes made to this statement? ICANN Org 146.8 Email<https://urldefense.proofpoint.com/v2/url?u=http-3A__mm.icann.org_pipermail_…> 25 Aug 2017 SSR1 Rec 1: How are the definitions of security, stability and resiliency consistently carried through into key documents, such as strategic plans and agreements with contracted parties? ICANN Org 146.9 Email<https://urldefense.proofpoint.com/v2/url?u=http-3A__mm.icann.org_pipermail_…> 25 Aug 2017 SSR1 Rec 2: Recommendation 2 directs that the definition of ICANN’s SSR remit and limited technical mission should be reviewed in order to maintain consensus and elicit feedback from the Community. Please provide details of reviews and community feedback that have occurred since 2013. ICANN Org 146.10 Email<https://urldefense.proofpoint.com/v2/url?u=http-3A__mm.icann.org_pipermail_…> 25 Aug 2017 SSR1 Rec 2: As ICANN’s SSR remit and limited technical mission statement has evolved, how has comment from the community been incorporated? For instance, is there a summary of the comments on the FY 2014 Framework? Where is this published? ICANN Org 146.11 Email<https://urldefense.proofpoint.com/v2/url?u=http-3A__mm.icann.org_pipermail_…> 25 Aug 2017 SSR1 Rec 3: In what way has ICANN publicized consistent terminology and descriptions related to ICANN’s SSR role and remit? Where are these published? ICANN Org 146.12 Email<https://urldefense.proofpoint.com/v2/url?u=http-3A__mm.icann.org_pipermail_…> 25 Aug 2017 SSR1 Rec 3: What terms related to SSR have been added to the ICANN public glossary? When were they added? ICANN Org 146.13 Email<https://urldefense.proofpoint.com/v2/url?u=http-3A__mm.icann.org_pipermail_…> 25 Aug 2017 SSR1 Rec 4: What accounts for the inconsistencies between the different documents on the ICANN website that describe the nature of the SSR relationships it has within the ICANN community? ICANN Org 146.14 Email<https://urldefense.proofpoint.com/v2/url?u=http-3A__mm.icann.org_pipermail_…> 25 Aug 2017 SSR1 Rec 4: In what way are these documents fulfilling the requirement to provide a single focal point for understanding the interdependencies between organizations? ICANN Org 146.15 Email<https://urldefense.proofpoint.com/v2/url?u=http-3A__mm.icann.org_pipermail_…> 25 Aug 2017 SSR1 Rec 4: What opportunities have there been for community input into the nature/definition of ICANN’s SSR relationships? ICANN Org 146.16 Email<https://urldefense.proofpoint.com/v2/url?u=http-3A__mm.icann.org_pipermail_…> 25 Aug 2017 SSR1 Rec 4:How is the document describing SSR relationships with partner organizations being updated? ICANN Org 146.17 Email<https://urldefense.proofpoint.com/v2/url?u=http-3A__mm.icann.org_pipermail_…> 25 Aug 2017 SSR1 Rec 6: What is the status of the document currently available at: https://www.icann.org/en/system/files/files/draft-rssac-ssac-roles-responsi…<https://urldefense.proofpoint.com/v2/url?u=https-3A__www.icann.org_en_syste…>? ICANN Org 146.18 Email<https://urldefense.proofpoint.com/v2/url?u=http-3A__mm.icann.org_pipermail_…> 25 Aug 2017 SSR1 Rec 6: The recommendation requires that ICANN should seek consensus for this document across both groups. Please provide documentation that this occurred. ICANN Org 146.19 Email<https://urldefense.proofpoint.com/v2/url?u=http-3A__mm.icann.org_pipermail_…> 25 Aug 2017 SSR1 Rec 6: What specific resourcing for RSSAC and SSAC appears in either the ICANN Operating Plan or the most recent budget? ICANN Org 146.20 Email<https://urldefense.proofpoint.com/v2/url?u=http-3A__mm.icann.org_pipermail_…> 25 Aug 2017 SSR1 Rec 7: How are the objectives specific to the SSR Framework documented in either the Operating Plan or the Strategic Plan? ICANN Org 146.21 Email<https://urldefense.proofpoint.com/v2/url?u=http-3A__mm.icann.org_pipermail_…> 25 Aug 2017 SSR1 Rec 7: Where are priorities for SSR activities and initiatives published? ICANN Org 146.22 Email<https://urldefense.proofpoint.com/v2/url?u=http-3A__mm.icann.org_pipermail_…> 25 Aug 2017 SSR1 Rec 7: In what ways have pragmatic cost-benefit and risk analysis informed the choice of priorities (if any)? ICANN Org 146.23 Email<https://urldefense.proofpoint.com/v2/url?u=http-3A__mm.icann.org_pipermail_…> 25 Aug 2017 SSR1 Rec 7: In addition to the ability to comment on draft ICANN budgets and plans, how is the community able to provide input into the objectives, initiatives and activities related to SSR at ICANN? ICANN Org 146.24 Email<https://urldefense.proofpoint.com/v2/url?u=http-3A__mm.icann.org_pipermail_…> 25 Aug 2017 SSR1 Rec 7: The SSR1 Report indicates that ICANN will “improve and publish a process for establishing updated SSR priorities and objectives.” Where has this been published? Was there a mechanism for community review of the process (if so, please provide links)? ICANN Org 146.25 Email<https://urldefense.proofpoint.com/v2/url?u=http-3A__mm.icann.org_pipermail_…> 25 Aug 2017 SSR1 Rec 9: SysTrust certification is referenced in the SSR1 Report as already in place. Please explain how it is claimed to be implementation of SSR1. ICANN Org 146.26 Email<https://urldefense.proofpoint.com/v2/url?u=http-3A__mm.icann.org_pipermail_…> 25 Aug 2017 SSR1 Rec 9: Beside the certifications/audits done for processes in IANA, what certification activities have been assessed or implemented related to SSR? ICANN Org 146.27 Email<https://urldefense.proofpoint.com/v2/url?u=http-3A__mm.icann.org_pipermail_…> 25 Aug 2017 SSR1 Rec 9: For staff working on SSR-related objectives, is there a certification plan in place as part of career/staff development? ICANN Org 146.28 Email<https://urldefense.proofpoint.com/v2/url?u=http-3A__mm.icann.org_pipermail_…> 25 Aug 2017 SSR1 Rec 9: When was the EFQM model implemented within ICANN, and please provide details of how the SSR Framework and standard operating procedures have been evaluated and updated in the light of EFQM adoption to demonstrate process improvements over time. ICANN Org 146.29 Email<https://urldefense.proofpoint.com/v2/url?u=http-3A__mm.icann.org_pipermail_…> 25 Aug 2017 SSR1 Rec 9: Has ICANN ever published a document that would include “a clear roadmap towards certification?” If so, where? Was there a mechanism by which community comment or engagement took place for such a document? ICANN Org 146.30 Email<https://urldefense.proofpoint.com/v2/url?u=http-3A__mm.icann.org_pipermail_…> 25 Aug 2017 SSR1 Rec 10: Please provide a summary of the number of complaints and enforcement actions against registries and registrars taken by contractual compliance on the basis of SSR obligations in the past 5 years. ICANN Org 146.31 Email<https://urldefense.proofpoint.com/v2/url?u=http-3A__mm.icann.org_pipermail_…> 25 Aug 2017 SSR1 Rec 10: To what extent does ICANN measure the incidence and impact of registration abuse and/or malicious conduct by contracted parties? ICANN Org 146.32 Email<https://urldefense.proofpoint.com/v2/url?u=http-3A__mm.icann.org_pipermail_…> 25 Aug 2017 SSR1 Rec 11: What measurements exist, and are used, for the effectiveness of mechanisms to mitigate domain name abuse, as required in recommendation 11? ICANN Org 146.33 Email<https://urldefense.proofpoint.com/v2/url?u=http-3A__mm.icann.org_pipermail_…> 25 Aug 2017 SSR1 Rec 11: Please provide details of the measures of success relating to new gTLDs and IDNs that expressly address SSR related program objectives. The link in the SSR1 Report did not resolve. ICANN Org 146.34 Email<https://urldefense.proofpoint.com/v2/url?u=http-3A__mm.icann.org_pipermail_…> 25 Aug 2017 SSR1 Rec 11: Please provide details of how SSR objectives are explicitly referenced in ICANN’s standard operating procedures, Service Level Agreements and monitoring, emergency back- end registry operators and data escrow, Trademark Clearinghouse, root zone scaling management, DNSSEC-related activities, and Compliance Dept. activities. ICANN Org 146.35 Email<https://urldefense.proofpoint.com/v2/url?u=http-3A__mm.icann.org_pipermail_…> 25 Aug 2017 SSR1 Rec 11: Noting IAG-CCT produced 70 metrics of which a single one (1.13) related to security issues; please provide details of the information gathered according to that metric. The web page of metrics and measures does not include information relating to 1.13. ICANN Org 146.36 Email<https://urldefense.proofpoint.com/v2/url?u=http-3A__mm.icann.org_pipermail_…> 25 Aug 2017 SSR1 Rec 11: The SSR1 Report refers to Specification 11 as applying to all new gTLD registries. Please provide reports on the number and type of security threats reported by registries under their Specification 11 obligations. Please give details of enforcement action(s) taken by ICANN’s contractual compliance department in relation to Specification 11. ICANN Org 146.37 Email<https://urldefense.proofpoint.com/v2/url?u=http-3A__mm.icann.org_pipermail_…> 25 Aug 2017 SSR1 Rec 11:How many new gTLD applications were failed (or placed in contention or required to take additional steps) on the basis of the (i) the security and stability review or (ii) the string similarity review. ICANN Org 146.38 Email<https://urldefense.proofpoint.com/v2/url?u=http-3A__mm.icann.org_pipermail_…> 25 Aug 2017 SSR1 Rec 11: In relation to the IDN ccTLD Fast Track, please give details of any strings that have failed those security and stability checks for security and stability related reasons rather than for consumer confusion – a CCT Review issue. ICANN Org 146.39 Email<https://urldefense.proofpoint.com/v2/url?u=http-3A__mm.icann.org_pipermail_…> 25 Aug 2017 SSR1 Rec 11: Considering staff and community feedback, how effective is the EPSRP mechanism (the second security and stability review in the IDN ccTLD Fast Track) in detecting and preventing stability and security issues other than consumer confusion? ICANN Org 146.40 Email<https://urldefense.proofpoint.com/v2/url?u=http-3A__mm.icann.org_pipermail_…> 25 Aug 2017 SSR1 Rec 11: Are there any updates on the status of Coordinated Vulnerability Disclosure Reporting since 2013? ICANN Org 146.41 Email<https://urldefense.proofpoint.com/v2/url?u=http-3A__mm.icann.org_pipermail_…> 25 Aug 2017 SSR1 Rec 11: Please provide a copy of the report referred to in bullet point 9 of recommendation 11 implementation in the Final Implementation Report. Given that the SSR objectives referred to in the report remain ‘to be defined’ please provide an explanation as to why this recommendation is said to be complete. ICANN Org 146.42 Email<https://urldefense.proofpoint.com/v2/url?u=http-3A__mm.icann.org_pipermail_…> 25 Aug 2017 SSR1 Rec 11: To what extent was the commissioning of the CDAR report, the Root Stability Study Workshop and the new gTLD program security and stability impact triggered by the SSR1 recommendation, and why is the SSR1 Report not referenced in the published materials relating to those initiatives? ICANN Org 146.43 Email<https://urldefense.proofpoint.com/v2/url?u=http-3A__mm.icann.org_pipermail_…> 25 Aug 2017 SSR1 Rec 12: In what way have the recommendations contained in the paper, “Identifier System Attack Mitigation Methodology,” been integrated into contracts, agreements and MoUs as envisioned by SSR1 recommendation 12? ICANN Org 146.44 Email<https://urldefense.proofpoint.com/v2/url?u=http-3A__mm.icann.org_pipermail_…> 25 Aug 2017 SSR1 Rec 12: Is there a central, up-to-date resource to see how the ISSSR team, and other professionals in the SSR field, have worked with SOs and ACs to identify additional, targeted best-practices for their constituents? Are there pointers to or records of those engagements? ICANN Org 146.45 Email<https://urldefense.proofpoint.com/v2/url?u=http-3A__mm.icann.org_pipermail_…> 25 Aug 2017 SSR1 Rec 12: What are some examples of significant MoUs with international entities that have SSR-practices embedded within them? ICANN Org 146.46 Email<https://urldefense.proofpoint.com/v2/url?u=http-3A__mm.icann.org_pipermail_…> 25 Aug 2017 SSR1 Rec 12: Is the only place where ICANN has documented work on recommendations for web application protection and development of resources for security awareness in the report from the 4th Global DNS Stability, Security and Resiliency Symposium? ICANN Org 146.47 Email<https://urldefense.proofpoint.com/v2/url?u=http-3A__mm.icann.org_pipermail_…> 25 Aug 2017 SSR1 Rec 12: Has there been a Global DNS Stability, Security and Resiliency Symposium since 2014? ICANN Org 146.48 Email<https://urldefense.proofpoint.com/v2/url?u=http-3A__mm.icann.org_pipermail_…> 25 Aug 2017 SSR1 Rec 13: In what way are the resources on the ICANN Security Awareness Resource Locator supposed to help Supporting Organizations secure collaborative community assets? ICANN Org 146.49 Email<https://urldefense.proofpoint.com/v2/url?u=http-3A__mm.icann.org_pipermail_…> 25 Aug 2017 SSR1 Rec 13: Have any recent steps been taken to encourage SOs and ACs to produce and publish best practices repositories for SSR-related information? Is the 2012 information on the ccTLD website the most recent example of SSR-related information published by a Supporting Organization? ICANN Org 146.50 Email<https://urldefense.proofpoint.com/v2/url?u=http-3A__mm.icann.org_pipermail_…> 25 Aug 2017 SSR1 Rec 14: When is the Annual Report for FY 2016-2017 going to be published as a community resource? ICANN Org 146.51 Email<https://urldefense.proofpoint.com/v2/url?u=http-3A__mm.icann.org_pipermail_…> 25 Aug 2017 SSR1 Rec 14: In the ICANN Engagement Interface, are all the SSR-Related outreach activities recorded or listed? ICANN Org 146.52 Email<https://urldefense.proofpoint.com/v2/url?u=http-3A__mm.icann.org_pipermail_…> 25 Aug 2017 SSR1 Rec 15: Is there any record of the methodology in the Coordinated Vulnerability Disclosure Document ever being invoked since 2013? ICANN Org 146..53 Email<https://urldefense.proofpoint.com/v2/url?u=http-3A__mm.icann.org_pipermail_…> 25 Aug 2017 SSR1 Rec 15: Are there any statistics available for the processes identified in the Coordinated Vulnerability Disclosure Document? ICANN Org 146.54 Email<https://urldefense.proofpoint.com/v2/url?u=http-3A__mm.icann.org_pipermail_…> 25 Aug 2017 SSR1 Rec 15: Are there any metrics or statistics available for ICANN’s engagement with operators and trusted community entities on DNS security threats and mitigation techniques? ICANN Org 146.55 Email<https://urldefense.proofpoint.com/v2/url?u=http-3A__mm.icann.org_pipermail_…> 25 Aug 2017 SSR1 Rec 16: What public engagement was done for the creation of the Frameworks and Annual Reports? ICANN Org 146.56 Email<https://urldefense.proofpoint.com/v2/url?u=http-3A__mm.icann.org_pipermail_…> 25 Aug 2017 SSR1 Rec 16: Is there a record showing how Community participation and input into the SSR Framework was incorporated? ICANN Org 146.57 Email<https://urldefense.proofpoint.com/v2/url?u=http-3A__mm.icann.org_pipermail_…> 25 Aug 2017 SSR1 Rec 16: Are the documents that used to be called Frameworks, now to be SSR Annual Reports? If so, what is the community engagement mechanism being used for the Annual Reports? ICANN Org 146.58 Email<https://urldefense.proofpoint.com/v2/url?u=http-3A__mm.icann.org_pipermail_…> 25 Aug 2017 SSR1 Rec 16: The implementation report specifically mentions capability building initiatives that would affect greater engagement in the development of the SSR Frameworks or Annual Reports. What initiatives have taken place? Who has participated? How have they expanded participation and input into the SSR Framework development process? ICANN Org 146.59 Email<https://urldefense.proofpoint.com/v2/url?u=http-3A__mm.icann.org_pipermail_…> 25 Aug 2017 SSR1 Rec 17: What is an example of a more structured internal process for showing how activities and initiatives relate to specific strategic goals, objectives and priorities in the SSR Framework? Has this been incorporated into the internal “At Task” system or other internal management systems? ICANN Org 146.60 Email<https://urldefense.proofpoint.com/v2/url?u=http-3A__mm.icann.org_pipermail_…> 25 Aug 2017 SSR1 Rec 17: Are there any statistics available for the processes identified in the Coordinated Vulnerability Disclosure Document? ICANN Org 146.61 Email<https://urldefense.proofpoint.com/v2/url?u=http-3A__mm.icann.org_pipermail_…> 25 Aug 2017 SSR1 Rec 17: Are there any metrics or statistics available for ICANN’s engagement with operators and trusted community entities on DNS security threats and mitigation techniques? ICANN Org 146.62 Email<https://urldefense.proofpoint.com/v2/url?u=http-3A__mm.icann.org_pipermail_…> 25 Aug 2017 SSR1 Rec 19: In ICANN’s Portfolio Management system, the only SSR-related activity that appears is KSK Rollover. Is there another place where SSR-activities are tracked so that the community can see progress on current year activities (for instance the KPI Dashboard seems to be entirely related to the OCTO’s work with the technical and public safety communities)? ICANN Org 146.63 Email<https://urldefense.proofpoint.com/v2/url?u=http-3A__mm.icann.org_pipermail_…> 25 Aug 2017 SSR1 Rec 20: Provide documentation of, and links to, mechanisms that have been used since 2012 to provide more detailed public information on SSR-related budgets and expenditures across multiple ICANN departments ICANN Org 146.64 Email<https://urldefense.proofpoint.com/v2/url?u=http-3A__mm.icann.org_pipermail_…> 25 Aug 2017 SSR1 Rec 20: Have any after-event reports (for relevant threats) been published that include budget and resource impacts related to managing the event? What would be an example of this kind of after-event-report? ICANN Org 101.1 Plenary Meeting 21<https://urldefense.proofpoint.com/v2/url?u=https-3A__community.icann.org_di…> 01 Aug 2017 Rec 11: What was happening in the 5 years between when the recommendation was approved by the Board and when a draft consultant report was posted in April 2017? ICANN Org 101.2 Plenary Meeting 21<https://urldefense.proofpoint.com/v2/url?u=https-3A__community.icann.org_di…> 01 Aug 2017 Rec 11: On the status and deliverables of Rec 11 it says that ICANN has implemented measures of success for the gTLDs, but we haven’t seen how you’ve implemented measures of success for new gTLDs and IDNs. That’s the first check mark, but what we’ve been provided with is a draft report of some ideas that you could do. How is that considered full implementation of this recommendation? ICANN Org 101.5 Plenary Meeting 21<https://urldefense.proofpoint.com/v2/url?u=https-3A__community.icann.org_di…> 01 Aug 2017 Rec. 11: The SSR1 review team called out a number of activities that were operational and within staff’s purview and contained in the SSR framework and called for implementation of measurements and metrics. Was that work done and is it captured anywhere? To clarify, as part of the SSR1 report related to rec 11, the SSR1 review team noted ICANN administration of the new gTLD Program, IDN program, significant SSR related issues that are in the framework. They called for more specific goals, measurements and impact assessment. Was that work done and is it captured somewhere else? ICANN Org Clarity requested via email<https://urldefense.proofpoint.com/v2/url?u=http-3A__mm.icann.org_pipermail_…>. Awaiting input from Review Team. 101.6 Plenary Meeting 21<https://urldefense.proofpoint.com/v2/url?u=https-3A__community.icann.org_di…> 01 Aug 2017 Rec. 11: Is there more information on the steps that ICANN has taken in the past five years to facilitate data access and activities that involved other entities that had ownership or responsibilities on related activities? ICANN Org Clarity requested via email<https://urldefense.proofpoint.com/v2/url?u=http-3A__mm.icann.org_pipermail_…>. Awaiting input from Review Team. 101.7 Plenary Meeting 21<https://urldefense.proofpoint.com/v2/url?u=https-3A__community.icann.org_di…> 01 Aug 2017 Rec 11: Broadly, in looking at the dashboard for rec 11 and all the checkmarks including operational items, it’s really unclear how staff defined and measured success related to SSR. It’s hard to see how the basic sprit of this recommendation was implementation, especially with an idea paper from a consultant. But in terms of the last 5 years and what staff did to implement, it’s unclear. Can you gather more information and provide more clarity and facts? ICANN Org 101.8 Plenary Meeting 21<https://urldefense.proofpoint.com/v2/url?u=https-3A__community.icann.org_di…> 01 Aug 2017 Rec 12: With regards to establishing best practices and integrating these into agreements to which ICANN enters: It’s linked to a paper that raises a whole host of issues and addresses proposed activities but it’s unclear how that then relates to integrating those into agreements into which ICANN has entered over the past 5 years. Can you provide more specific information on how best practices are reflected in agreements that ICANN has entered into? ICANN Org 101.9 Plenary Meeting 21<https://urldefense.proofpoint.com/v2/url?u=https-3A__community.icann.org_di…> 01 Aug 2017 Rec 12: ‘Addressing SSR practices in MOUs’ links to a page that holds all of the MOUs. Can you provide some quantification of SSR-related practices in MOUs and more information on which ones contain SSR-related practices, which practices they contain, and how all that’s tracked or the implementation is assessed? ICANN Org Clarity requested via email<https://urldefense.proofpoint.com/v2/url?u=http-3A__mm.icann.org_pipermail_…>. Awaiting input from Review Team. 101.11 Plenary Meeting 21<https://urldefense.proofpoint.com/v2/url?u=https-3A__community.icann.org_di…> 01 Aug 2017 Rec 12: Which sections of the revised new gTLD registry agreement does OCTO staff feel advance SSR best practices and objectives? ICANN Org Completed Actions/Requests Item # Source of Request Date of Request Action Item Request Action Owner Anticipated Completion Date* Progress Notes Completed Response Completion Date 101.10 Plenary Meeting 21<https://urldefense.proofpoint.com/v2/url?u=https-3A__community.icann.org_di…> 01 Aug 2017 Rec 12: Is there any quantification or more detailed information on what the working relationship with the APWG has yielded? ICANN Org Question answered via email<https://urldefense.proofpoint.com/v2/url?u=http-3A__mm.icann.org_pipermail_…>. 09 Aug 2017 101.3 Plenary Meeting 21<https://urldefense.proofpoint.com/v2/url?u=https-3A__community.icann.org_di…> 01 Aug 2017 Rec 11: Do you think it is ICANN staff’s responsibility to gather, analyze and publish this data or do you feel that it’s ICANN’s responsibility to facilitate others to do that? ICANN Org Question answered during the call. See meeting record<https://urldefense.proofpoint.com/v2/url?u=https-3A__community.icann.org_di…>. 01 Aug 2017 101.4 Plenary Meeting 21<https://urldefense.proofpoint.com/v2/url?u=https-3A__community.icann.org_di…> 01 Aug 2017 Rec 11: In a commercialized world of DNS service provision where data is considered to be a corporate asset, do you feel that either ICANN or the community at large have access to meaningful metrics? I cite the barriers that exist on information on root servers. Is this a barrier to the entire objective, that access to data appears to be challenging? ICANN Org Geoff Huston (asker) clarified that he feels this is a question for the review team to answer, not ICANN Org. 01 Aug 2017 101.12 Plenary Meeting 21<https://urldefense.proofpoint.com/v2/url?u=https-3A__community.icann.org_di…> 01 Aug 2017 Rec 12: What has changed after the implementation of Rec#12 as compared with the past? ICANN Org Question answered during the call. See meeting record<https://urldefense.proofpoint.com/v2/url?u=https-3A__community.icann.org_di…>. 01 Aug 2017 https://community.icann.org/display/SSR/Tracking+Tool<https://urldefense.proofpoint.com/v2/url?u=https-3A__community.icann.org_di…> (I don’t know if this page is duplicative or requests/questions are included above?)

1 0

Apologies for today
by Norm Ritchie Sept. 13, 2018

Sept. 13, 2018

Hi all, I will not be able to attend today’s conference call. I'm interested and supportive of the recommendation from the CCT RT. If the group decides to act upon it, count me in. Also, for staff’s agenda item, I have not yet heard from ICANN travel regarding Barcelona. Cheers, Norm

1 0

SSR2 RT Engagement Session | ICANN63 Barcelona | 23 October 2018 - Placeholder invite pending confirmation
by MSSI Secretariat Sept. 11, 2018

Sept. 11, 2018

This is a placeholder invite pending confirmation.

1 0

SSR2 - NCSG (NCUC and NPOC) MEETING PLACEHOLDER | ICANN63 Barcelona | 23 October 2018
by MSSI Secretariat Sept. 10, 2018

Sept. 10, 2018

Details TBD.

1 0

FW: [Ssr2-coordination] SSR2 Restart, Terms of Reference Update
by Jennifer Bryce Sept. 10, 2018

Sept. 10, 2018

Dear all I’m forwarding the below for your information. Best, Jennifer From: ssr2-coordination <ssr2-coordination-bounces(a)icann.org> on behalf of Russ Housley <housley(a)vigilsec.com> Date: Monday, September 10, 2018 at 1:21 PM To: Bruna Martins dos Santos <bruna.mrtns(a)gmail.com> Cc: ssr2-coordination <ssr2-coordination(a)icann.org>, Joan Kerr <joankerr(a)fbsc.org>, Maryam Bakoshi <maryam.bakoshi(a)icann.org>, farzaneh badii <farzaneh.badii(a)gmail.com>, Rafik Dammak <rafik.dammak(a)gmail.com> Subject: Re: [Ssr2-coordination] SSR2 Restart, Terms of Reference Update Bruna: Thanks. We will plan to join you at 18:00 on Oct 23rd. So far, there are no conflicts, and I will let you know if any surface. Russ SSR2 Chair On Sep 10, 2018, at 3:37 PM, Bruna Martins dos Santos <bruna.mrtns(a)gmail.com<mailto:bruna.mrtns@gmail.com>> wrote: Dear Jennifer and SSR2 leadership, Thank you very much for the updates on the status of the RT. In light of the outreach activities mentioned in the email we discussed the possibility of inviting the review team to our stakeholder group meeting - so both our constituencies (NCUC and NPOC) are able to hear on the updated scope/terms of reference and reviewed work to date. NCSG Open Meeting is scheduled on Oct 23rd, from 15h15 to 18h30 - and we thought of reserving a 30 min slot starting at 18h for the SSR2. Would that be of interest ? Best, Bruna Santos NCUC Chair Em qua, 5 de set de 2018 às 15:23, Jennifer Bryce <jennifer.bryce(a)icann.org<mailto:jennifer.bryce@icann.org>> escreveu: Sent on behalf of Russ Housley, Chair, SSR2 Review Team to SO, AC, SG, C Leaders and ICANN Board Dear all, On behalf of the ICANN Security, Stability, and Resiliency of the Domain Name System (SSR2) Review Team, I am pleased to inform you that the Review Team has worked with the appointed facilitator to successfully address the work outlined in your 13 March 2018 note [icann.org]<https://urldefense.proofpoint.com/v2/url?u=https-3A__www.icann.org_en_syste…>: a) on-boarding new members who have joined since the "pause" and agreeing on leadership from the current membership; b) helping the group to work through concerns around membership and scope as identified in a confidential survey conducted by the SO/AC Chairs shortly after the pause; and c) helping the RT to identify ways to reach consensus. On 5 June 2018, we were notified that ICANN had engaged an external professional, Phil Khoury, to “facilitate the transition process and help the SSR2 Review Team in restarting and moving forward with its work.” The Review Team worked with Phil in relaunching our activities and planning an in-person meeting. The Review Team reconvened after being paused since October 2017 and held an in-person meeting on 22-24 August in Washington, DC. The Review Team has on-boarded new members, selected leadership, reviewed work to date, and updated our scope/terms of reference<https://community.icann.org/download/attachments/66061139/SSR2-Terms%20of%2…> (attached). We are refreshing our workplan and outreach/communication plan, and then we are moving forward with our substantive work. More details of our August meeting and ongoing work are described in the attached blog, which will be publicly posted. The Review Team unanimously agreed on leadership (in addition to me serving as Chair, we have Vice Chairs - Denise Michel, Eric Osterweil, Laurin Weissinger), and unanimously approved an updated scope/terms of reference, which is attached and will be publicly posted on our wiki<https://community.icann.org/display/SSR/SSR2+Review>. We welcome your input on this and other SSR2 efforts. The Review Team is looking forward to efficiently progressing its work. We plan to next meet at ICANN63 in Barcelona. Given the past delays, we feel it’s imperative that the Review Team meet at ICANN63 to advance our work and engage with community members. We would greatly appreciate your help in ensuring that a room is reserved ASAP for our 15-member meeting sessions on 21 and 24 October. To hold time on Review Team members’ schedules and to save ICANN funds, we need to promptly lock-in this meeting and arrange travel. Thank you for your support for the Review Team’s important, bylaw-mandated work. Please don’t hesitate to contact me and the Review Team if you need additional information or wish to share your thoughts. -- Jennifer Bryce Senior Reviews Coordinator Internet Corporation for Assigned Names and Numbers (ICANN) Email: jennifer.bryce(a)icann.org<mailto:jennifer.bryce@icann.org> Skype: jennifer.bryce.icann www.icann.org [icann.org]<https://urldefense.proofpoint.com/v2/url?u=http-3A__www.icann.org_&d=DwMFaQ…> _______________________________________________ ssr2-coordination mailing list ssr2-coordination(a)icann.org<mailto:ssr2-coordination@icann.org> https://mm.icann.org/mailman/listinfo/ssr2-coordination

1 0

FYI - CCT Final Report
by Alice Jansen Sept. 10, 2018

Sept. 10, 2018

Dear SSR2, For your information, the Competition, Consumer Trust & Consumer Choice Review Team (CCT) has adopted its Final Report and submitted it to the ICANN Board. You can read it at: https://community.icann.org/download/attachments/58727456/CCT%20Final%20Rep… The CCT leadership has been made aware of the SSR2’s request for a discussion at ICANN63. More information will be shared as soon as available. Kind regards Alice

2 1

Fwd: Get ready for the KSK rollover
by Russ Housley Sept. 10, 2018

Sept. 10, 2018

Since IANA was a previous discussion topic, the review team may be interested in this guide. Russ > From: ICANN NA <icann.communications(a)communications.icann.org> > Subject: Get ready for the KSK rolloverDate: September 10, 2018 at 11:04:32 AM EDT > To: housley(a)vigilsec.com > Reply-To: icann.communications(a)communications.icann.org <mailto:icann.communications@communications.icann.org> > > ICANN Publishes Comprehensive Guide on What to Expect During the Root KSK Rollover > What will happen when ICANN, for the first time ever, changes the cryptographic keys that helps protect the Domain Name System (DNS)? To answer that question, the ICANN organization has just published a guide to let people know what to expect. It describes which users are most likely to see problems, and among those - what types of issues they will face and the timing of when those issues might appear. > > The operators of validating resolvers will likely derive the most benefit from the guide, as they seek clear direction on what to look for once the rollover is complete. Others who may benefit from the guide are: non-technical journalists, bloggers, researchers, and others who intend to write about the rollover before, during, and after the event. The guide can be accessed here <http://r20.rs6.net/tn.jsp?f=0015oWF5A6zdar5QZqh5VuSixY7Zsqij6k0f_rHw3D-5AOH…>.

1 0

Re: [Ssr2-review] Facilitator Report
by Phil Khoury Sept. 10, 2018

Sept. 10, 2018

With thanks to Norm and Steve – and my apologies. Herewith the attachment. Groan. Phil From: Norm Ritchie <norm(a)webcatcher.ca> Date: Monday, 10 September 2018 at 10:27 am To: Phil Khoury <phil(a)crkhoury.com> Subject: Re: [Ssr2-review] Facilitator Report Hey, No attachment, Phil :) Best, Norm On Sep 9, 2018, at 8:23 PM, Phil Khoury <phil(a)crkhoury.com> wrote: Hello all, I have been much impressed with the level of activity since Washington (and also much impressed that I am not having to be up at 1am for plenary calls)! Please find attached my draft report for the SO/AC Chairs and the Board (you may recall that I promised to circulate to the team before submitting it). Obviously, I can't enter into a long drafting exchange with the whole team – but if there are major errors or omissions, I would like to know. I am going on leave at end of the week, so I have to get this sent no later than Thursday morning UTC. My thanks to all of you for your support in my time with the team – I very much enjoyed the assignment and I wish you all the very best for the challenges ahead. I will read your report with great interest. Regards Phil Phil Khoury Facilitator – ICANN SSR2 phil(a)crkhoury.com tel +61 3 9421 3111 mob +61 431 500 999 (also WhatsApp) skype phil.khoury cameron. ralph. khoury Cameron Ralph Pty Ltd | PO Box 307 East Melbourne VIC 8002 | Australia This email may contain confidential information. If received in error, please let us know us by reply email or phone and delete this email. _______________________________________________ Ssr2-review mailing list Ssr2-review(a)icann.org https://mm.icann.org/mailman/listinfo/ssr2-review

2 1

Facilitator Report
by Phil Khoury Sept. 10, 2018

Sept. 10, 2018

Hello all, I have been much impressed with the level of activity since Washington (and also much impressed that I am not having to be up at 1am for plenary calls)! Please find attached my draft report for the SO/AC Chairs and the Board (you may recall that I promised to circulate to the team before submitting it). Obviously, I can't enter into a long drafting exchange with the whole team – but if there are major errors or omissions, I would like to know. I am going on leave at end of the week, so I have to get this sent no later than Thursday morning UTC. My thanks to all of you for your support in my time with the team – I very much enjoyed the assignment and I wish you all the very best for the challenges ahead. I will read your report with great interest. Regards Phil Phil KhouryFacilitator – ICANN SSR2 phil(a)crkhoury.com tel +61 3 9421 3111 mob +61 431 500 999 (also WhatsApp)skype phil.khoury cameron. ralph. khoury Cameron Ralph Pty Ltd | PO Box 307 East Melbourne VIC 8002 | Australia This email may contain confidential information. If received in error, please let us know us by reply email or phone and delete this email.

1 0