ICANN Resolutions » Acceptance of the Second Organizational Review of the Security and Stability Advisory Committee (SSAC2) Final Implementation Report

Important note: The Board Resolutions are as reported in the Board Meeting Transcripts, Minutes & Resolutions portion of ICANN's website. Only the words contained in the Resolutions themselves represent the official acts of the Board. The explanatory text provided through this database (including the summary, implementation actions, identification of related resolutions, and additional information) is an interpretation or an explanation that has no official authority and does not represent the purpose behind the Board actions, nor does any explanations or interpretations modify or override the Resolutions themselves. Resolutions can only be modified through further act of the ICANN Board.

Acceptance of the Second Organizational Review of the Security and Stability Advisory Committee (SSAC2) Final Implementation Report


Resolution of the ICANN Board
Meeting Date: 
Thu, 25 Mar 2021
Resolution Number: 
2021.03.25.08 – 2021.03.25.10
Resolution Text: 

Whereas, on 12 March 2020 the Board accepted the SSAC2 Review Detailed Implementation Plan and directed the SSAC2 Review Work Party to provide the Board with regular reporting on the implementation efforts.

Whereas, the Security and Stability Advisory Committee Review Work Party (SSAC2 RWP), with SSAC approval and oversight, provided the Board via the Board Organizational Effectiveness Committee (OEC) with semi-annual updates on the progress of implementation efforts until such time that the implementation efforts concluded.

Whereas, the SSAC2 RWP, submitted a Final Implementation Report on 3 December 2020, detailing the completion of implementation of the recommendations arising out of the second SSAC Review and documenting that three recommendations1 have limited components that are not yet fully implemented. The OEC acknowledged that the remaining steps of the SSAC2's implementation work have dependencies beyond the control of the SSAC.

Whereas, the OEC recommends that the Board accept the SSAC2 Review Final Implementation Report issued by the SSAC2 RWP and approved by the SSAC on 3 December 2020, thereby completing the second SSAC Review; and requests that the SSAC provide a written or oral update to the OEC by 30 June 2021 on the three recommendations with limited components for which implementation is not yet fully completed and, if not completed by then, every six months thereafter until all implementation is completed.

Resolved (2021.03.25.08), the Board accepts the Final Implementation Report of the second SSAC Review issued by the SSAC RWP approved by the SSAC, which marks the completion of this organizational review in accordance with Bylaws Article 4 Section 4.4. The Board encourages the SSAC to continue monitoring the impact of the implementation of the recommendations from the second Review of the SSAC as part of its continuous improvement process.

Resolved (2021.03.25.09), the Board acknowledges the SSAC RWP's implementation work aimed at improving the SSAC's effectiveness, transparency, and accountability, in line with the proposed timeline as set out in the adopted SSAC2 Review Detailed Implementation Plan.

Resolved (2021.03.25.10), the Board requests the SSAC to provide the OEC with a written or oral progress update on the remaining components of the three recommendations for which the implementation is not fully completed. In the event that implementation is not completed by 30 June 2021, the SSAC shall continue to provide such updates to the OEC on a six-monthly basis until such time that the implementation efforts conclude.

Rationale for Resolution: 

Why is the Board addressing the issue?

ICANN organizes independent reviews of its supporting organizations and advisory committees as prescribed in Article 4 Section 4.4 of the ICANN Bylaws, to ensure ICANN's multistakeholder model remains transparent and accountable, and to improve its performance.

This action completes the second review of the SSAC and is based on the Final Implementation Report, as approved by the SSAC.

Following the assessment of all pertinent documents by the Organizational Effectiveness Committee (OEC), the Board is now in a position to consider and accept the Final Implementation Report.

Background: The independent examiner began its work in March 2018 and issued its Final Report in December 2018, including 30 recommendations. The SSAC published its Feasibility Assessment and Initial Implementation Plan in May 2019, with the Board accepting both and directing the implementation planning to start in June 2019. The Board accepted the Detailed Implementation Plan in March 2020. Note that six recommendations and/or the underlying issues provided by the independent examiner were not supported by the SSAC and consequently, these recommendations were not included in the Detailed Implementation Plan nor the Final Implementation Report (recommendations 7, 13, 17, 21, 22, and 23).

What is the proposal being considered?

The SSAC RWP submitted its Final Implementation Report to the OEC on 3 December 2020. The Final Implementation Report indicates that all 24 recommendations accepted by the Board have now been either completed, or integrated into ongoing SSAC processes, as documented in the SSAC Operational Procedures.

Particularly, the implementation work for twelve recommendations resulted in the amendment several sections of the SSAC Operational Procedures issued on 12 February 2020: Sections 2.1.2 (Withdrawals and Dissents)2, 2.3 (New Member Selection)3, 2.5 (Annual Review Process)4, 2.6.1 (Affirmation of Confidentiality and Non-disclosure)5, 2.8.1 (SSAC Roles – Chair)6, 2.8.3 (SSAC Roles – SSAC Outward liaisons)7, 3.1 (SSAC Publication Procedures - Proposing, Selecting, and Planning a Work Product)8, 3.2.4 (SSAC Publication Procedures – Study and Primary Work – Preliminary Review)9, 3.4 (Publication, Promulgation, and Publicizing)10, 3.5 (Tracking, Review, and Follow-Up)11, Appendix B and F12.

These twelve recommendations cover various aspects of SSAC operations:

documenting reviews and feedback from Board Liaison (recommendation 3),
capturing of information in the Board Action Request Register (ARR) (recommendation 4),
reviewing the implementation state of past and future advice provided to the ICANN Board (recommendation 5),
formalizing an annual process to set research priorities and identify SSR threats (recommendations 8),
updating skills in the SSAC's membership and recruitment processes (recommendation 9),
communicating on its decisions (recommendation 10),
explicitly discussing who affected parties may be in SAC-series document (recommendation 16),
identifying skills gap in the current membership (recommendation 24),
developing a formalized process to estimate its current and desired diversity (recommendation 25),
ensuring ensure that the effectiveness of an external liaison and the individual in the role are reviewed on a regular basis (recommendation 26),
and limiting SSAC's leadership to two, three-year terms, and imposing no term limits on non-leadership members (recommendation 27).
In addition, the implementation of recommendation 28 resulted in a Bylaws amendment for there to be term limits on the SSAC Chair. This suggests that the impact of the implementation of these recommendations will continue on as part of the ongoing processes, supporting the continuous improvement orientation of the SSAC as they operationalize and continue to follow the modified procedures on a go forward basis.

SSAC RWP reported that eight recommendations (1, 2, 11, 14, 15, 19, 20, 30) did not require implementation work because the recommended steps are already part of the SSAC processes and operations.

Moreover, limited components of implementation work for recommendations 18, 24 and 25, are dependent on factors beyond the control of the SSAC. The recommendations pertain to consolidating information online and increasing transparency (recommendation 18), identifying skills gap in the current membership (recommendation 24), developing a formalized process to estimate its current and desired diversity (recommendation 25) and while significant work was implemented, components of these recommendations could not be considered fully implemented due to the non-publication of photographs of SSAC members on the SSAC public-facing webpage (recommendation 18), and the lack of face-to face opportunities due to the COVID-19 cancellations of ICANN meetings (recommendations 24, 25). However, SSAC is planning to address the last component of recommendation 18 once the new SSAC public-facing webpage is published, and will also approach ICANN regional staff to assist with outreach pertaining to implementation of recommendation 24 and 25.

Which stakeholders or others were consulted?

The Board, through the OEC, consulted with the SSAC2 RWP, who was responsible for the implementation, and monitored the progress of the review as well as the progress of the implementation of review recommendations.

What concerns, or issues were raised by the community?

The implementation work conducted by the SSAC followed its standard best practices to ensure transparency and accountability. No concerns were voiced by the community.

What significant materials did the Board review?

The Board reviewed relevant Bylaws sections, Organizational Review Process documentation, SSAC2 Review Implementation Plan, its first six-monthly implementation progress report and the final implementation report.

What factors did the Board find to be significant?

The Board found several factors to be significant, contributing to the effective completion of the implementation work:

SSAC's commitment to its continuous improvement.
Convening a dedicated group that oversees the implementation of Board-accepted recommendations.
Adherence to the implementation plan that included a timeline for the implementation, definition of desired outcomes, as well as ways to measure current state and progress toward the desired outcome.
Timely and thorough reporting on the progress of implementation.
Are there positive or negative community impacts?

This Board action is expected to have a positive impact on the community by acknowledging and highlighting an effective completion of implementation of SSAC2 Review Recommendations. The completed implementation of the SSAC2 organizational review demonstrates SSAC's commitment to continuous improvement.

Are there fiscal impacts or ramifications on ICANN (strategic plan, operating plan, budget); the community; and/or the public?

This Board action is anticipated to have no additional fiscal impact. The Board notes that most recommendations require the help of the ICANN org SSAC support staff to execute, which would be done as part of support staff's standard duties. The ramifications of this resolution on the ICANN organization, the community and the public are anticipated to be positive, as this Board action signifies an important milestone for organizational reviews.

Are there any security, stability or resiliency issues relating to the DNS?

This Board action is not expected to have a direct effect on security, stability or resiliency issues relating to the DNS.

How is this action within ICANN's mission and what is the public interest served in this action?

The Board's action is consistent with ICANN's commitment pursuant to Article 4, Section 4.1 of the Bylaws to ensure ICANN's multistakeholder model remains transparent and accountable, and to improve the performance of its supporting organizations and advisory committees. This action will serve the public interest by fulfilling ICANN's commitment to maintaining and improving its accountability and transparency.

Is public comment required prior to Board action?

This is an Organizational Administrative Function not requiring public comment.