Hi all, I’m working on the Baseline Security (see page 38) findings to try and help them support the recommendations. The evidence for the recommendation depend entirely on how the Board handled RSSAC037 and 038. Since this recommendation was first drafted, the Board likely hadn’t done much of anything. The Board’s initial response was in June 2018 and it said they would create an Root Server System Governance Working Group (RSS GWG) so that the community could tell them how to implement RSSAC 037 and 038. That working group didn’t form until the very end of 2019 (see https://ccnso.icann.org/en/announcements/announcement-26nov19-en.htm). That said, it did form, and has a work plan that runs through 2022. Given that, I’m not entirely sure that this still fits - the Board will simply point to the RSS GWG as the group with all the action items in the RSS space. I think it makes sense to drop this recommendation, unless there other supporting evidence we would like to refer to for the recommendation to have merit. Text of the recommendation: SSR2 Recommendation 21: Establish Baseline Security Practices for Root Server Operators and Operations 21.1. ICANN org, in close cooperation with RSSAC and other relevant stakeholders, should ensure that the RSS governance model as proposed by RSSAC037 includes baseline security best practices for Root Server Operators and operations to minimize the SSR risks associated with root server operation. These best practices should include change management, verification procedures, and sanity check procedures. As part of this process, ICANN org should publish its own strategies for managing SSR for the IMRS and encourage other Root Server Operators to do the same. Heather Flanagan — Translator of Geek to Human https://sphericalcowconsulting.com