Dear SSR2 RT, The below answers have been added to the Q&A Google doc: https://docs.google.com/document/d/14eJwDGP-LvS9ltTmZoh1i19Fi0_pB2nJ4JYMsS7l.... Please let us know if you have any questions. Review Team volunteers: Laurin, Norm, Denise, Eric, Scott, Matogoro Workstream: Future Challenges Topic: Access to data and info: Research on important abuse and attack vectors Outstanding questions: 0 Q: Does the TEG or some other group provide information about (future) abuse and attack vectors? Where? A: There is no single and centralized repository for abuse and attack vectors maintained by ICANN. Review Team volunteers: Russ, Kerry-Ann, Naveed Workstream: ICANN SSR Topic 5: Perform an assessment of internal security, stability and resiliency of ICANN's operation processes and services. Outstanding questions: 0 Q: Previous question to ICANN org “We've been told that this particular contract that supported ICANN's gathering of this data does not allow it to display all of this data. Once ICANN understands what can and cannot be displayed, will they come back to the Board and community with the cost to report on everything? What would a new contract with a new provider potentially, or the same provider, need to look like in order to display more of that particular data publicly, and what would it cost?" Previous answer from ICANN org “There are two things conflated here. One is the cost of curating and validating the data. This is the major cost and is covered by ICANN's budget transparency. The other is the cost of then defining which of the curated data we can publish and presenting that to the public. It is ICANN's intention to publish as much data that our licensing allows via ODI. This cost is not yet certain as we have not finalized the possible output but it is likely to be minimal." This was reported on 15 months ago, what is the cost? A: ICANN is contractually unable to release all data that it receives from its data providers. When this question was raised by the review team earlier, OCTO SSR queried the potential to be able to provide the data in its entirety but the data providers are extremely resistant to do so as it dismantles their own business model. Review Team volunteers: Denise, Kerry-Ann, Žarko Workstream: ICANN SSR Topic 7: Perform an assessment how effectively ICANN has implemented its processes to ensure compliance regarding registrar agreements and the consensus policies. Oustanding questions: 12 Q: Is OCTO going to provide public information on DAAR and its findings and how much will that cost? A (updated to include cost information): ICANN started in February 2019, by publishing monthly reports from DAAR. We also intend to publish back dated reports. (Currently published back to June 2018. https://www.icann.org/octo-ssr/daar). Further publications may be possible and will be part of discussions with the community. Regarding cost, ICANN is contractually unable to release all data that it receives from its data providers. When this question was raised by the review team earlier, OCTO SSR queried the potential to be able to provide the data in its entirety but the data providers are extremely resistant to do so as it dismantles their own business model. -- Jennifer Bryce Senior Reviews Coordinator Internet Corporation for Assigned Names and Numbers (ICANN) Email: jennifer.bryce@icann.org Skype: jennifer.bryce.icann www.icann.org