<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div class="WordSection1" style="page: WordSection1;"><div class="" style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;"><span lang="EN-US" class="">Giovanni:</span></div><div class="" style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;"><span lang="EN-US" class=""><br class=""></span></div><div class="" style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;"><span lang="EN-US" class="">Please find the attached response to the questions. All of the implementation shepherds collaborated on the responses, and they represent our consensus.</span></div><div class="" style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;"><span lang="EN-US" class=""><br class=""></span></div><div class="" style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;"><span lang="EN-US" class="">Russ</span></div><div class="" style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;"><span lang="EN-US" class=""><br class=""></span></div><div class="" style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;"><span lang="EN-US" class="">= = = = = = = =</span></div><div class="" style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;"><span lang="EN-US" class=""><br class=""></span></div><div class="" style="margin: 0cm;"><span lang="EN-US" class=""><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class="">Response to</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class="">SSR2 Pending - Further Clarification Clarifying Questions</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class="">for Implementation Shepherds</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class=""><br class=""></span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class="">20 June 2022</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class=""><br class=""></span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class=""><br class=""></span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class="">SSR2 Recommendations 3.1, 3.2, 3.3, and 4.3</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class=""><br class=""></span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class="">a. Given that recommendation 2.1 was rejected by the Board, could these</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class=""> dependent recommendations be successfully implemented by existing</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class=""> ICANN org security, planning and reporting positions and Board Risk</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class=""> committee detailed in 22 July 2021 Board Action Scorecard and Board</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class=""> Rationale?</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class=""><br class=""></span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class="">While the board has decided not to create the C-Suite position. A single</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class="">point of responsibility for SSR-related topics is highly desirable. The</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class="">implementation shepherds observe that having security report to operations</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class="">goes against accepted best practices. The single point of responsibility</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class="">was intended to cover strategic security, tactical security, and risk</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class="">management. The suggested way forward does not accomplish this goal.</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class=""><br class=""></span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class="">b. Regarding SSR2 Recommendations 3.1, ICANN org's current plan for</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class=""> reporting framework and engagement reflects an annual cycle of</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class=""> reporting with two (2) milestones of publication per year. One of</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class=""> these two (2) milestones has already been implemented in the form of</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class=""> the Appendix D to the Five Year Operating and Financial Plan for</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class=""> FY23-27 (pages 262-264). Is this reporting in alignment with the</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class=""> SSR2 Implementation Shepherds intended outcomes?</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class=""><br class=""></span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class="">No. There is no transparency provided by these broad statements.</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class=""><br class=""></span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class="">c. Regarding SSR2 Recommendations 3.2 and 3.3, SSR-related elements are</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class=""> included in ICANN’s Five Year Operating & Financial Plan and Annual</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class=""> Operating Plan and Budget, and the Five Year Strategic Plan. Extensive</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class=""> public consultation activities are in place with regard to these</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class=""> documents. See, for example, information about ICANN's strategic planning</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class=""> process and the most recent Public Comment proceeding on the draft</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class=""> Five-Year Operating & Financial Plan and draft Operating Plan & Budget.</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class=""> </span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class=""> i. Do the above mentioned elements generally address the intended</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class=""> purpose of recommendations 3.2 and 3.3?</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class=""><br class=""></span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class="">No. There is no transparency provided by these broad statements. Further,</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class="">simply stating that an activity is "SSR related" does not allow the same</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class="">insight as a specific line dedicated to SSR.</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class=""> </span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class=""> ii. Is there additional work beyond what is already in place to meet</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class=""> the requirements of the recommendation?</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class=""><br class=""></span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class="">Yes. Much greater visibility into the SSR-related activities and the cost</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class="">of each SSR-related activity is desired.</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class=""><br class=""></span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class=""><br class=""></span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class="">SSR2 Recommendation 4.3</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class=""><br class=""></span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class="">a. Recommendation 4.3 suggests the appointment of a dedicated, responsible</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class=""> person in charge of security risk management, who will report to the</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class=""> C-Suite Security role, and update, report on and guide ICANN org's</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class=""> related security activities. ICANN has in place a risk management program</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class=""> that reports to the C-suite under the direction of the CFO. It includes,</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class=""> and is significantly broader than, security-related risk management.</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class=""> Within this program, identified risks, their assessment rating and</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class=""> mitigation plans, including relative to security, are reviewed</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class=""> regularly, updated and reported to management and to the Board Risk</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class=""> Committee. These existing activities would appear to address the</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class=""> intended outcome of the recommendation. While not performed under the</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class=""> C-suite responsibility suggested in the recommendation, it is carried</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class=""> out under an existing C-suite executive which provides the appropriate</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class=""> executive-level visibility and accountability. Considering that even</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class=""> broader activities are already being carried out than those in this</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class=""> recommendation, and are already under the direction of a C-level</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class=""> executive, do the existing activities align with the intended outcomes</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class=""> for this recommendation, even if not reporting to a new C-level executive</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class=""> requested in dependent recommendation 2.1?</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class=""><br class=""></span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class="">It is the understanding of the implementation shepherds that strategic</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class="">security and tactical security do not report to the CFO. As stated above,</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class="">a single point of responsibility was intended to cover strategic security,</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class="">tactical security, and risk management.</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class=""><br class=""></span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class="">b. Given that recommendation 2.1 was rejected, can recommendation 4.3 be</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class=""> successfully implemented by existing ICANN org security, planning and</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class=""> reporting positions and committees detailed in Board Action Scorecard?</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class=""><br class=""></span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class="">At a minimum, placing strategic security, tactical security and risk</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class="">management under a single point of responsibility should be done. The</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class="">position needs to have the authority to place security above other demands</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class="">of their time and other resources.</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class=""> </span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class=""><br class=""></span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class="">SSR2 Recommendation 5.3</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class=""><br class=""></span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class="">a. All services onboarded through the Engineering and Information</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class=""> Technology function at ICANN org are required to have a Risk Assessment</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class=""> performed and documented. This risk assessment is used for the business</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class=""> to assess the risks of using those external services. Is the intention</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class=""> of the recommendation to introduce the risk assessment requirement for</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class=""> any external party that provides services to ICANN org?</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class=""><br class=""></span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class="">A risk assessment is only part of appropriate security governance and</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class="">management. The implementation shepherds expect ICANN org to create a</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class="">policy that states what is expected from vendors. A based tiered approach</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class="">(low, medium, high) for risk, criticality, and sensitivity is one method.</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class="">Additionally, audit should cover the implementation of the agreed standards,</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class="">including follow up on mitigation measures where gaps are identified, as</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class="">stated by ICANN's chosen NIST Cybersecurity Framework when it comes to</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class="">supply chain security:</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class=""><br class=""></span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class=""> "Suppliers and third-party partners are routinely assessed using</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class=""> audits, test results, or other forms of evaluations to confirm</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class=""> they are meeting their contractual obligations." (ID.SC-4)</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class=""><br class=""></span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class=""><br class=""></span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class="">SSR2 Recommendation 7.1, 7.2, 7.3, and 7.5</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class=""><br class=""></span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class="">a. Would the SSR2 Implementation Shepherds consider 7.1, 7.2, 7.3, 7.5 to</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class=""> be successfully implemented and effective in the event that the Board</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class=""> rejects Recommendation 7.4 regarding opening a non-U.S., non-North</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class=""> American site, and that portion of the success measure cannot be</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class=""> achieved?</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class=""><br class=""></span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class="">Not fully, but they would be partially implemented.</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class=""><br class=""></span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class=""><br class=""></span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class="">SSR2 Recommendation 7.1</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class=""><br class=""></span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class="">a. ICANN org reading of this recommendation is that the SSR2 RT has</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class=""> conflated the goal of Business Continuity Management for the whole of</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class=""> ICANN org, such as what ISO 22301 calls for, with the goals of</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class=""> operational plans for systems disaster recovery to support operational</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class=""> business continuity. In light of ICANN org's interpretation, can the</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class=""> implementation shepherds please clarify the intent of this recommendation?</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class=""><br class=""></span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class="">As indicated by the section heading, the goal is BOTH Business Continuity</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class="">and Disaster Recovery.</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class=""><br class=""></span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class=""><br class=""></span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class="">SSR2 Recommendation 7.2</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class=""><br class=""></span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class="">a. The recommendation states "... includes all relevant systems that</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class=""> contribute to the security and stability of the DNS". Since ICANN does</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class=""> not own/operate all of the systems that contribute to the security and</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class=""> stability of the DNS, can the Implementation Shepherds confirm that the</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class=""> scope of this recommendation is meant to only cover systems owned and</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class=""> operated by ICANN org?</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class=""><br class=""></span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class="">Correct, this recommendations is aimed at the systems owned and operated by</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class="">ICANN org. The SSR2 RT is asking ICANN org to lead by example!</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class=""><br class=""></span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class="">b. This recommendation calls for a DR plan that is in line with ISO 27031</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class=""> but ICANN org is seeking clarification to this approach in recommendations</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class=""> 7.1 and 7.3. Once the clarifying questions are answered and a decision</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class=""> is made regarding adopting ISO 27031, do the Implementation Shepherds find</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class=""> it acceptable for this recommendation to follow the same approach?</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class=""><br class=""></span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class="">The implementation shepherds understand that ICANN will use the NIST</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class="">Cybersecurity Framework, and the implementation shepherds think this is</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class="">a reasonable alternative as long as the implementation is transparent</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class="">to the community, and is regularly audited and attested by a third party.</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class="">NIST provides a number of resources regarding audit:</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class=""><br class=""></span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class=""> <a href="https://www.nist.gov/cyberframework/assessment-auditing-resources" class="">https://www.nist.gov/cyberframework/assessment-auditing-resources</a></span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class=""><br class=""></span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class=""><br class=""></span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class="">SSR2 Recommendation 7.3</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class=""><br class=""></span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class="">a. The recommendation specifies ISO 27031. ICANN org has already commenced</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class=""> adoption and implementation of applicable NIST standards. Would the</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class=""> Implementation Shepherds consider if other standards such as</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class=""> NIST SP 800-34 Rev 1 would meet the requirements of the recommendation?</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class=""><br class=""></span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class="">The implementation shepherds understand that ICANN will use the NIST</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class="">Cybersecurity Framework, and the implementation shepherds think this</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class="">well accepted standard a reasonable way forward as long as the</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class="">implementation is transparent to the community so that there is an</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class="">opportunity to identify and remedy gaps. Regular external, attested</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class="">audits of the implementation of framework and the resulting controls</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class="">is most critical for establishing a constantly evolving security</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class="">program and stature.</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class=""><br class=""></span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class=""><br class=""></span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class="">SSR2 Recommendation 7.5</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class=""><br class=""></span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class="">a. The recommendation proposes publishing information that is potentially</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class=""> confidential or may lead to exposure of sensitive operational details.</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class=""> Would the Implementation Shepherds accept this item fulfilled if the</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class=""> ICANN Org provided such reports to the ICANN Board?</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class=""><br class=""></span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class="">The SSR2 RT used the word "summary" so that the information could be</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class="">provided at a level that avoids exposure of sensitive operational details.</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class="">Reports to the ICANN Board DO NOT provide the transparency that is desired.</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class=""><br class=""></span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class="">b. The recommendation proposes that the ICANN Org use a 3rd party auditor</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class=""> to review the BC and DR plans to some level of "compliance", can the</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class=""> Implementation Shepherds provide insight on the expected cadence of such</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class=""> audits that would meet the Implementation Shepherd's view as sufficient.</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class=""><br class=""></span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class="">Such audits are common practice. The implementation shepherds would</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class="">expect to see regular audits as part of routine audits performed at</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class="">ICANN Org internally and by third-party, independent auditors, as is</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class="">common practice. The sufficient cadence depends on the results of the</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class="">previous audit and the associated remedies, if any are needed.</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class=""><br class=""></span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class=""><br class=""></span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class="">SSR2 Recommendation 9.3</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class=""><br class=""></span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class="">a. What "Compliance activities" do the SSR2 Implementation Shepherds</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class=""> intend to be audited?</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class=""> </span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class="">b. What would be the scope of the audits?</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class=""><br class=""></span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class="">c. What standards would Compliance be audited against?</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class=""><br class=""></span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class="">d. What kinds of information would be requested that is not currently</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class=""> already published within the ICANN Contractual Compliance Dashboard, or</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class=""> the ICANN Contractual Compliance Twelve-Month Trends Report.</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class=""><br class=""></span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class="">The implementations shepherds agree that the recommendation could have</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class="">been more clear. The ideal would be to follow the ISO 9000, setting goals,</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class="">strategies, policies, and so on. Then, ICANN should have regular, third</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class="">party audits conducted against the relevant quality management program to</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class="">ensure that all of them are being met in practice.</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class=""><br class=""></span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class=""><br class=""></span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class="">SSR2 Recommendation 11.1</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class=""><br class=""></span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class="">a. ICANN org notes that this recommendation appears to relate to and be</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class=""> in support of SAC097. As the Board notes in the rationale for actions</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class=""> taken on Recommendation 11.1, ICANN org is currently in the process of</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class=""> implementing recommendations from SAC097, which calls for ICANN org to</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class=""> revise "the [Centralized Zone Data Service] CZDS system to address the</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class=""> problem of subscriptions terminating automatically by default, for</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class=""> example by allowing subscriptions to automatically renew by default."</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class=""> ICANN org has provided the Board information regarding a plan to</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class=""> approach and accomplish the recommendations in SAC097. ICANN org also</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class=""> provides quarterly updates on the status of implementation via the</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class=""> Action Request Register. Please confirm the correctness of our</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class=""> understanding that this recommendation is in support of SAC097.</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class=""><br class=""></span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class="">The SSR2 report points to the overlap with SAC097. Please keep in</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class="">mind that SSR2 RT was concerned about the large number of unaddressed</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class="">CZDS-related complaints, and the SSR2 RT metric of effectiveness is</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class="">that these complaints stop because CZDS users are satisfied with the</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class="">CZDS service. To that end, the SSR2 RT wants to ensure that access</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class="">to CZDS data is available even if all of SAC097 is not implemented by</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class="">the ICANN Board.</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class=""><br class=""></span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class=""><br class=""></span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class="">SSR2 Recommendation 24.1</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class=""><br class=""></span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class="">a. Is the SSR2 Review Team's intent for ICANN org to conduct Emergency</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class=""> Back-end Registry Operator (EBERO) testing on "live" gTLDs with</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class=""> registrations?</span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class=""><br class=""></span></font></div><div class="" style="margin: 0cm;"><font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class="">No, EBERO testing on "live" gTLDs is not anticipated.</span></font></div><div style="font-family: Calibri, sans-serif; font-size: 11pt;" class=""><br class=""></div></span></div></div><div><br class=""><blockquote type="cite" class=""><div class="">On May 18, 2022, at 12:56 PM, Giovanni Seppia via ssr2-implementation-shepherds <<a href="mailto:ssr2-implementation-shepherds@icann.org" class="">ssr2-implementation-shepherds@icann.org</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div class="WordSection1" style="page: WordSection1; caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span lang="EN-US" class="">Dear Kerry-Ann, KC, Russ and Laurin,<o:p class=""></o:p></span></div><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span lang="EN-US" class=""><o:p class=""> </o:p></span></div><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span lang="EN-US" class="">I hope this message finds you well.<o:p class=""></o:p></span></div><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span lang="EN-US" class=""><o:p class=""> </o:p></span></div><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span lang="EN-US" class="">Please find attached the next set of SSR2 clarifying questions on Group-3 pending recommendations.<o:p class=""></o:p></span></div><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span lang="EN-US" class=""><o:p class=""> </o:p></span></div><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span lang="EN-US" class="">The scorecard for the whole SSR2 recommendations can be found at<span class="Apple-converted-space"> </span><a href="https://www.icann.org/en/system/files/files/ssr2-scorecard-22jul21-en.pdf" style="color: rgb(5, 99, 193); text-decoration: underline;" class="">https://www.icann.org/en/system/files/files/ssr2-scorecard-22jul21-en.pdf</a><o:p class=""></o:p></span></div><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span lang="EN-US" class=""><o:p class=""> </o:p></span></div><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span lang="EN-US" class="">It would be great if you could send us your feedback by 20 June 2022 at the latest.<o:p class=""></o:p></span></div><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span lang="EN-US" class=""><o:p class=""> </o:p></span></div><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span lang="EN-US" class="">I remain available for any further information and/or clarification you may need.<o:p class=""></o:p></span></div><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span lang="EN-US" class=""><o:p class=""> </o:p></span></div><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span lang="EN-US" class="">Kind Regards,<o:p class=""></o:p></span></div><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span lang="EN-US" class=""><o:p class=""> </o:p></span></div><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span lang="EN-US" class="">Giovanni<o:p class=""></o:p></span></div><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span lang="EN-US" class=""><o:p class=""> </o:p></span></div></div></div></blockquote></div></body></html>