<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div class="">Hello,</div><div class=""><br class=""></div>I also have some issues accessing and editing the document, see below :<div class=""><br class=""></div><div class="">Possible focus area.</div><div class="">======</div><div class="">- Complete the assessment of the implementation of SSR1 recommendations, the impact of the implementation, how the post implementation is being managed and what implications for the SSR2 review.</div><div class=""><br class=""></div><div class=""><div style="margin: 0px; font-size: 11px; line-height: normal;" class="">- Scope of ICANN’s SSR responsibilities: action zone, influence zone, coordination zone</div><div style="margin: 0px; font-size: 11px; line-height: normal;" class=""><br class=""></div><div style="margin: 0px; font-size: 11px; line-height: normal;" class="">*ICANN SSR responsibility for the coordination of the global unique Identifiers</div><div style="margin: 0px; font-size: 11px; line-height: normal;" class="">*ICANN operational role</div><div style="margin: 0px; font-size: 11px; line-height: normal;" class="">*ICANN influence role (TLD operators, registrars ….), </div><div style="margin: 0px; font-size: 11px; line-height: normal;" class="">*ICANN coordination role( IETF, RIRs Root zone operators ,technical community</div><div style="margin: 0px; font-size: 11px; line-height: normal; min-height: 13px;" class=""><br class=""></div><div style="margin: 0px; font-size: 11px; line-height: normal;" class="">- Effectiveness of ICANN’s SSR framework, SSR Plan and its implementation </div></div><div style="margin: 0px; font-size: 11px; line-height: normal;" class=""><br class=""></div><div style="margin: 0px; font-size: 11px; line-height: normal;" class=""> *Security framework</div><div style="margin: 0px; font-size: 11px; line-height: normal;" class="">* Contingence planning</div><div style="margin: 0px; font-size: 11px; line-height: normal;" class="">*security framework robustness for a rapid evolving security environment </div><div style="margin: 0px; font-size: 11px; line-height: normal;" class=""><br class=""></div><div style="margin: 0px; font-size: 11px; line-height: normal;" class="">=========</div><div class=""><br class=""><div><blockquote type="cite" class=""><div class="">On 14 May 2017, at 17:28, Boban Krsic <<a href="mailto:krsic@denic.de" class="">krsic@denic.de</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div class="">Dear All,<br class=""><br class="">Given that I could not access the Google Drive folder, please find my<br class="">homework in accordance to James proposal below ;-)<br class=""><br class="">-----<br class=""><br class="">Focus on Sub-Team Number 2 - ICANN’ Internal Security Processes<br class=""><br class="">The sub team will be responsible for reviewing the completeness and<br class="">effectiveness of ICANNs internal security processes and the<br class="">effectiveness of the ICANN security framework<br class=""><br class="">Due to ICANN’s orientation to ISO/IEC 27001 I would recommend to provide<br class="">a gap-analysis to the normative requirements of the management part and<br class="">Annex A of the ISO standard based on the SoA (Scope).<br class=""><br class="">- Perform interviews and review descriptions and evidence of:<br class=""><br class="">* ISMS Scope<br class="">* Information security policy<br class="">* Information risk assessment and risk treatment processes<br class="">* Information security objectives<br class="">* Information security roles and responsibilities<br class="">* ISMS internal audit program and results of conducted audits<br class="">* Operational planning and control documents<br class="">* Evidence of top management reviews of the ISMS<br class=""><br class="">Various others from the Annex A like rules for acceptable use of assets,<br class="">access control policy, operating procedures, confidentiality or<br class="">non-disclosure agreements, secure system engineering principles,<br class="">information security policy for supplier relationships, etc.<br class=""><br class="">- Categorize and prioritize the outcome of the analysis<br class=""><br class="">- Develop a short-, medium- and long-term schedule to implement<br class="">different controls in accordance to the requirements<br class=""><br class="">- Define a set of metrics to measure the effectiveness of the<br class="">implementation<br class=""><br class="">With the goal to achieve a high level of maturity and to pass a<br class="">successful certification process concerning ICANNs ISMS.<br class=""><br class="">Best,<br class=""><br class=""><span class="Apple-tab-span" style="white-space:pre"> </span>- Boban.<br class=""><br class=""><br class=""><br class="">Am 14.05.17 um 17:08 schrieb Karen Mulberry:<br class=""><blockquote type="cite" class="">Dear SSR2 Review Team,<br class=""><br class="">Per the discussion this afternoon on next steps, I have created a Google Drive for the SSR2 Review Team to place their collaborative materials.<br class=""><br class="">Here is the link to the Folder where I have created a Google Doc for you to add your areas of interest or topics for tomorrow’s planning discussion.<br class=""><a href="https://drive.google.com/drive/folders/0B_IP1b20BSBUcndyOFVpbEZKbTQ?usp=sharing" class="">https://drive.google.com/drive/folders/0B_IP1b20BSBUcndyOFVpbEZKbTQ?usp=sharing</a><br class=""><br class="">Sincerely,<br class=""><br class="">Karen Mulberry<br class="">Director, Multistakeholder Strategy and Strategic Initiatives (MSSI)<br class="">ICANN<br class="">12025 Waterfront Dr., Suite 300<br class="">Los Angeles, CA 90094<br class="">Phone: +1 424 353 9745<br class=""><br class=""><br class=""><br class="">_______________________________________________<br class="">Ssr2-review mailing list<br class="">Ssr2-review@icann.org<br class="">https://mm.icann.org/mailman/listinfo/ssr2-review<br class=""><br class=""></blockquote><br class=""><br class="">-- <br class=""><br class="">Boban Kršić<br class="">Chief Information Security Officer<br class=""><br class="">DENIC eG, Kaiserstraße 75-77, 60329 Frankfurt am Main, GERMANY<br class=""><br class="">E-Mail: <a href="mailto:krsic@denic.de" class="">krsic@denic.de</a>, Fon: +49 69 272 35-120, Fax: -248<br class="">Mobil: +49 172 67 61 671<br class=""><a href="https://www.denic.de" class="">https://www.denic.de</a><br class=""><br class="">X.509 Key-ID: 00A54FCB79884413A4<br class="">Fingerprint: 9D37 F593 AF9A D766 FAB4 8B88 D49A 2716<br class=""><br class="">PGP Key-ID: 0x43C89BA9<br class="">Fingerprint: B974 E725 FEF7 CB3A E452 BEE0 5B80 73E9 43C8 9BA9<br class=""><br class="">Angaben nach § 25a Absatz 1 GenG:<br class="">DENIC eG (Sitz: Frankfurt am Main)<br class="">Vorstand: Helga Krüger, Martin Küchenthal, Andreas Musielak, Dr. Jörg<br class="">Schweiger<br class="">Vorsitzender des Aufsichtsrats: Thomas Keller<br class="">Eingetragen unter Nr. 770 im Genossenschaftsregister, Amtsgericht<br class="">Frankfurt am Main<br class="">_______________________________________________<br class="">Ssr2-review mailing list<br class="">Ssr2-review@icann.org<br class="">https://mm.icann.org/mailman/listinfo/ssr2-review<br class=""></div></div></blockquote></div><br class=""></div></body></html>