- Ssr2-review - lists.icann.org

Final Draft - Sub Topic 2 – ICANN SSR / Audit Plan and Follow Up
by Boban Krsic Aug. 23, 2017

Aug. 23, 2017

Dear all, As mentioned last week, Žarko and I had a workshop last Friday and worked also on some SSR2 stuff. We finalized the draft of our sub group item list and drafted an audit plan with specific topics and questions for the forthcoming workshop. What we did in detail: * Rearrangement of the existing topics and work items from Sub Topic 2 – ICANN SSR in the document “SSR2 Sub topics” [1] * Consensus on the following seven key action steps - transitionally in a new document “SSR2_sub_topic_ICANN.SSR” [2]; we will merge them with “SSR2 Sub topics” [1] after a final feedback from the review team. 1. Perform a comprehensive assessment of ICANN's Information Security Management System. 2. Perform a comprehensive assessment of ICANN's Business Continuity Management System. 3. Perform a comprehensive assessment of ICANN's Risk Management Methodology and Framework. 4. Perform an assessment how effectively ICANN has implemented its Security Incident Management and Response Processes to reduce (proactive and reactive) the probability of DNS-related incidents. 5. Perform a comprehensive assessment of internal security, stability and resiliency of ICANN's operation processes and services. 6. Perform an assessment how effectively ICANN has implemented its processes around vetting registry operators and services concerning the New gTLD Delegation and Transition process. 7. Perform an assessment how effectively ICANN has implemented its processes to ensure compliance regarding registrar agreements and the consensus policies. * Drafted an audit plan [5] for planning purposes, to indicate the right persons at ICANN and to help us in the execution of the workshop - based on the structure from “SSR2_sub_topic_ICANN.SSR” [2] and with the content of the following both documents: * SSR2-ICANNSecurity-workplan-draft [3] * ICANN Security Questions for CIO [4] We will circulate the link of the draft after upload it to google docs - not later than Tuesday afternoon. What are the next steps: * Please provide final feedback on “SSR2_sub_topic_ICANN.SSR” [2] until August 28. We will consolidate potential feedback and finalize the document on Tuesday, August 29. * Please provide final feedback on the audit plan [5] until August 28. We will consolidate potential feedback and finalize the document on Tuesday, August 29. * MSSI Secretariat, You will be able to identify all responsible staff owners with the first draft of the document [5]. Please confirm their availability asap. We should be able to organize parallel tracks on the two workshop days. Thanks a lot and wishing all a relaxing Sunday. - Boban. [1] https://docs.google.com/document/d/1DWoT4VoMlT5Dvcy78EXI-O5tQFqa9CblwsDEV6g… [2] https://docs.google.com/document/d/145i1Q-ZXgsvuwpDIUi_jJt_WJlaCRoxBoh2vKtN… [3] https://docs.google.com/spreadsheets/d/1vs1nyYdmg27cHXhM_qBaMOjmMEuNMst24cl… [4] https://docs.google.com/document/d/1QmUaAufCfYtEs0cXS-fTxwtkxHZMrBj1IwGIe33… [5] URL will follow -- Boban Kršić Chief Information Security Officer DENIC eG, Kaiserstraße 75-77, 60329 Frankfurt am Main, GERMANY E-Mail: krsic(a)denic.de, Fon: +49 69 272 35-120, Fax: -248 Mobil: +49 172 67 61 671 https://www.denic.de X.509 Key-ID: 00A54FCB79884413A4 Fingerprint: 9D37 F593 AF9A D766 FAB4 8B88 D49A 2716 PGP Key-ID: 0x43C89BA9 Fingerprint: B974 E725 FEF7 CB3A E452 BEE0 5B80 73E9 43C8 9BA9 Angaben nach § 25a Absatz 1 GenG: DENIC eG (Sitz: Frankfurt am Main) Vorstand: Helga Krüger, Martin Küchenthal, Andreas Musielak, Dr. Jörg Schweiger Vorsitzender des Aufsichtsrats: Thomas Keller Eingetragen unter Nr. 770 im Genossenschaftsregister, Amtsgericht Frankfurt am Main

4 7

SSR2 Actions: 22 Aug.
by Jennifer Bryce Aug. 23, 2017

Aug. 23, 2017

Hi all, Here are the draft action items from the Tuesday 22 August SSR2 plenary call. The record of the meeting can be found on the SSR2 wiki here.<https://community.icann.org/display/SSR/SSR2+Meeting+%2324+-++22+August+201…> Plenary Action Items/Requests #24 Action/Request Owner Expected Completion Date Review Team to submit consolidated input and edits on the RFP overview document and confirm their approval for ICANN organization to initiate a process to engage a contractor, based on qualifications, scope of work, timeline, deliverables and other essential components included in the RFP overview document modified by the Review Team (the cost not to exceed $50,000) SSR2-RT 25 August 2017 Review Team members to volunteer if they feel they can contribute to the SSR1 implementation subgroup. SSR2-RT Provide briefing to Review Team on NDA documents, when available. Kerry-Ann, James Confirm Review Team’s approval of proposed ICANN SSR subtopic meeting in Los Angeles, 9-10 October. SSR2-RT 22 August 2017 -- Jennifer Bryce Senior Reviews Coordinator Internet Corporation for Assigned Names and Numbers (ICANN) Email: jennifer.bryce(a)icann.org Skype: jennifer.bryce.icann www.icann.org

1 0

Re: [Ssr2-review] [EXT] Re: Draft agenda, SSR2 Team call Tues 22 August 21:00 UTC
by Barrett, Kerry-Ann Aug. 23, 2017

Aug. 23, 2017

Denise, We can also answer any questions or concerns that the team may have but it may be better management of time if when we receive the document from Legal we brief the wider group on the logic and provide an overview of the process. Regarding *Alain, James & Kerry: please confirm your participation & share any materials in advance that you’d like the Team review.*, staff already circulated on my behalf the updated work items and what we needed was sign off from the plenary before plotting a way forward. Thanks Sincerely, Kerry-Ann Barrett Cyber Security Policy Specialist Inter-American Committee against Terrorism Secretariat for Multidimensional Security Organization of American States 1889 F Street N.W., Washington, D.C. 20006 T. 202-370-4675 F. 202-458-3857 kabarrett(a)oas.org<mailto:kabarrett@oas.org> www.oas.org/cyber<http://www.oas.org/cyber> Register to our distribution list here!<http://oas.us11.list-manage.com/subscribe?u=353ff0663258ae5a775d460db&id=10…> From: ssr2-review-bounces(a)icann.org [mailto:ssr2-review-bounces@icann.org] On Behalf Of James Gannon Sent: Monday, August 21, 2017 2:26 PM To: Denise Michel <denisemichel(a)fb.com>; SSR2 <ssr2-review(a)icann.org> Subject: [EXT] Re: [Ssr2-review] Draft agenda, SSR2 Team call Tues 22 August 21:00 UTC Hi All, Will be attending yes, final updates to the NDA will be made by ICANN legal this week, following the meeting myself and Kerry-Ann had with them on Friday as planned, and then sent to the full group for ratification and signatures. So I don’t know if there is much to be gained with a briefing other than its coming this week. Kerry Ann do you have anything to add? James From: ssr2-review-bounces(a)icann.org<mailto:ssr2-review-bounces@icann.org> [mailto:ssr2-review-bounces@icann.org] On Behalf Of Denise Michel Sent: 21 August 2017 19:13 To: SSR2 <ssr2-review(a)icann.org<mailto:ssr2-review@icann.org>> Subject: [Ssr2-review] Draft agenda, SSR2 Team call Tues 22 August 21:00 UTC Hi, All. The proposed agenda for our upcoming call is included below. As always, suggested edits are welcome. Per previous emails/discussions, SSR1 implementation will be a focus of this call, along with a discussion about NDAs. *Alain, James & Kerry: please confirm your participation & share any materials in advance that you’d like the Team review.* Thanks Denise SSR2 Plenary Call: Tuesday 22 August 21:00 UTC · Updated SOIs & note apologies/absences · SSR1 Implementation o Status of Subgroup work (Alain) - Assemble data - Preliminary review of the implementation of the recommendations - Agree on ToR for the consultant (for gap analysis) - Select/work with consultant to ensure work performed as required - Review consultant report and engage the global team o Challenges, Actions Needed, Work plan Updates · Non-Disclosure Agreements (NDAs) (Kerry-Ann & James) · AOB Denise Michel Domain Name System Strategy & Management Facebook, Inc. denisemichel(a)fb.com<mailto:denisemichel@fb.com>

2 1

Connectivity - SSR2 Review Team Meeting# 24 | Tuesday, 22 August 2017 @ 21:00 UTC
by MSSI Secretariat Aug. 22, 2017

Aug. 22, 2017

Hello SSR2 Review Team - Good day. I just wanted to touch base regarding connectivity for our next SSR2 Meeting Call scheduled for Tuesday, 22 August 2017 @ 21:00 UTC. We have conquered many of the noise disturbances previously present and would like to ensure continued connectivity on future calls. For the best results in regions with connectivity, we suggest doing the following... * Connect to the Adobe Connect (https://participate.icann.org/ssrreview) 20-30 minutes before the scheduled call - the Adobe Connect room will be open and I will be available to assist you - in addition we can resolve any microphone/static/connection issues ahead of time - including connecting with international operators if need be. The goal is to have all connection concerns resolved by the top of the hour for the benefit of the team. * Be located (if possible) in an area that has proper broadband connection and is quiet - thus creating a strong signal connection, making it possible to see and hear in the Adobe Connect Room. * Feel free to Skype me either before, during or after the call - my skype address is yvette.guigneaux.icann - this way I can respond to you almost immediately for whatever you may need - including having the Adobe Connect Room dial out to you if need be. As your SSR2 Review Team Secretariat, I am determined to create an atmosphere where you can clearly participate in the Adobe Connect Room. Thank you everyone and I look forward to seeing you all on our upcoming call. :) Kind Regards, Yvette Guigneaux (MSSI) Multistakeholder Strategy & Strategic Initiatives Projects & Operations Assistant. ICANN - Internet Corporation for Assigned Names and Numbers Email: yvette.guigneaux(a)icann.org<mailto:yvette.guigneaux@icann.org> Cell: +1-310-460-8432 Skype: yvette.guigneaux.icann www.icann.org<http://www.icann.org/> [cid:image001.png@01D31B44.2696CEE0]

1 0

Delayed
by Gannon, James-1 Aug. 22, 2017

Aug. 22, 2017

Hi all, sat at a gate in LHR waiting for a delayed flight. I am 50/50 on landing in time for the call. If Kerry Ann is on hopefully she might be able to brief on NDA if required Sent from my iPhone Novartis Ireland Ltd. Registered No. 11931, Ireland. Registered Office: The Vista Building, Elm Park Business Park, Merrion Road, Dublin 4. DO4 A9N6, Ireland. Confidentiality Notice: This e-mail message, including any attachments, is for the sole use of the intended recipient(s) and may contain confidential and privileged information. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply e-mail and destroy all copies of the original message.

1 0

Re: [Ssr2-review] Draft agenda, SSR2 Team call Tues 22 August 21:00 UTC
by Jennifer Bryce Aug. 22, 2017

Aug. 22, 2017

Hi all, Please find draft slides attached to accompany the agenda, below. Jennifer From: <ssr2-review-bounces(a)icann.org> on behalf of Denise Michel <denisemichel(a)fb.com> Date: Monday, August 21, 2017 at 11:13 AM To: SSR2 <ssr2-review(a)icann.org> Subject: [Ssr2-review] Draft agenda, SSR2 Team call Tues 22 August 21:00 UTC Hi, All. The proposed agenda for our upcoming call is included below. As always, suggested edits are welcome. Per previous emails/discussions, SSR1 implementation will be a focus of this call, along with a discussion about NDAs. *Alain, James & Kerry: please confirm your participation & share any materials in advance that you’d like the Team review.* Thanks Denise SSR2 Plenary Call: Tuesday 22 August 21:00 UTC * Updated SOIs & note apologies/absences * SSR1 Implementation o Status of Subgroup work (Alain) - Assemble data - Preliminary review of the implementation of the recommendations - Agree on ToR for the consultant (for gap analysis) - Select/work with consultant to ensure work performed as required - Review consultant report and engage the global team * Challenges, Actions Needed, Work plan Updates * Non-Disclosure Agreements (NDAs) (Kerry-Ann & James) * AOB Denise Michel Domain Name System Strategy & Management Facebook, Inc. denisemichel(a)fb.com<mailto:denisemichel@fb.com>

2 1

working on the new WORKPLAN for the SSR1 subgroup
by ALAIN AINA Aug. 22, 2017

Aug. 22, 2017

Dear co- chairs, I understood from the last call: - we keep the SSR1 sub-group - may get extra member to join - sub-group to be the main contact to the Gab analysis consultant and its works I would like to know if the above are correct as i am updating the Work plan for the group. Merci —Alain

2 2

Draft agenda, SSR2 Team call Tues 22 August 21:00 UTC
by Denise Michel Aug. 21, 2017

Aug. 21, 2017

Hi, All. The proposed agenda for our upcoming call is included below. As always, suggested edits are welcome. Per previous emails/discussions, SSR1 implementation will be a focus of this call, along with a discussion about NDAs. *Alain, James & Kerry: please confirm your participation & share any materials in advance that you’d like the Team review.* Thanks Denise SSR2 Plenary Call: Tuesday 22 August 21:00 UTC * Updated SOIs & note apologies/absences * SSR1 Implementation * Status of Subgroup work (Alain) - Assemble data - Preliminary review of the implementation of the recommendations - Agree on ToR for the consultant (for gap analysis) - Select/work with consultant to ensure work performed as required - Review consultant report and engage the global team * Challenges, Actions Needed, Work plan Updates * Non-Disclosure Agreements (NDAs) (Kerry-Ann & James) * AOB Denise Michel Domain Name System Strategy & Management Facebook, Inc. denisemichel(a)fb.com<mailto:denisemichel@fb.com>

2 1

Sub-Group calls and full Team calls
by Denise Michel Aug. 18, 2017

Aug. 18, 2017

Dear All: Following-up on our last Team call discussion and the action item noted below, your faithful co-chairs would like to confirm where we are on sub-groups and calls: - We are keeping the sub-groups but suspending separate sub-group calls for now (for the most part). - We’ll rotate through the sub-group topics on subsequent full Team calls. A proposed schedule is below **input on this schedule is welcome; happy to try to accommodate changes** - The IANA and ICANN SSR sub-groups have specific work streams they’re addressing and may have additional calls as needed (email staff and co-chairs). - None of this should prevent Team members from working together! Use the email list, discuss work items with interested Team members as opportunities arise and bring results back to Team; more calls can be scheduled if needed but for now let’s use the full Team calls to increase Team member engagement and visibility into various issues. Suggested Schedule: - Aug 22: SSR1 Implementation - Aug 29: DNS SSR - Sept 5: ICANN SSR - Sept 12: Future Challenges - Sept 19: IANA Transition Thank you. Denise Denise Michel Domain Name System Strategy & Management Facebook, Inc. denisemichel(a)fb.com<mailto:denisemichel@fb.com> From: <ssr2-review-bounces(a)icann.org> on behalf of Denise Michel <denisemichel(a)fb.com> Date: Wednesday, August 16, 2017 at 9:13 AM To: SSR2 <ssr2-review(a)icann.org> Subject: [Potential Spoof] Re: [Ssr2-review] [Icannsecurity-ssr2-rt] Action items: 14 August Team Members: Please note additional action items below. Your action is needed. Jennifer: Thank you for this draft; please add the following items to the Task Tracker, as well as additional requests staff has received from co-chairs and Team members. ACTION Sub-team realignment - (Team Members) Reply on email list to Eric’s Aug 14 note about folding sub-group calls into Tuesday Team call to increase engagement and visibility Draft updated work plan - (Team Members) Reply on email list to Denise’s Aug 14 note; details and your contributions to workplan needed Trello - (Team Members) Please try www.trello.com<http://www.trello.com> and give your feedback on email list; we’ll assume Team members are comfortable using this unless we hear otherwise Abu Dhabi (Oct-Nov) - (Staff) Send calendar invites for Team meeting days and additional invites as meetings are scheduled - (Staff) Report to Team on potential room availability at ICANN meeting for sub-group meetings during week - (Team Members) Respond to ICANN Travel ASAP & make flight reservations (sooner you book the less it costs the Team’s budget) - (Staff) Report to chairs on emails to ICANN groups re meetings (date?) Brussels (Jan) - (Staff) Send calendar invites for Team meeting days, and report to Team on how soon can ICANN travel can book arrangements Denise Michel Domain Name System Strategy & Management Facebook, Inc. denisemichel(a)fb.com<mailto:denisemichel@fb.com> From: <icannsecurity-ssr2-rt-bounces(a)icann.org> on behalf of Jennifer Bryce <jennifer.bryce(a)icann.org> Date: Wednesday, August 16, 2017 at 8:06 AM To: "ICANNsecurity-SSR2-RT(a)icann.org" <ICANNsecurity-SSR2-RT(a)icann.org> Subject: [Icannsecurity-ssr2-rt] Action items: 14 August Hi all, Here are the draft action items and decisions from the ICANN SSR subteam call on 14 August at 17:00 UTC. Please let me know if you have edits. Action Owner Expected Delivery Date Report on results of NDA meeting with ICANN Legal scheduled for 25 August. James, Kerry-Ann 29 August Finalize questions for ICANN subject-matter experts during potential meeting in LA. Distribute to staff so they can identify appropriate resources. James, Boban 25 August Provide costing of ICANN SSR face-to-face meeting in LA, 9 and 10 October. ICANN Org Request ICANN Legal to be present at ICANN SSR face-to-face to rule on availability of documents. ICANN Org Decisions Team agreed to hold 9-10 October for potential face-to-face meeting in LA. Thanks, Jennifer -- Jennifer Bryce Senior Reviews Coordinator Internet Corporation for Assigned Names and Numbers (ICANN) Email: jennifer.bryce(a)icann.org Skype: jennifer.bryce.icann www.icann.org

1 0

Process for engaging qualified contractors for Review Teams
by Jennifer Bryce Aug. 18, 2017

Aug. 18, 2017

Hi all - I’m forwarding the below note on behalf of Larisa Gurnick Dear members of the SSR2 Review Team, We pulled together information to assist with engaging qualified contractors to perform various projects to support your work. We understand that you would like to engage two contractors: * Contractor to perform the gap analysis on the implementation of SSR1 recommendations, and * Contractor to serve as a technical writer Denise and Eric requested that we provide you with all relevant information about ICANN’s process of engaging contractors. Attached are the following: 1. Overview of the process of engagement of qualified contractors for Review Team Support – this includes roles and responsibilities as well as an outline of a Fast-Track process 2. Draft overview Fast Track Request for Proposal for engaging a contractor to perform the gap analysis on the implementation of SSR1 recommendations – with confirmation from Eric and Denise of the key elements of the Scope of Work and required skills, we drafted this for your consideration. In order to proceed, we ask for your input on this document and confirmation of your agreement to allocate a portion of the SSR2 budget toward this work. We anticipate that the cost will not exceed $50,000 and depending on the timing and nature of your input, as well as availability of qualified and available candidates, we would target having a contractor ready to work by 25 September. Please confirm your approval to proceed and provide your input on the draft document by 18 August. 3. Email outlining helpful steps for you to consider in determining requirements for a contractor to serve as a technical writer. As next steps, we propose that you identify several review team members that can provide feedback to help us gain clarity around your requirements for a technical writer and your expectations of output and timing of deliverables. Then, we will draft an overview Fast Track Request for Proposal for engaging a technical writer and follow the same process as outlined above. (Note: the request for technical writer and related information, including the attached email are tracked as item #44 on the Action Item Tracker<https://community.icann.org/display/SSR/Tracking+Tool>.) Please let us know if you have additional questions and we look forward to your input on these items, so that we can proceed. Best wishes, Larisa -- Jennifer Bryce Senior Reviews Coordinator Internet Corporation for Assigned Names and Numbers (ICANN) Email: jennifer.bryce(a)icann.org Skype: jennifer.bryce.icann www.icann.org

2 1