- Ssr2-review - lists.icann.org

Please review the first 5 SSR1 recommendations for the call tomorrow
by Russ Housley Oct. 10, 2018

Oct. 10, 2018

As part of the agenda for tomorrow, we will be looking over the SSR1 recommendations. We will take them each in turn. I doubt we will get through more that five on the call tomorrow, so if you are prepared to talk about the first five, that should be adequate preparation. The Bylaws are pretty clear about our task regarding the SSR1 recommendations. Section 4.6 (c) (iv) The SSR Review Team shall also assess the extent to which prior SSR Review recommendations have been implemented and the extent to which implementation of such recommendations has resulted in the intended effect. At the face-to-face meeting in Washington, I shared a way of thinking about this task. I repeat it here in the hopes it will be easier to prepare for tomorrow's call. Was there an attempt to implement the recommendation? (In all cases, the answer is "yes") Is the recommendation still relevant today? If not, write a short statement saying that it has been overcome by events. If so, assess whether the implementation has the intended effect. If so, write a short statement saying so. if not, is this something we want to see more work on? If so, write an SSR2 recommendation about it. If not, write a short statement with the reason. I look forward to our call tomorrow. Russ

4 11

SSR1 recommendations table - updated
by Jennifer Bryce Oct. 10, 2018

Oct. 10, 2018

Dear SSR2 Review Team, Please find attached the updated SSR1 recommendations table for all recs, 1-28. We have completed the table with the information re: what was done to implement the recommendation, and the questions and answers for each recommendation. We will circulate the agenda for the 11 October plenary call later today, once it has been finalized with the leadership team. Best, Jennifer -- Jennifer Bryce Senior Reviews Coordinator Internet Corporation for Assigned Names and Numbers (ICANN) Email: jennifer.bryce(a)icann.org Skype: jennifer.bryce.icann www.icann.org

1 0

Call summary: SSR2 4 October
by Jennifer Bryce Oct. 5, 2018

Oct. 5, 2018

Dear all, Please find attached the plenary call report for SSR2 meeting #46, 4 October at 14:00 UTC. These high-level notes are designed to help SSR2 Review Team members navigate through the content of the call. They are not meant to be a substitute for the recording or transcript, which are posted on the wiki at: https://community.icann.org/x/VAC8BQ. The transcript usually becomes available 5 - 7 business days after the meeting. Best, Jennifer -- Jennifer Bryce Senior Reviews Coordinator Internet Corporation for Assigned Names and Numbers (ICANN) Email: jennifer.bryce(a)icann.org Skype: jennifer.bryce.icann www.icann.org

1 0

Recommendations table
by Jennifer Bryce Oct. 4, 2018

Oct. 4, 2018

Hi all - here is the table that is being displayed in the Adobe Room. -- Jennifer Bryce Senior Reviews Coordinator Internet Corporation for Assigned Names and Numbers (ICANN) Email: jennifer.bryce(a)icann.org Skype: jennifer.bryce.icann www.icann.org

1 0

SSR2 agenda & action
by Jennifer Bryce Oct. 4, 2018

Oct. 4, 2018

Dear SSR2 Review Team, Below is the agenda for the SSR2 plenary call on Thursday 4 October at 14:00 UTC. 1. Welcome, roll call, SOI updates 2. Team to agree next steps on approach to work plan 3. SSR1 recommendations review (Denise, Eric & Laurin to lead) a) Staff to provide an update on questions & ETAs 4. AOB 5. Confirm action items / decisions reached REMINDER - Action Required: An action item from last week’s call was for Review Team members to select which recommendations they wish to take the lead on developing a strawman proposal for. Please select using the Doodle poll here: https://doodle.com/poll/8ew3ugdg9aghr8yf Best, Jennifer -- Jennifer Bryce Senior Reviews Coordinator Internet Corporation for Assigned Names and Numbers (ICANN) Email: jennifer.bryce(a)icann.org Skype: jennifer.bryce.icann www.icann.org

4 3

Re: [Ssr2-review] Q&As
by Jennifer Bryce Oct. 4, 2018

Oct. 4, 2018

Hi Denise, Please see the responses to your questions and requests below. 1. We are working with SMEs to get the answers to the questions as quickly as possible. Some of the answers have been provided already, and inserted into the Google sheet<https://docs.google.com/spreadsheets/d/1lFKb5ghbhQgl2klzQChHWT8_Y4WfTL21J9Q…>. The expected delivery dates and answers are being populated into the Google sheet directly once we have this information from the SMEs. 2. We will follow this up and provide additional answers and more specific links where they are available. 3. Noted, and we will do this going forward. Please let us know if you have any additional questions or comments. Best, Jennifer From: Ssr2-review <ssr2-review-bounces(a)icann.org> on behalf of Denise Michel <denisemichel(a)fb.com> Date: Thursday, September 20, 2018 at 4:45 PM To: SSR2 <ssr2-review(a)icann.org> Subject: [Ssr2-review] Q&As Dear staff: I have a couple requests and questions relating to Q&As<https://docs.google.com/spreadsheets/d/1lFKb5ghbhQgl2klzQChHWT8_Y4WfTL21J9Q….>. 1. When can we expect answers, or an ETA for answers, for outstanding questions? In particular, can we have answers relevant to Recs 1-5 before our next call? 2. In reviewing the answers that have been provided, I see that several answers re-state what was said in the briefing related to the recommendation. While I appreciate the summary (rather than just a link to a meeting recording), the questions were follow-ups to the briefings (note the dates; in some cases the briefings were the genesis for the questions). In addition to referencing statements in the briefings, would you please ask relevant staff to consider the questions and whether more specific answers (with links) could be provided? 3. It would be useful if you would please include relevant Q&As in the material you provide the team in advance of our calls addressing recommendations. Thank you. Denise Denise Michel Director, Domain Name System Strategy & Management Facebook, Inc. denisemichel(a)fb.com<mailto:denisemichel@fb.com>

4 5

SSR2 RT Engagement Session | ICANN63 Barcelona | 22 October 2018
by MSSI Secretariat Oct. 2, 2018

Oct. 2, 2018

Engagement Session with the SSR2 Review Team at ICANN63-Barcelona <https://63.schedule.icann.org/meetings/901537> Adobe Connect link: https://participate.icann.org/bcn63-111 Date: Monday, 22 October 2018 @ 9:45-10:45 AM/local Barcelona time - additional time zone support here <https://www.timeanddate.com/worldclock/fixedtime.html?msg=SSR2+Engagement+S…> Location: 111/112 - Venue map: here <https://63.schedule.icann.org/floor_maps/3228?per_page=30&with%5bfloor_map_…>

1 0

REMINDER: Webinar: Proposed Updates to Draft Operating Standards
by Jennifer Bryce Oct. 2, 2018

Oct. 2, 2018

Dear SSR2 Review Team members, This is a kind reminder that you are invited to attend the upcoming webinar on proposed updates to draft Operating Standards for Specific Reviews. The presentation will be identical for both one-hour webinars, scheduled as follows: * Webinar 1: 4 October 2018: 16:00 UTC [local time<https://www.timeanddate.com/worldclock/fixedtime.html?msg=Draft+Operating+S…>] * Webinar 2: 5 October 2018: 00:00 UTC [local time<https://www.timeanddate.com/worldclock/fixedtime.html?msg=Draft+Operating+S…>] The purpose of the webinar is to highlight proposed updates to the draft Operating Standards<https://www.icann.org/news/announcement-2018-09-19-en> in several key areas. Feedback on the proposals from current and former review team members is important as the Operating Standards will provide future guidance to Specific Review teams to help ensure that reviews are conducted efficiently and effectively. As a member of a specific review team we especially value your contributions on best practices and process improvements and would like to encourage you to participate if at all possible. Calendar invites for both webinars, including agenda and dial-in information, are attached to this email. If you cannot open the attachments, please email mssi-secretariat(a)icann.org<mailto:mssi-secretariat@icann.org> to receive an invite, indicating which of the two sessions you would like to attend. Please note, following these webinars and a public session at IANN63, ICANN org anticipates publishing a new draft Operating Standards, based on community input received, for public comment in December 2018. Background Information The ICANN Bylaws<https://www.icann.org/resources/pages/governance/bylaws-en/#article4.6> call for the development of Operating Standards to provide guidance to review teams to conduct Specific Reviews efficiently and effectively. The ICANN organization is in the process of modifying the draft Operating Standards based on public comments<https://www.icann.org/public-comments/reviews-standards-2017-10-17-en> received on the October 2017 draft and on the Long-Term Options to Adjust the Timeline for Specific Reviews<https://www.icann.org/public-comments/reviews-long-term-timeline-2018-05-14…>. -- Jennifer Bryce Senior Reviews Coordinator Internet Corporation for Assigned Names and Numbers (ICANN) Email: jennifer.bryce(a)icann.org Skype: jennifer.bryce.icann www.icann.org

1 0

Action Req'd: SSR1 Recommendations
by Jennifer Bryce Oct. 1, 2018

Oct. 1, 2018

Dear SSR2 RT members, Per the discussion on the 27 September plenary call, please use the Doodle poll to indicate which SSR1 recommendation you wish to take the lead on developing a strawman proposal for, to share with the RT. Note that recommendations 2, 3 and 5 are not included because the RT has already discussed these. The text of each recommendation is below. Doodle poll: https://doodle.com/poll/8ew3ugdg9aghr8yf SSR1 Recommendations: 1: ICANN should publish a single, clear and consistent statement of its SSR remit and limited technical mission. 4: ICANN should document and clearly define the nature of the SSR relationships it has within the ICANN Community in order to provide a single focal point for understanding the interdependencies between organizations. 6: ICANN should publish a document clearly outlining the roles and responsibilities for both the SSAC and RSSAC in order to clearly delineate the activities of the two groups. ICANN should seek consensus for this across both groups, recognizing the history and circumstances of the formation of each. ICANN should consider appropriate resourcing for both groups, consistent with the demands placed upon them. 7: ICANN should build on its current SSR Framework by establishing a clear set of objectives and prioritizing its initiatives and activities in accordance with these objectives. 8: ICANN should continue to refine its Strategic Plan objectives, particularly the goal of maintaining and driving DNS availability. Clear alignment of Framework & Strategic Plan. 9: ICANN should assess certification options with commonly accepted international standards (e.g. ITIL, ISO and SAS-70) for its operational responsibilities. ICANN should publish a clear roadmap towards certification. 10: ICANN should continue its efforts to step up contract compliance enforcement and provide adequate resources for this function. ICANN also should develop and implement a more structured process for monitoring compliance issues and investigations. 11: ICANN should finalize and implement measures of success for new gTLDs and IDN fast track that expressly relate to its SSR-related program objectives, including measurements for the effectiveness of mechanisms to mitigate domain name abuse. 12: ICANN should work with the Community to identify SSR-related best practices and support the implementation of such practices through contracts, agreements and MOUs and other mechanisms. 13: ICANN should encourage all Supporting Organizations to develop and publish SSR-related best practices for their members. 14: ICANN should ensure that its SSR-related outreach activities continuously evolve to remain relevant, timely and appropriate. 15: ICANN should act as a facilitator in the responsible disclosure and dissemination of DNS security threats and mitigation techniques. 16: ICANN should continue its outreach efforts to expand Community participation and input into the SSR Framework development process. ICANN also should establish a process for obtaining more systematic input from other ecosystem participants. 17: ICANN should establish a more structured internal process for showing how activities and initiatives relate to specific strategic goals, objectives and priorities in the SSR Framework 18: ICANN should conduct an annual operational review of its progress in implementing the SSR Framework and include this assessment as a component of the following year’s SSR Framework 19: ICANN should establish a process that allows the Community to track the implementation of the SSR Framework. Information should be provided with enough clarity that the Community can track ICANN’s execution of its SSR responsibilities. 20: ICANN should increase the transparency of information about organization and budget related to implementing the SSR Framework and performing SSR-related functions. 21: ICANN should establish a more structured internal process for showing how organization and budget decisions relate to the SSR Framework, including the underlying cost-benefit analysis 22: ICANN should publish, monitor and update documentation on the organization and budget resources needed to manage SSR issues in conjunction with introduction of new gTLDs. 23: ICANN must provide appropriate resources for SSR-related Working Groups and Advisory Committees, consistent with the demands placed upon them. ICANN also must ensure decisions reached by Working Groups and Advisory Committees are reached in an objective manner that is free from external or internal pressure. 24: ICANN must clearly define the charter, roles and responsibilities of the Chief Security Office Team. 25: ICANN should put into place mechanisms for identifying both near and longer-term risks and strategic factors in its Risk Management Framework. 26: ICANN should prioritize the timely completion of a Risk Management Framework. 27: ICANN’s Risk Management Framework should be comprehensive within the scope of its SSR remit and limited missions 28: ICANN should continue to actively engage in threat detection and mitigation, and participate in efforts to distribute threat and incident information -- Jennifer Bryce Senior Reviews Coordinator Internet Corporation for Assigned Names and Numbers (ICANN) Email: jennifer.bryce(a)icann.org Skype: jennifer.bryce.icann www.icann.org

1 0

Clarification requested: FAO Denise, Noorul
by Jennifer Bryce Sept. 28, 2018

Sept. 28, 2018

Dear all, The latest table of questions and answers is attached and posted to the wiki.<https://community.icann.org/x/girwAw> Note this doc replaces the Google sheet. *There are some questions that require clarification. I have identified the person who asked the question below and ask that they please provide some clarification* Recommendation 4: ICANN should document and clearly define the nature of the SSR relationships it has within the ICANN Community in order to provide a single focal point for understanding the interdependencies between organizations. Question: What accounts for the inconsistencies between the different documents on the ICANN website that describe the nature of the SSR relationships it has within the ICANN community? Asked by: Denise, via email<https://mm.icann.org/pipermail/ssr2-review/2017-August/000564.html> Clarification requested: Could you please provide some concrete examples of discrepancies? Recommendation 11: ICANN should finalize and implement measures of success for new gTLDs and IDN fast track that expressly relate to its SSR-related program objectives, including measurements for the effectiveness of mechanisms to mitigate domain name abuse. Question: Within the area of recommendation 11 & 12 activities for which ICANN can be a facilitator or convener – is there more information on the steps that ICANN took over the past five years to facilitate activities that involve other entities that had primary ownership or responsibility on related activities? Asked by: Denise during briefing<https://community.icann.org/x/jXHwAw> Clarification requested: We’re not clear on what the question is asking. Recommendation 21: ICANN should establish a more structured internal process for showing how organization and budget decisions relate to the SSR Framework, including the underlying cost-benefit analysis Question: Where is the budgetary information as it pertains to the SSR? And where is the cost benefit analysis for making these decisions? Asked by Denise via email<https://mm.icann.org/pipermail/ssr2-review/2017-October/000683.html> Clarification requested: Which decisions are referred to in the second part of this question? Ops & Finance briefing Question: There are many challenges in IDN WHOIS lookups. How do we get an accurate IDN WHOIS database for the Incident Handling process? Asked by: Noorul as follow-up to briefing<https://community.icann.org/pages/viewpage.action?pageId=64949767&preview=/…> Clarification requested: Can you please: * Clarify what is meant by "IDN WHOIS database" and by "Incident Handling process”? * Clarify the context in which this question pertains to SSR? -- Jennifer Bryce Senior Reviews Coordinator Internet Corporation for Assigned Names and Numbers (ICANN) Email: jennifer.bryce(a)icann.org Skype: jennifer.bryce.icann www.icann.org

1 0