<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns:mv="http://macVmlSchemaUri" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Title" content="">
<meta name="Keywords" content="">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:"Source Sans Pro";
panose-1:2 11 5 3 3 4 3 2 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal;
font-family:"Calibri",sans-serif;
color:windowtext;}
span.EmailStyle18
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
span.msoIns
{mso-style-type:export-only;
mso-style-name:"";
text-decoration:underline;
color:teal;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:595.0pt 842.0pt;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1027"/>
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1"/>
</o:shapelayout></xml><![endif]-->
</head>
<body bgcolor="white" lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt">Hi all,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Please see below for responses to a number of outstanding questions for ICANN Org:
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><b><span style="font-size:11.0pt">Tracker item 80: Provide responses to <a href="https://docs.google.com/document/d/15g9bz4h57wC9LmNltKLarLRGhJdztnCBzDGtWmBs8q0/edit">questions</a> from SSR1 briefings (Ops + Finance)<o:p></o:p></span></b></p>
<p class="MsoNormal"><b><span style="font-size:11.0pt">(Question 11): Who will be the contracting entity for future SOC2/3 audits of PTI?<o:p></o:p></span></b></p>
<p class="MsoNormal"><b><span style="font-size:11.0pt"><o:p> </o:p></span></b></p>
<p class="MsoNormal"><span style="font-size:11.0pt">It is not currently known who the contractor will be beyond the current period. A competitive RFP process is being conducted to select the vendor for the next SOC2 and SOC3 audits. It is estimated the vendor
will be selected in October.<o:p></o:p></span></p>
<p class="MsoNormal"><b><span style="font-size:11.0pt"><o:p> </o:p></span></b></p>
<p class="MsoNormal"><b><span style="font-size:11.0pt">Tracker item 86: Provide SSR2-RT with information on if ICANN Office of the CTO has plans to re-define “security”? If so, how and when?</span></b><span style="font-size:11.0pt"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> <o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">It is not the role of the ICANN Office of the CTO to define or re-define "security". We currently use the definition found in the SSR Framework document, however if the community believes refinement or replacement
of that definition is necessary, we'll facilitate those discussions and use the new definition when complete.<o:p></o:p></span></p>
<p class="MsoNormal"><b><span style="font-size:11.0pt"><o:p> </o:p></span></b></p>
<p class="MsoNormal"><b><span style="font-size:11.0pt">Tracker item 101: Provide responses to <a href="https://docs.google.com/document/d/1qwMPHYVoS_H4VSXx-ZbwzosSfxkD6xc8jxxPT1Vj8Kc/edit?usp=sharing">questions</a> on SSR1 briefing: Recommendations 11, 12.<o:p></o:p></span></b></p>
<p class="MsoNormal"><b><span style="font-size:11.0pt">(Question 10): Is there any quantification or more detailed information on what the working relationship with the APWG has yielded?<o:p></o:p></span></b></p>
<p class="MsoNormal"><b><span style="font-size:11.0pt"><o:p> </o:p></span></b></p>
<p class="MsoNormal"><span style="font-size:11.0pt">1) cross-community collaboration on APWG white papers, see <a href="https://apwg.org/resources/apwg-reports/whitepapers">https://apwg.org/resources/apwg-reports/whitepapers</a>, including these topics:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">- registrar best/recommended practices<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">- web vulnerabilities survey<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">- subdomain registration phishing practices <o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">- whois data and phishing<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">- twice annual global phishing surveys<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">2) cross-posting of SSAC documents for APWG community, again see <a href="https://apwg.org/resources/apwg-reports/whitepapers">https://apwg.org/resources/apwg-reports/whitepapers</a><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">3) cross-fertilization of subject matter expertise<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">- incoming SSAC chairperson is originally from APWG community<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">- several SSAC members are originally from APWG community<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">- registry (e.g., Afilias, Org) and registrar (Blackknight, GoDaddy) staff have joined APWG<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">4) Our membership provides access to APWG eCrimeX phishing data for the DAAR project<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">5) Collaboration on an Accelerated Malicious Domain Suspension program (AMDoS) see <a href="https://apwg.org/apwg-news-center/amdos/">https://apwg.org/apwg-news-center/amdos/</a> for registries and registrars<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.5pt;color:black">-- <o:p></o:p></span></p>
<div>
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Source Sans Pro";color:#595959">Jennifer Bryce</span></b><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Source Sans Pro";color:#595959">Senior Reviews Coordinator </span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Source Sans Pro";color:#595959">Internet Corporation for Assigned Names and Numbers (ICANN)</span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Source Sans Pro";color:black"> </span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Source Sans Pro";color:#595959">Email: jennifer.bryce@icann.org</span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Source Sans Pro";color:#595959">Skype: jennifer.bryce.icann</span><span style="color:black"><o:p></o:p></span></p>
</div>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Source Sans Pro";color:#595959">www.icann.org</span><o:p></o:p></p>
</div>
</body>
</html>