- Ssr2-review - lists.icann.org

ACTION REQUESTED: SSR2 Doodle Poll
by MSSI Secretariat April 16, 2019

April 16, 2019

Dear SSR2 Members, Please see doodle poll; https://doodle.com/poll/evk98zqk7gvbzsxp and provide your availability to attend upcoming Face to Face meetings. The doodle poll will close at 23:59 UTC tomorrow, 17 April and results will be shared on Thursday’s plenary call. With kind regards, Brenda --- Brenda Brewer, Projects & Operations Assistant Multistakeholder Strategy & Strategic Initiatives (MSSI) Internet Corporation for Assigned Names and Numbers (ICANN) Skype: brenda.brewer.icann

1 0

ICANN SSR and Future Challenges answers
by Jennifer Bryce April 12, 2019

April 12, 2019

Dear SSR2 RT members, The below answers has been added to the Q&A Google doc: https://docs.google.com/document/d/14eJwDGP-LvS9ltTmZoh1i19Fi0_pB2nJ4JYMsS7… [docs.google.com]<https://urldefense.proofpoint.com/v2/url?u=https-3A__docs.google.com_docume…>. Please let us know if you have any questions. Review Team volunteers: Boban, Alain, Žarko Workstream: ICANN SSR Topic 2: Perform an assessment of ICANN's Business Continuity Management System. Outstanding questions: 1 Q: What is the frequency of DR testing? A: As it relates to systems, disaster recovery fail-over between data centers is tested annually. Q: Was an impact analysis done after PTI separation to asses needed for update to BC plans? A: PTI, the affiliate with which ICANN contracts for the performance of the IANA Functions, is not separate from ICANN. As noted through the IANA Stewardship Transition process, a separate contracting entity was created in the event that it was determined that the performance of the IANA Functions needed to be separated. As anticipated, there is little functional change in how the IANA Functions are actually performed, including the systems through which those services are performed. ICANN and PTI entered into a shared services agreement (https://www.icann.org/iana_pti_docs/153-services-agreement-v-30sep16) which is common in affiliate and spin-off relationships, through which ICANN commits to provide services to support the IANA activities, as well as commits ICANN to coordinate and maintain business continuity efforts. As a result, the IANA Stewardship Transition did not have an impact on ICANN’s business continuity plans. Q: Has ICANN implement the recommendations of the following exercise: IANA Full‐Scale Business Continuity Exercise Conducted 19 January 2010 (https://www.icann.org/en/system/files/files/iana-business-continuity-exerci…) A: Yes. Over time, IANA procedures have matured and evolved to incorporate the types of recommendations in that report. Q: Does ICANN's top management and /or the responsible person) established and published a documented organization business continuity policy? A: These documents are confidential and not published publicly for security reasons. There is an established Disaster Recovery plan for systems, a Continuity Plan for the IANA Functions, and a broader Continuity Plan under development for the wider ICANN organization to be delivered in 2019. Q: Does ICANN have a documented Policy concerning the procurement, provision and management of outsourced good and services via its supply chain? A: Yes. See https://www.icann.org/en/system/files/files/procurement-guidelines-21feb10-… Q: Does ICANN have a documented business continuity operational planning and control process that enables it to determine, plan, implement and control those actions needed to fulfil its business continuity policy and objectives? A: These documents are confidential and not published publicly for security reasons. There is an established Disaster Recovery plan for systems, a Continuity Plan for the IANA Functions, and a broader Continuity Plan under development for the wider ICANN organization to be delivered in 2019. Q: Does ICANN have a formal documented standard procedure and evaluation process for conducting a Business Impact Analysis (BIA)?\ A: ICANN has carried out a BIA in the past. Providing detailed information on such results could highlight vulnerabilities to the organization. The revised Continuity Plan, discussed in response to other questions, will be more focused on resource substitution until a disaster recovery is complete generally, rather than making scenario assumptions. BIA implies a certain speed of resource recovery which in practice may be much different than expected. That is, there should be contingency plans for all important resources, dispensing with a detailed analysis based on recovery time assumptions which may not hold in a crisis. Q: Has ICANN carried out a BIA to identify its prioritized activities? If so, what was the results? A: ICANN has carried out a BIA in the past. Providing detailed information on such results could highlight vulnerabilities to the organization. The revised Continuity Plan, discussed in response to other questions, will be more focused on resource substitution until a disaster recovery is complete generally, rather than making scenario assumptions. BIA implies a certain speed of resource recovery which in practice may be much different than expected. That is, there should be contingency plans for all important resources, dispensing with a detailed analysis based on recovery time assumptions which may not hold in a crisis. Q: Is there a documented Business Continuity Resumption/Recovery Strategy(ies) for the ICANN's prioritized activities their support resources and dependencies that has been signed off by top management? A: These documents are confidential and not published publicly for security reasons. There is an established Disaster Recovery plan for systems, a Continuity Plan for the IANA Functions, and a broader Continuity Plan under development for the wider ICANN organization to be delivered in 2019. ICANN has carried out a BIA in the past. Providing detailed information on such results could highlight vulnerabilities to the organization. The revised Continuity Plan, discussed in response to other questions, will be more focused on resource substitution until a disaster recovery is complete generally, rather than making scenario assumptions. BIA implies a certain speed of resource recovery which in practice may be much different than expected. That is, there should be contingency plans for all important resources, dispensing with a detailed analysis based on recovery time assumptions which may not hold in a crisis. Q: Is there a documented Resource Recovery Strategy for critical business activities and their dependencies that has been signed off by top management, which includes the identification of critical assets on a scheduled basis? If so, is the strategy based upon and consistent with the resource recovery requirements identified within the current BIA in respect to ICANN's prioritized activities their support services and dependencies recovery profile? A: These documents are confidential and not published publicly for security reasons. There is an established Disaster Recovery plan for systems, a Continuity Plan for the IANA Functions, and a broader Continuity Plan under development for the wider ICANN organization to be delivered in 2019. ICANN has carried out a BIA in the past. Providing detailed information on such results could highlight vulnerabilities to the organization. The revised Continuity Plan, discussed in response to other questions, will be more focused on resource substitution until a disaster recovery is complete generally, rather than making scenario assumptions. BIA implies a certain speed of resource recovery which in practice may be much different than expected. That is, there should be contingency plans for all important resources, dispensing with a detailed analysis based on recovery time assumptions which may not hold in a crisis. Q: Does ICANN have documented business continuity plans in respect of each of the prioritized activities and their dependencies? A: These documents are confidential and not published publicly for security reasons. There is an established Disaster Recovery plan for systems, a Continuity Plan for the IANA Functions, and a broader Continuity Plan under development for the wider ICANN organization to be delivered in 2019. ICANN has carried out a BIA in the past. Providing detailed information on such results could highlight vulnerabilities to the organization. The revised Continuity Plan, discussed in response to other questions, will be more focused on resource substitution until a disaster recovery is complete generally, rather than making scenario assumptions. BIA implies a certain speed of resource recovery which in practice may be much different than expected. That is, there should be contingency plans for all important resources, dispensing with a detailed analysis based on recovery time assumptions which may not hold in a crisis. Q: Does each plan contain predefined task checklists that includes mandatory and discretionary tasks together with individuals/roles/teams responsible for their completion and a process for tracking they're completion within an allocated timeframes? A: No, as previously stated, the plan will focus on resource recovery generally. Q: Does ICANN have a documented exercise/testing programme and process for business continuity procedures, plans and arrangements? The last available exercise is from 2009: https://www.icann.org/en/system/files/files/gtld-registry-continuity-plan-2… A: The referenced document relates to backup registries, rather than continuity at ICANN itself. The continuity plan being developed for the organization will include testing. Systems disaster recovery testing is done annually. Q: Depth of testing of DR needs to be elaborated on (Table top vs power trip). Are there any results of power trip exercises? A: Systems disaster recovery tests are actual failover tests. All systems were successfully recovered failing-over from primary to secondary. Q: Does ICANN conduct performance evaluations of its business continuity procedures, arrangements and capabilities in order to verify their continued suitability, adequacy and effectiveness? A: The continuity plan will be reviewed periodically, with testing, which would achieve what this question seems to be asking. Q: Does ICANN have documented boundaries and processes that have inter-org dependencies? Are they relate back to BC plans? a. Clarification requested from Boban, Alain, Zarko: What is meant by “inter-org” dependencies? Which orgs? What is meant by “boundaries.” b. ICANN org has asked for clarification as to the meaning of this question, and is awaiting a response. That said, based on current understanding, ICANN org thinks the answer is no, not beyond the shared services agreement between ICANN and PTI. Q: Does ICANN conduct internal audits at planned intervals to provide information on whether the Business Continuity Management is effectively implemented and maintained? A: Periodic testing and validation by the Risk Management function will be an important part of the Continuity Plan being developed this year. Review Team volunteers: Laurin, Boban, Žarko, Kerry-Ann Workstream: ICANN SSR Topic 3: Perform an assessment of ICANN's Risk Management Methodology and Framework. Outstanding questions: 0 Q: As of Oct 2017, ICANN did not follow formal information security audit frameworks such as ISO 27001. Is that still the case? A: That statement is incorrect. ICANN org has carried out assessments based on the CIS20 Cyber Security Framework starting in 2014. During 2018, ICANN transitioned to the NIST Cyber Security Framework. The benchmarking assessment has been done annually by a consulting firm with expertise in such assessments. In addition, two annual information security audits are performed related to the IANA Functions. The IANA department has been performing SOC3 audits on the Root Zone Key Signing Key Operator System since 2010, and SOC2 audits on the Registry Assignment and Maintenance System since 2013. Those audits are performed by external auditors. Q: Are there any plans to adopt a formal framework? If so, please give details of the framework, timeline for implementation and budget allocated. If not, provide reasoning for pursuing a formal framework. A: ICANN org has carried out assessments based on the CIS20 Cyber Security Framework starting in 2014. During 2018, ICANN transitioned to the NIST Cyber Security Framework. The benchmarking assessment has been done annually by a consulting firm with expertise in such assessments. In addition, two annual information security audits are performed related to the IANA Functions. The IANA department has been performing SOC3 audits on the Root Zone Key Signing Key Operator System since 2010, and SOC2 audits on the Registry Assignment and Maintenance System since 2013. Those audits are performed by external auditors. Q: Please provide documentation (links/perma-links) about your business continuity and risk management processes. A: ICANN org is not able to provide links to these processes, as this detailed information is confidential and unable to be shared due the nature of risk management, which may involve vulnerabilities and threats to the organization. Therefore, it would not be prudent to provide details of those vulnerabilities and threats nor details of the countermeasures ICANN takes or would take to counter vulnerabilities and threats. In general, however, ICANN org has a risk management policy and risk identification process. The policy and the process are reviewed by a Risk Management Committee made up of the org executives, approved by the President and CEO, and reviewed by the Board Risk Committee. Key elements of the policy have been presented to the full Board. A Continuity Plan is under development for ICANN organization and will be delivered later in 2019. That Continuity Plan will also be reviewed by a committee of the org executives, approved by the President and CEO, and reviewed by the Board Risk Committee. ICANN org is planning to develop public risk management reporting in 2019 which would highlight some of our risk management activities. Q: Is James Caulfield still the person responsible for risk and business continuity management? A: Yes. Q: There is a Board Risk Committee which meets at least twice a year, and considers the risk register. Is this still the case? The Committee organises an interactive risk workshop at least once a year, is that still the case? Please give dates of meetings since 2016, along with attendees, agendas, and outcome reports. A: Yes and yes. Minutes of the Board and Board Committee meetings are a matter of public record and can be found here: https://www.icann.org/resources/pages/minutes-2014-03-24-en Q: Please confirm that the risk register is updated on an ongoing basis, and give evidence of these updates. A: Yes, the Risk Register is updated regularly. Please refer to the Board Risk Committee minutes. Q: Relevant managers are responsible for declaring a disaster. Is this still the case? A: ICANN organization has a crisis management policy that defines the roles and responsibilities for declaring a crisis. Per that policy, it is the responsibility of executive management to determine whether a crisis is in progress. Review Team volunteers: Denise, Žarko, Kerry-Ann Workstream: ICANN SSR Topic 7: Perform an assessment how effectively ICANN has implemented its processes to ensure compliance regarding registrar agreements and the consensus policies. Outstanding questions: 3 Q: Is there are separate risk management framework (including risk register and business continuity plan) for the PTI? A: There is a separate continuity plan for the IANA Functions, and that plan is also included in the ICANN organization risk management framework. Q: IANA (PTI) systems (both IT and operational) continue to be dependent on ICANN. When PTI staff login in the morning, they are on the ICANN secured network, correct? Is this still the case? Note: may want to address this off the public list/wiki) A: ICANN org is unable to provide a specific response to this question due to system security concerns. Further, ICANN org understands that a response has already been provided in the questions answered by the IANA functions regarding the level of network access security. Q: Within risk classification or scoring, there is no multiplier for potential impact on the internet’s system of unique identifiers. Is this still the case? A: Yes, there is no multiplier, and we do not see that as a standard risk management approach. Review Team volunteers: Noorul, Kerry-Ann, Eric, Laurin, Norm Workstream: Future Challenges Topic: Root server system protection: assess the threatscape of top threats (e.g. DDoS to the root system) Outstanding questions: 0 Q: What does staff and the community already do regarding emerging and future threats, and related issues? We are aware of efforts focused on emerging technologies; are there ones that focus on threats too? A: Emerging risks are treated in the usual risk management process. For example the recent DNS threat alert: https://www.icann.org/news/announcement-2019-02-15-en -- Jennifer Bryce Senior Reviews Coordinator Internet Corporation for Assigned Names and Numbers (ICANN) Email: jennifer.bryce(a)icann.org Skype: jennifer.bryce.icann www.icann.org

1 0

Call summary: SSR2 11 Apr
by Jennifer Bryce April 11, 2019

April 11, 2019

Dear SSR2 RT members, Please find attached the plenary call report for SSR2 meeting #65, 11 April at 15:00 UTC. These high-level notes are designed to help SSR2 Review Team members navigate through the content of the call. They are not meant to be a substitute for the recording or transcript, which are posted on the wiki. The transcript usually becomes available 5 - 7 business days after the meeting. Best, Jennifer -- Jennifer Bryce Senior Reviews Coordinator Internet Corporation for Assigned Names and Numbers (ICANN) Email: jennifer.bryce(a)icann.org Skype: jennifer.bryce.icann www.icann.org

1 0

Re: [Ssr2-review] [EXT] SSR2 agenda: 11 April
by Barrett, Kerry-Ann April 11, 2019

April 11, 2019

Dear Team Regrettably Ill be in meetings tomorrow at the time of the call that I wont be able to get out of. I will provide updates in the google doc as suggested by Russ under separate cover. All the best for the week. Kind Regards Kerry-Ann Barrett Cyber Security Policy Specialist Organization of American States From: Jennifer Bryce<mailto:jennifer.bryce@icann.org> Sent: Wednesday, April 10, 2019 12:50 PM To: ssr2-review(a)icann.org<mailto:ssr2-review@icann.org> Subject: [EXT] [Ssr2-review] SSR2 agenda: 11 April Dear SSR2 RT members, Please see below for the SSR2 Review Team plenary agenda, Thursday 11 April at 14:00 UTC. 1. Welcome, roll call, SOI updates * Marrakech meeting dates - 22nd and 23rd June confirmed, morning of 27th June pending * Brussels meeting - team members to book flights, hotel confirmations pending * Technical writer - progress update to the team 2. Walk through the table of work topics here: https://docs.google.com/document/d/1Xid7AwbUpGRmX8c1TxxCmPF6mKxtdI30pwpEi-x… 3. AOB 4. Confirm action items / decisions reached Best, Jennifer -- Jennifer Bryce Senior Reviews Coordinator Internet Corporation for Assigned Names and Numbers (ICANN) Email: jennifer.bryce(a)icann.org Skype: jennifer.bryce.icann www.icann.org

1 1

SSR2 agenda: 11 April
by Jennifer Bryce April 11, 2019

April 11, 2019

Dear SSR2 RT members, Please see below for the SSR2 Review Team plenary agenda, Thursday 11 April at 14:00 UTC. 1. Welcome, roll call, SOI updates * Marrakech meeting dates - 22nd and 23rd June confirmed, morning of 27th June pending * Brussels meeting - team members to book flights, hotel confirmations pending * Technical writer - progress update to the team 2. Walk through the table of work topics here: https://docs.google.com/document/d/1Xid7AwbUpGRmX8c1TxxCmPF6mKxtdI30pwpEi-x… 3. AOB 4. Confirm action items / decisions reached Best, Jennifer -- Jennifer Bryce Senior Reviews Coordinator Internet Corporation for Assigned Names and Numbers (ICANN) Email: jennifer.bryce(a)icann.org Skype: jennifer.bryce.icann www.icann.org

4 4

ICANN SSR answers
by Jennifer Bryce April 8, 2019

April 8, 2019

Dear Scott, dear Noorul, The below answer in highlight has been added to the Q&A Google doc: https://docs.google.com/document/d/14eJwDGP-LvS9ltTmZoh1i19Fi0_pB2nJ4JYMsS7… [docs.google.com]<https://urldefense.proofpoint.com/v2/url?u=https-3A__docs.google.com_docume…>. Please let us know if you have any questions. Review Team volunteers: Scott, Noorul Workstream: ICANN SSR Topic 4: Perform an assessment of how effectively ICANN has implemented its Security Incident Management and Response Processes to reduce (pro-active and reactive) the probability of DNS-related incidents. Outstanding questions: 3 Per ICANN org answer to a previous question: ”ICANN Org employs network segmentation strategies designed to reduce the risk of pivoting activity by an attacker. Administrative access to critical services (particularly those managed by IANA) have restrictions beyond internal network access. Periodic network penetration testing is conducted by independent service providers against ICANN Org network defenses, simulating attacks from both outside the network and attempted lateral movement from within the network. The results are used to prioritize network security Improvements. Q: “ICANN Org employs network segmentation strategies designed to reduce the risk of pivoting activity by an attacker.” Are these segmentation strategies implemented now, how are they implemented? Q: “Administrative access to critical services (particularly those managed by IANA) have restrictions beyond internal network access.” What are those restrictions, and are they on the same network (topology, in detail -- diagram)? Q: “Periodic network penetration testing is conducted by independent service providers against ICANN Org network defenses, simulating attacks from both outside the network and attempted lateral movement from within the network.” * Are industry best practices followed? Please report and link to which ones. * Are penetration testers being rotated on a regular basis? If there is evidence relating to these processes, please provide a link? Is there version control, is there a permanent link? Q: “The results are used to prioritize network security Improvements”. Can you provide details on how these findings feed into improvements? Are there any reports on this? Is there version control, is there a permanent link? A: For all 4 items above we manage these strategies proactively and appropriately, taking into account best practices, and we respond to the information learnt in a proactive and professional manner given the resources available to us. Given the specificity of the questions related to highly sensitive areas we will not be disclosing detailed information from documents, processes, findings, and improvements even under NDA. ICANN Org would like to understand how these very detail orientated questions fall into the scope of the SSR2, but given the level of detail that we are able to provide in any event, we are responding as able. -- Jennifer Bryce Senior Reviews Coordinator Internet Corporation for Assigned Names and Numbers (ICANN) Email: jennifer.bryce(a)icann.org Skype: jennifer.bryce.icann www.icann.org

1 0

DNS SSR answer
by Jennifer Bryce April 8, 2019

April 8, 2019

Dear KC, The below answer has been added to the Q&A Google doc: https://docs.google.com/document/d/14eJwDGP-LvS9ltTmZoh1i19Fi0_pB2nJ4JYMsS7… [docs.google.com]<https://urldefense.proofpoint.com/v2/url?u=https-3A__docs.google.com_docume…>. Please let us know if you have any questions. Review Team volunteers: KC Workstream: DNS SSR Topic: Data sharing/data release Outstanding questions: 0 Q: ITHI - how is it different from ODI, where does it get its data (from internal collection or external data) A: ODP (Open Data Program), formally ODI is merely a vehicle in which data is published in a raw state so that the consumer can utilize the data in a manner that work for their own needs. This may include recreating statistics or graphs that is displayed within ITHI, but could be used for other methods as well. ITHI is a collection of data, both raw and aggregated, that is specifically targeted to provide a sense of the “wellness” of certain aspects of the Internet infrastructure and unique identifiers that ICANN ORG and the community may find interesting and valuable. Objective: publish through ODP (when it will be ready) - Rely on ODP for future archival - Maintain ITHI Web portal for partners/outreach/analysis Develop relevant metrics & pre-process data - Build expertise in the problem-space - Define metrics - Obtain and aggregate data Act as a privacy filter before ODP - The partners’ data is not “open data” - The aggregated, anonymized metric measurements are -- Jennifer Bryce Senior Reviews Coordinator Internet Corporation for Assigned Names and Numbers (ICANN) Email: jennifer.bryce(a)icann.org Skype: jennifer.bryce.icann www.icann.org

1 0

ICANN SSR, Future Challenges answers
by Jennifer Bryce April 3, 2019

April 3, 2019

Dear SSR2 RT, The below answers have been added to the Q&A Google doc: https://docs.google.com/document/d/14eJwDGP-LvS9ltTmZoh1i19Fi0_pB2nJ4JYMsS7… [docs.google.com]<https://urldefense.proofpoint.com/v2/url?u=https-3A__docs.google.com_docume…>. Please let us know if you have any questions. Review Team volunteers: Norm, Ram Workstream: ICANN SSR Topic 6: Perform an assessment of how effectively ICANN has implemented its processes around vetting registry operators and services concerning the New gTSLALD Delegation and Transition process. Outstanding questions: 1 Q: Referencing the EBERO testing of Fall, 2017 (https://schd.ws/hosted_files/icann60abudhabi2017/08/7%20EBERO%20Arias.pdf [schd.ws<https://schd.ws/hosted_files/icann60abudhabi2017/08/7%20EBERO%20Arias.pdf>]) Since the ERERO testing in the Fall of 2017, have the issues raised been addressed by the EBERO providers? If so, has a re-test been conducted and, if so, are the results available? If not, is a re-test scheduled and when is it scheduled? A: ICANN has updated the EBERO Master Services Agreement and updated requirements in the Common Transition Process (the requirements for EBERO Service Providers) in preparation for the EBERO RFP process that is underway. These changes add additional clarity to the process requirements and all providers selected as part of the RFP will be subject to the new requirements. No re-test has been conducted and none is scheduled at this time as the referenced tests were conducted with the permission of terminating gTLDs. Review Team volunteers: Denise, Kerry-Ann, Zarko Workstream: ICANN SSR Topic 7: Perform an assessment how effectively ICANN has implemented its processes to ensure compliance regarding registrar agreements and the consensus policies. Outstanding questions: 6 Q: In your experience, are the emergence thresholds fit for purpose? If not, are there any plans to revisit them with the community? A: The emergency thresholds fit the purpose for which they were designed. There are no plans to revise them with the community. Q: To what extent are the EBERO processes part of ICANN’s risk management framework? A: EBERO capabilities are considered as part of ICANN's enterprise risk management efforts. Q: To what extent have the relationships or contracts with EBERO providers been updated to take into account the changing security landscapes, information security requirements? A: EBERO provider contracts are for 5 years. ICANN is currently running a Request for Proposal (RFP) to find EBERO providers for the next 5 years. Throughout the past five years, EBERO processes have been updated as needed when criteria have changed. The requirements for the next round of EBERO providers, to be identified in 2019, includes several updates to both EBERO processes and contract. It includes lessons learned from experience in EBERO operations as well as new language and amendments to cover data privacy and management (IT Security) of data. Q: ICANN was not monitoring EPP. Is this still the case? A: Correct, EPP is not currently being monitored. Q: Please provide a progress report on the planned webpage with current information on common challenges for registry service providers, and suggested mitigation actions/proactive measures? A: There is no planned webpage for this service. Q: Is there a plan to continue research on the abuse of and possible safeguards in the DNS, and in particular with reference to New gTLDs, following the report on DNS abuse (commissioned by CCT Review Team)? A: ICANN’s Office of the CTO will continue to provide anonymized reports from the Domain Abuse Activity Reporting (DAAR)<https://www.icann.org/octo-ssr/daar> system, which monitors the amount of spam, phishing, malware, and botnet domains in the DNS. While DAAR is not a result of the CCT-RT’s work, it employs a similar methodology to that used in the DNS abuse study<https://www.icann.org/en/system/files/files/sadag-final-09aug17-en.pdf> they commissioned, and is referenced in the CCTRT’s recommendations regarding DNS abuse. The CCTRT also recommended continuing research on new gTLD safeguards and DNS abuse for future Review Teams. Currently, however, there are no specific plans for a study on gTLD safeguards. The ICANN Board flagged some of the CCTRT’s recommendations relating to DNS abuse and safeguards as “pending,” to be addressed at a later time when certain pre-requisites have been met. If and when these recommendations are approved, ICANN org may carry out further research on DNS abuse and gTLD safeguards. For details, see the ICANN Board’s scorecard<https://www.icann.org/en/system/files/files/resolutions-final-cct-recs-scor…>. Review Team volunteers: Eric, Denise, Norm, Boban Workstream: Future Challenges Topic: Coalescence of registrars/registry/backend operators for multiple TLDs Outstanding questions: 0 Q: Is there a complete list of backend registry operators & escrow providers? A: We do not have the authority to release some of this data. Approved Data Escrow providers are listed at https://newgtlds.icann.org/en/applicants/data-escrow Q: Are there any measurements/ analysis/ testing of exercising the above functions? A: There is no service defined for direct testing of RSPs. Data Escrow Agents are monitored via regular, monthly data escrow reports. Measurement or testing of RSP performance is done on a random basis. Q: Is there a periodic report of domain names (number registrars, etc.)? A: In terms of periodic summary reports, the Domain Name Marketplace Indicators initiative will shortly release a first wave of relevant indicators such as those identified in the question. This report is intended to be updated semi-annually, and should be accessible via https://www.icann.org/resources/pages/metrics-gdd-2015-01-30-en. The same webpage currently hosts some relevant statistics, albeit with less breadth and depth, under the 'gTLD Marketplace Health Index' heading. Q: Are there higher security requirements for backend operators running multiple TLD’s? A: The requirements in the base Registry Agreement apply to the Registry Operator signing the agreement. ICANN does not have a contractual relationship with backend operators, with the exception of backend operator that are also Registry Operators. Q: Are there any and if so, what are the control mechanisms for operational availability of the TLD’s? A: The control mechanisms are: * data escrow, please refer to specification 2 of the base registry agreement. * registry performance specifications, please refer to specification 10 of the base registry agreement. * registry continuity, please refer to section 3, specification 6 of the base registry agreement. * emergency transition (EBERO), please refer to section 2.13 of the base agreement. * contractual and operational compliance audit, please refer to section 2.11 of the base agreement. * continued operations instrument, please refer to section 2.12 of the base agreement. -- Jennifer Bryce Senior Reviews Coordinator Internet Corporation for Assigned Names and Numbers (ICANN) Email: jennifer.bryce(a)icann.org Skype: jennifer.bryce.icann www.icann.org

1 0

New clarification request
by Jennifer Bryce April 1, 2019

April 1, 2019

Dear all, Please see below for a new clarification request, and the 5 outstanding requests for clarification on questions asked to ICANN org. New request: Review Team volunteers: Boban, Alain, Žarko Workstream: ICANN SSR Topic 2: Perform an assessment of ICANN's Business Continuity Management System. Clarification requested: What is meant by “inter-org” dependencies? Which orgs? What is meant by “boundaries.” 1. Does ICANN have documented boundaries and processes that have inter-org dependencies? Do they relate back to BC plans? Outstanding requests: Review Team volunteers: Scott, Noorul Workstream: ICANN SSR Topic 4: Perform an assessment of how effectively ICANN has implemented its Security Incident Management and Response Processes to reduce (pro-active and reactive) the probability of DNS-related incidents. Clarification requested: Can you please clarify if these questions are specific to the ICANN Managed Root Server or more generally for ICANN? 1. Which certifications is ICANN pursuing for the organisation and staff? 2. Which certifications and compliance frameworks has ICANN completed? 3. Who are ICANN’s auditors, what audits are completed regularly? Review Team volunteers: Eric, Denise, Norm, Boban Workstream: Future Challenges Topic: Coalescence of registrars/registry/backend operators for multiple TLDs Clarification requested: Can you please provide further context behind the question or clarify the question? 1. Has ICANN identified the issue of coalescence of registrars/registry operators in their risk management and what are the measures be taken? 2. Are there any and if so, what are the control mechanisms for operational availability of the TLD’s? Best, Jennifer -- Jennifer Bryce Senior Reviews Coordinator Internet Corporation for Assigned Names and Numbers (ICANN) Email: jennifer.bryce(a)icann.org Skype: jennifer.bryce.icann www.icann.org

2 1

Future challenges, ICANN SSR answers
by Jennifer Bryce April 1, 2019

April 1, 2019

Dear SSR2 RT, The below answers have been added to the Q&A Google doc: https://docs.google.com/document/d/14eJwDGP-LvS9ltTmZoh1i19Fi0_pB2nJ4JYMsS7…. Please let us know if you have any questions. Review Team volunteers: Laurin, Norm, Denise, Eric, Scott, Matogoro Workstream: Future Challenges Topic: Access to data and info: Research on important abuse and attack vectors Outstanding questions: 0 Q: Does the TEG or some other group provide information about (future) abuse and attack vectors? Where? A: There is no single and centralized repository for abuse and attack vectors maintained by ICANN. Review Team volunteers: Russ, Kerry-Ann, Naveed Workstream: ICANN SSR Topic 5: Perform an assessment of internal security, stability and resiliency of ICANN's operation processes and services. Outstanding questions: 0 Q: Previous question to ICANN org “We've been told that this particular contract that supported ICANN's gathering of this data does not allow it to display all of this data. Once ICANN understands what can and cannot be displayed, will they come back to the Board and community with the cost to report on everything? What would a new contract with a new provider potentially, or the same provider, need to look like in order to display more of that particular data publicly, and what would it cost?" Previous answer from ICANN org “There are two things conflated here. One is the cost of curating and validating the data. This is the major cost and is covered by ICANN's budget transparency. The other is the cost of then defining which of the curated data we can publish and presenting that to the public. It is ICANN's intention to publish as much data that our licensing allows via ODI. This cost is not yet certain as we have not finalized the possible output but it is likely to be minimal." This was reported on 15 months ago, what is the cost? A: ICANN is contractually unable to release all data that it receives from its data providers. When this question was raised by the review team earlier, OCTO SSR queried the potential to be able to provide the data in its entirety but the data providers are extremely resistant to do so as it dismantles their own business model. Review Team volunteers: Denise, Kerry-Ann, Žarko Workstream: ICANN SSR Topic 7: Perform an assessment how effectively ICANN has implemented its processes to ensure compliance regarding registrar agreements and the consensus policies. Oustanding questions: 12 Q: Is OCTO going to provide public information on DAAR and its findings and how much will that cost? A (updated to include cost information): ICANN started in February 2019, by publishing monthly reports from DAAR. We also intend to publish back dated reports. (Currently published back to June 2018. https://www.icann.org/octo-ssr/daar) Further publications may be possible and will be part of discussions with the community. Regarding cost, ICANN is contractually unable to release all data that it receives from its data providers. When this question was raised by the review team earlier, OCTO SSR queried the potential to be able to provide the data in its entirety but the data providers are extremely resistant to do so as it dismantles their own business model. -- Jennifer Bryce Senior Reviews Coordinator Internet Corporation for Assigned Names and Numbers (ICANN) Email: jennifer.bryce(a)icann.org Skype: jennifer.bryce.icann www.icann.org

1 0