Tracking Tool

Include budget discussion in the DC meeting objectives

Team members to provide Phil with suggestions on how to recommence review work in preparation for the DC meeting

Phil to circulate a request for volunteers to produce a narrative of methodology used to determine scope of work, division of work/subgroups (incl. progress)

Advise if the sub-team requires an NDA to access, and provide access to requested documents.

• ICANN SSR team provided list of questions, shared with SME.
• EBERO operator responded with questions for the team. Shared on Trello. Response provided by team and shared with SME for progression.
• ICANN has sent a request to EBERO operators to gauge interest.

Progress of requests is available on the SSR1 Subgroup page.

• Meeting request on hold.
• Proposed time slots sent to subteam via email.

Provide responses to questions on SSR1 briefing: Recommendations 11, 12.

Progress of requests is available on the SSR1 Subgroup page.

• Community webinars scheduled and information shared with the review team via email.
• Briefing confirmed for 25 June 2017. Postponed per Co-Chairs.

• Briefing scheduled for 3 November. Cancelled.
• Asked Co-Chairs via email to advise if meeting with members of the drafting team should be scheduled in Abu Dhabi.
• Briefing scheduled for 5 September 2017. Plenary meeting cancelled.
• Briefing confirmed for 25 July 2017. Postponed per Co-Chairs
• Briefing confirmed for 26 June 2017. Postponed per Co-Chairs.

11

Draft note and summary of SSR1 implementation for ICANN to send to SSR1 team members and invite them to share their assessment with the SSR2-RT.

11

Draft a Statement of Work for specialist technical writer: Co-Chairs to provide guidance on the scope of work and other requirements for the engagement of the technical writer.

Co-Chairs

ICANN org to pull together a SSR1 implementation package (briefing materials, SSR1 implementation related questions) for posting on the ICANN wiki

ICANN org to find out what the current FY budget is 

Phil to summarize and share stock-take on the status of the review team’s work.

ICANN org to provide an overview of restrictions associated scheduling during ICANN meetings

Phil to provide a summary of deliverables established in contract

ICANN org to provide Phil with information on meeting room layout/size etc.

ICANN org to send meeting minutes to Phil for edits

ICANN org to submit a request for a two-day face-to-face meeting prior to ICANN63 

Review team members who require a letter of invitation for visa procedures are asked to send a request to ssr2-staff@icann.org by 23:59 UTC on Friday 6 July.

Staff to circulate Doodle poll to the team re: team’s next conference call meeting. Suggested date for meeting, week of July 3rd.

Phil to work with co-chairs to prepare agenda/materials ahead of the next meeting for RT members to respond to.

Eric and Denise to draft a digest of reading materials ahead of the face-to-face meeting and share with the RT for feedback.

Report to Team on potential room availability at ICANN meeting for sub-group meetings during week.

Subteam rapporteurs to prepare a short status update for the presentations to the SO/AC groups in Abu Dhabi

Send calendar invites for Team meeting days in Abu Dhabi and additional invites as meetings are scheduled.

Calendar invites for confrmed meetings, including outreach sessions, sent to team.

ICANN org to arrange meeting with Board Caucus group in Abu Dhabi.

Provide responses to questions from SSR1 briefings (Ops + Finance).

ICANN Org

• Clarification requested from Review Team for question 2.

Answers provided in Google document and circulated to Review Team.

75, b. Provide responses to draft questions for ICANN Chief Innovation & Information Officer (CIO).

75. a. Prepare draft questions for ICANN Chief Innovation & Information Officer (CIO). Questions will be sent to the CIO in preparation for holding a briefing for the RT.

75.b. ICANN Org

75. a. SSR2-RT

• Draft audit plan document reviewed with SMEs and ICANN SSR subgroup during face-to-face meeting in Los Angeles.
• 75.a. Questions sent to ICANN CIO.

Review Team members to review the Non-Disclosure Agreement and Confidential Disclosure Framework documents and raise any questions on the list.

Try www.trello.com and give your feedback on email list. Co-Chairs will assume Team members are comfortable using this unless otherwise informed.

Access granted and request sent via Trello for all team members to access the SSR2 Review Team boards. See action item 166 for workaround for team members unable to access Trello.

Respond to ICANN Travel ASAP & make flight reservations to travel to Abu Dhabi for the face-to-face meeeting.

Break out IANA subteam document requests in order of priority to help expedite access to documents, once NDAs have been finalized and signed.

Team members to indicate which work item topics they wish to volunteer for. Boban to mirror in Trello.

Staff to explore options for team members who are unable to access Google docs/Trello

Staff to circulate send a final version of Future Challenges topics list to plenary email list for approval by the plenary – allow 7 days for Review Team approval on list.

Provide feedback to the IANA subgroup team on how quickly team can expect access to documents requested once NDAs are finalized and signed.

SSR2 to share thoughts on ICANN SSR scope related discussion on email list

ICANN Org to share ICANN SSR subgroup audit plan and the document ‘SSR2_sub_topic_ICANN.SSR’ on email list. 

ICANN Org to circulate update to list of staff members attending LA subgroup meeting.

Review Team members to share expected outcomes of outreach meetings in Abu Dhabi to the list to ensure team is in alignment. 

Add “ICANN SSR sub-team scope discussion” as item #1 to 26 September plenary agenda

ICANN Org to circulate a Doodle poll and schedule a conference call next week to prepare for LA

ICANN Org to publish agenda and participants of the ICANN SSR subgroup meeting in LA by Monday 25 September, 23:59 UTC to the subgroup wiki and email list.

Question for ICANN: Regarding the SSR implications of the .avianca tld https://www.icann.org/uploads/compliance_notice/attachment/957/serad-to-reyes-19sep17.pdf[icann.org] situation, i.e when and where do the decisions on enforcement of non compliance get evaluated for SSR impact (in this case where a gTLD is AWOL but for months no actual action is taken).

Gap analysis RFP published to ICANN.org.

Review Team agreed to proceed with release of gap analysis specifications document on 26 September plenary call.

• 'Clean' RFP document and revised procurement process overview circulated to Co-Chairs 9/14. Co-Chairs to approve document for ICANN Procurement final review.
• Edits provided on list. Further updates may be provided based on ICANN's response to action item 145.

Determine appropriate person to ask for training documentation for processes and procedures for PTI staff.

Provide additional information about soliciting consultants with a budget under $50k (no RFP needed), and the difference between engaging a consultant and an “independent expert.”

Team to provide feedback on the structure of the 9 work items, including identifying items which staff may be able to provide more information or help build out.

11

Updated Per meeting 24: James and Kerry-Ann will provide briefing to Review Team on Non-Disclosure Agreement (NDA) and associated documents, when available. 

Review non-disclosure form with ICANN Legal and report back to RT on any updates or edits to the circulated form.

James Gannon, Kerry-Ann Barrett

• Revised draft NDA and Confidential Disclosure Agreement circulated to review team via email.
• James provided update to team via email.
• Meeting to review revised documents scheduled with ICANN Legal Friday 18th August 2017.
• Discussion with ICANN Legal took place on 5 June 2017. Kerry-Ann and James to follow-up with redline edits to document.

Documents circulated to the list (29 August) and overview provided by Kerry-Ann on plenary meeting 27 (12 September).

• 43. b. Follow-up via email: Could you please clarify when ITHI will start regularly publishing (or giving the public access to) data? It seems that the “schedule” below is about discussions rather than production, or am I misunderstanding?

• 43. a. Provide the SSR2 RT a timeline of the ITHI project, when they have clarity on next steps and schedules.

ICANN Org

• 43. a. Email circulated to Review Team 26 June 2017.

The ICANN security team (now OCTO/SSR) developed a framework that provided a definition for "security".  The SSR2 team used that definition. The Board response to the Terms of Reference expressed that this definition is too broad for the Review Team’s use. Is Board asking staff to redefine definition of “security”?

• ICANN staff working to schedule webinars for the community.
• Briefing confirmed for 25 June 2017. Postponed per Co-Chairs.

Community webinars scheduled and information shared with the review team via email.

Request ICANN Legal to be present at ICANN SSR face-to-face meeting, October 9-10 to rule on availability of documents.

• Process for sharing confidential documents is in development. Team updated via email.

Update sent to the review team via email. Replaced by action item 144.

Send calendar invites for Team meeting days in Brussels, 22-24 January, and report to Team on how soon can ICANN travel can book arrangements.

Calendar invites distributed to team.

Welcome email/initial travel correspondence sent to review team from ICANN Travel.

1. Fix the broken links in the Final Implementation Report and ensure that relevant references have links (if it’s noted in the report as relevant to implementation, please make sure there’s a link to information about it).
2. Put all the documentation/information (links) for each Recommendation together in one place. Some are linked in the Final Implementation Report, some are listed under “Background Materials” in our wiki and others…. ?
3. In each Recommendation, provide completion dates for each listed “deliverable” that has a check-mark under “due date” instead of an actual date

See completed action item 104 for progress notes regarding related previous request.

Outline in writing a request to meet with ICANN staff responsible for Information Security Management, Auditing, Risk Management and Business Continuity Management. Request to include details of expected goals and outcomes of the meeting.

Sub-team realignment: Reply on email list to Eric’s Aug 14 note about folding sub-group calls into Tuesday Team call to increase engagement and visibility

Circulate outline of detailed work items and proposed next steps after face-to-face meeting.

Žarko, Boban

Finalize questions for ICANN subject-matter experts during potential ICANN SSR subgroup meeting in LA. Distribute to staff so they can identify appropriate resources.

Confirm approval of ICANN SSR subgroup potential face-to-face meeting in LA

• Cost estimate and staff availability circulated via email to Review Team.
• Doodle poll closed. Email circulated identifying 9-10 October as most popular dates.
• Staff requested via email additional information regarding meeting objectives/ desired outcomes.

Report on results of NDA meeting with ICANN Legal scheduled for 18 August.

Report to Co-chairs on outreach emails to ICANN groups regarding requested meetings in Abu Dhabi

Provide costing of ICANN SSR face-to-face meeting in LA, 9 and 10 October.

• Staff sought clarification via email as to the style as it differs from the template outline agreed on 25 July plenary.
• Work plan circulated via email by Co-Chairs.
  
  

11

Research collaborative tools the RT may use that can be publicly archived.

Email request from James Gannon & PDF attachment

• ICANN IT researched requested tools and provided response to James Gannon and Co-Chairs.
• Face-to-face meeting with ICANN IT, MSSI support staff and James Gannon in Johannesburg, June 24.
• Tools demonstration scheduled for SSR2 plenary meeting 18, with ICANN and MSSI support staff.

Briefing provided during 15 August 2017 plenary meeting. Background information provided via email 14 August 2017.

Potential engagement of a third party to complete SSR1 implementation gap analysis: Draft a document to address statement of work, required skills and expertise, expected deliverables, timelines and work methods for co-chairs’ review and approval. 

Briefing with ICANN Procurement scheduled for 15 August 2017. Cancelled per co-chairs (staff/leadership call 11 August)

Draft RFP overview document shared with Co-Chairs via email 11 August 2017.

Draft work plan template shared with Co-Chairs via email 11 August 2017.

80. Provide follow-up questions from the 25 June SSR1 briefings so that ICANN Org can prepare responses.

ICANN Org

SSR2-RT

Interview complete and notes shared with subteam.

Share redline version of DNS SSR work topics draft to the subtopic email list.

• Follow-up via email: Please provide a written explanation as to how the original question was felt to be objectionable.
• ICANN DNS Engineering team to reframe the following question and provide an answer (Q3 from SSR2 Plenary 14, 6 June GSE presentation) so as to better align with the RT mandate: Regarding L-root operations and hosting: What is the planning process vs. passive response? Is there a master plan for anyone who operates, in terms of Anycast? And how is that overall process implemented? (GH) 

ICANN DNS Engineering team provided proposed reframe of the question: "What measures are undertaken by ICANN for the anycast deployment for L-Root to ensure physical and network security and stability?"

• Question reframe response circulated via email 11 July 2017.

Re-organized work items shared with plenary for input (see Item 90 on Tracking Tool). Replaced by actions S2.2

Provide completion dates for each recommendation (date it was designated as “complete”); if there was multiple activities or deliverables in a recommendation, include the dates those were completed too.

• Email provided additional clarity.
• Completion dates available in the SSR1 Implementation Final Report.
• Link added to SSR1 Subteam wiki page.

Review ICANN SSR re-organized work items (37 items in 8 groups) and send feedback to ICANNsecurity-SSR2-RT@icann.org. Please bear in mind the following questions:

• Is this a useful structure to use to organize this activity?
• What is missing from this list?
• Is there anything here that is perhaps out of scope?
• Is this an achievable agenda?

Confirm if staff responsible for the outstanding SSR1 Recommendations (11, 12) can attend the SSR2 plenary call to present the recommendation implementation.

• 76. e. Review Team members to share edits to availability with staff off-list. Co-Chairs to confirm meeting dates.
• 76. d. Co-Chairs to confirm location of face-to-face meeting.
• 76. c. Identify most cost-effective meeting location with Meetings team.
• 76. b. Co-Chairs to identify date for face-to-face meeting and share with Review Team.
• 76. a. Complete Doodle poll on January 2018 face-to-face meeting.

76. d. Co-Chairs

76. c. ICANN Org

76. b. Co-Chairs

76. a. SSR2-RT

• 76. e. James Gannon and Cathy Handley shared updates July 14. No additional follow-up received.
• 76. d. Email sent to Review Team confirming Brussels as the location.
• 76. c. Email sent to co-chairs identifying Brussels as the most cost-effective location.
• 76. b. 22-24 January identified by Co-Chairs per Doodle poll responses. Save-the-date invites distributed.

• 76. a. Doodle poll completed.

Provide follow-up questions via email regarding the SSR1 implementation briefing by ICANN Compliance – recommendation 10.

SSR2-RT

Build out the SSR2 Review Team work plan to provide additional substance and practical steps to share with Co-Chairs for initial input.

https://www.icann.org/resources/pages/compliance-reports-2016

Respond to questions asked by the Review Team during the SSR1 implementation briefing by ICANN Compliance – recommendation 10.

ICANN Org

• Follow-up question: Please clarify when.
• Provide SSR2-RT with information on if ICANN Org will accept Board proposal for a new, template “Terms of Reference in Operating Standards”? If so, when will it be issued?

• Response provided via email to Review Team. Terms of Reference template estimated to be completed 28 July 2017.
• Response provided via email to Review Team.

Identify Board members on “caucus” reviewing SSR2 work.

Doodle poll completed.

SSR2-RT members to volunteer for sub-topic rapporteur roles within each sub-team.

SSR2-RT to share any objections on list to dropping the 0600 UTC call slot and address call schedule rotation in the Johannesburg meeting.

Update the January 2018 face-to-face meeting Doodle poll with option for weekend meeting.

Post attendance participation rates to wiki on a monthly basis.

Staff to capture and share all discussions to-date around outreach.

Email request to adopt the title "Security Review" in public communications.

• Follow-up email sent from ICANN Comms.
• Follow-up meeting with Eric Osterweil, Denise Michel, Duncan Burns, Emily Pimentel, MSSI support staff - Johannesburg, 28 June
• Email response provided, 15 June

Send written responses to RT questions asked during the presentation on ICANN’s Global Stakeholder Engagement outreach efforts to SSR technical community.

1. We’re hearing that the GSE is supporting the work done by CTO. So, what do we mean by help support? And what is the relationship between this engagement and the IANA functions? (AA)
2. A lot of the presentation was about sending the message out. How does it work going the other way? You point to passive mechanisms but what about active measures? (GH)
3. Regarding L-root operations and hosting: What is the planning process vs. passive response? Is there a master plan for anyone who operates, in terms of Anycast? And how is that overall process implemented? (GH)
4. What efforts does ICANN take to inform the policy debate as it is taking place vs. after the fact? (GH)
5. How does GSE work specifically with the ccTLD community on SSR? (JM)
6. How is your work is coordinated and support the OCTO and SSR teams commitment to engage and seek input from the broader SSR community that’s not necessarily active in ICANN. Including their obligation to get input/interaction from them on SSR Framework and strategic priorities. How are you involved and how does the coordination occur? (DM)
7. When do you think in terms of GSE that the focus on explanation/teaching of what ICANN does will shift to more of an interaction/ substantive engagement? (GH)

• Answers to follow-up questions circulated to Review Team.

• ICANN DNS Engineering team asked RT to reframe the following question (Q3 from SSR2 Plenary 14, 6 June GSE presentation) so as to better align with the RT mandate: Regarding L-root operations and hosting: What is the planning process vs. passive response? Is there a master plan for anyone who operates, in terms of Anycast? And how is that overall process implemented? (GH) 

• RT asked ICANN DNS Engineering to reframe the question and provide an answer.

Prepare a draft work plan proposal for SSR1 Review and ICANN Security topics.

Add agenda item regarding how Observers can participate and contribute to sub topic work to plenary call #13. 

Publish blog on ICANN.org regarding SSR2 face-to-face meeting in Madrid.

11

Schedule remainder of briefings related to SSR1.

11

Staff to provide RT with explanation and background information from ICANN Global Stakeholder Engagement and Adiel Akplogan (ICANN VP Technical Engagement) regarding current outreach efforts to SSR technical community (responsibility, focus, accomplishments) for RT’s consideration.

Patrick Jones, Senior Director, GSE and Adiel Akplogan, Vice President, Technical Engagement joined SSR2 plenary 14.

11

Circulate list of potential scope topics and list of sub team volunteers.

Circulate link to ICANN technical portal

11

Share links to relevant articles regarding threat mitigation and classification of threats.

Links circulated to Review Team:

Threat Mitigation

• http://www.g20portal.com/accelerating-cybercrime-response-and-mitigation/
• https://insights.sei.cmu.edu/sei_blog/2017/02/six-best-practices-for-securing-a-robust-domain-name-system-dns-infrastructure.html
• http://www.securityskeptic.com/2015/03/can-we-extend-trust-based-collaboration-beyond-handshakes-and-face-to-face.html

Classification of Threats 

• http://www.securityskeptic.com/2016/02/lending-clarity-to-security-risk-definitions-for-icann-community-and-beyond.html
• https://www.spamhaus.org/news/article/713/changes-in-spamhaus-dbl-dnsbl-return-codes
• http://www.surbl.org/lists (see multi.surbl.org section)

11

Circulate Google doc for RT to input their SSR concerns. Inputs to form substance of scope discussion.

11

Provide the SSR2 RT a timeline of the ITHI project, when they have clarity on next steps and schedules.

10

Post PTI briefing materials and relevant materials to the SSR2 wiki background materials page.

Circulate clean version of Terms of Reference to list for final 24-hour consideration.

Send adopted Terms of Reference to ICANN Board, should no objections occur in the 24 hours from circulation.

Prepare proposal for initial structuring of RT work for Madrid meeting.

Provide a decision to the Review Team on whether a face-to-face meeting will take place in Johannesburg, and on what dates. 

Share link to Bylaws Article 18 and appropriate context.

Provide v3 draft scope for Terms of Reference based on discussions and comments.

Circulate Doodle poll to establish RT availability for F2F meeting in Johannesburg.

Circulate updated open action items list to RT.

Non-Disclosure (NDA) and Conflicts Disclosure (CDA) documentation for RT.

• Documents circulated to Review Team via email.
• Posted to the SSR2 Legal Documentation wiki page.

Clean up draft Terms of Reference (accept points of agreement). Pull out points of disagreement for discussion on email list.

25

Propose timeline for finalizing scope.

• Replaced by action item #26.
• Thoughts shared via email.

3

Open SSR1 Rec 11 - Effectiveness of mechanisms to mitigate abuse. 

Implementation description: ICANN should finalize and implement measures of success for new gTLDs and IDN fast track that expressly relate to its SSR-related program objectives, including measurements for the effectiveness of mechanisms to mitigate domain name abuse.

3

The following three open SSR1 Recommendations are interrelated and are being implemented together:

Rec 20 - SSR budget

Implementation description: ICANN should increase the transparency of information about organization and budget related to implementing the SSR Framework and performing SSR-related functions. 

Rec 21 - SSR budget 

Implementation description: ICANN should establish a more structured internal process for showing how organization and budget decisions relate to the SSR Framework, including the underlying cost-benefit analysis.

Rec 22 - SSR resources for new gTLDs

Implementation description: ICANN should publish, monitor and update documentation on the organization and budget resources needed to manage SSR issues in conjunction with introduction of new gTLDs.  

Recommendation 20 implementation completed:

https://community.icann.org/display/SSR/Rec+%2320

Recommendation 21 implementation completed:

https://community.icann.org/display/SSR/Rec+%2321

Recommendation 22 implementation completed:

https://community.icann.org/display/SSR/Rec+%2322

• Strawman work plan shared with Review Team.
• Initial Terms of Reference document shared with Review Team.

• Email circulated to Review Team
• SSR2 Observers wiki page updated with link to requested information.

• Slide deck circulated and uploaded to SSR2 plenary 2 wiki page.
• Contact details provided via email.

Request for the IS-SSR team to provide a summary of the types of requests for assistance that they receive from the community.

 1