Acceptance of the Second Organizational Review of the Security and Stability Advisory Committee (SSAC2) Final Implementation Report

Why is the Board addressing the issue?

ICANN organizes independent reviews of its supporting organizations and advisory committees as prescribed in Article 4 Section 4.4 of the ICANN Bylaws, to ensure ICANN's multistakeholder model remains transparent and accountable, and to improve its performance.

This action completes the second review of the SSAC and is based on the Final Implementation Report, as approved by the SSAC.

Following the assessment of all pertinent documents by the Organizational Effectiveness Committee (OEC), the Board is now in a position to consider and accept the Final Implementation Report.

Background: The independent examiner began its work in March 2018 and issued its Final Report in December 2018, including 30 recommendations. The SSAC published its Feasibility Assessment and Initial Implementation Plan in May 2019, with the Board accepting both and directing the implementation planning to start in June 2019. The Board accepted the Detailed Implementation Plan in March 2020. Note that six recommendations and/or the underlying issues provided by the independent examiner were not supported by the SSAC and consequently, these recommendations were not included in the Detailed Implementation Plan nor the Final Implementation Report (recommendations 7, 13, 17, 21, 22, and 23).

What is the proposal being considered?

The SSAC RWP submitted its Final Implementation Report to the OEC on 3 December 2020. The Final Implementation Report indicates that all 24 recommendations accepted by the Board have now been either completed, or integrated into ongoing SSAC processes, as documented in the SSAC Operational Procedures.

Particularly, the implementation work for twelve recommendations resulted in the amendment several sections of the SSAC Operational Procedures issued on 12 February 2020: Sections 2.1.2 (Withdrawals and Dissents)2, 2.3 (New Member Selection)3, 2.5 (Annual Review Process)4, 2.6.1 (Affirmation of Confidentiality and Non-disclosure)5, 2.8.1 (SSAC Roles – Chair)6, 2.8.3 (SSAC Roles – SSAC Outward liaisons)7, 3.1 (SSAC Publication Procedures - Proposing, Selecting, and Planning a Work Product)8, 3.2.4 (SSAC Publication Procedures – Study and Primary Work – Preliminary Review)9, 3.4 (Publication, Promulgation, and Publicizing)10, 3.5 (Tracking, Review, and Follow-Up)11, Appendix B and F12.

These twelve recommendations cover various aspects of SSAC operations:

documenting reviews and feedback from Board Liaison (recommendation 3),
capturing of information in the Board Action Request Register (ARR) (recommendation 4),
reviewing the implementation state of past and future advice provided to the ICANN Board (recommendation 5),
formalizing an annual process to set research priorities and identify SSR threats (recommendations 8),
updating skills in the SSAC's membership and recruitment processes (recommendation 9),
communicating on its decisions (recommendation 10),
explicitly discussing who affected parties may be in SAC-series document (recommendation 16),
identifying skills gap in the current membership (recommendation 24),
developing a formalized process to estimate its current and desired diversity (recommendation 25),
ensuring ensure that the effectiveness of an external liaison and the individual in the role are reviewed on a regular basis (recommendation 26),
and limiting SSAC's leadership to two, three-year terms, and imposing no term limits on non-leadership members (recommendation 27).
In addition, the implementation of recommendation 28 resulted in a Bylaws amendment for there to be term limits on the SSAC Chair. This suggests that the impact of the implementation of these recommendations will continue on as part of the ongoing processes, supporting the continuous improvement orientation of the SSAC as they operationalize and continue to follow the modified procedures on a go forward basis.

SSAC RWP reported that eight recommendations (1, 2, 11, 14, 15, 19, 20, 30) did not require implementation work because the recommended steps are already part of the SSAC processes and operations.

Moreover, limited components of implementation work for recommendations 18, 24 and 25, are dependent on factors beyond the control of the SSAC. The recommendations pertain to consolidating information online and increasing transparency (recommendation 18), identifying skills gap in the current membership (recommendation 24), developing a formalized process to estimate its current and desired diversity (recommendation 25) and while significant work was implemented, components of these recommendations could not be considered fully implemented due to the non-publication of photographs of SSAC members on the SSAC public-facing webpage (recommendation 18), and the lack of face-to face opportunities due to the COVID-19 cancellations of ICANN meetings (recommendations 24, 25). However, SSAC is planning to address the last component of recommendation 18 once the new SSAC public-facing webpage is published, and will also approach ICANN regional staff to assist with outreach pertaining to implementation of recommendation 24 and 25.

Which stakeholders or others were consulted?

The Board, through the OEC, consulted with the SSAC2 RWP, who was responsible for the implementation, and monitored the progress of the review as well as the progress of the implementation of review recommendations.

What concerns, or issues were raised by the community?

The implementation work conducted by the SSAC followed its standard best practices to ensure transparency and accountability. No concerns were voiced by the community.

What significant materials did the Board review?

The Board reviewed relevant Bylaws sections, Organizational Review Process documentation, SSAC2 Review Implementation Plan, its first six-monthly implementation progress report and the final implementation report.

What factors did the Board find to be significant?

The Board found several factors to be significant, contributing to the effective completion of the implementation work:

SSAC's commitment to its continuous improvement.
Convening a dedicated group that oversees the implementation of Board-accepted recommendations.
Adherence to the implementation plan that included a timeline for the implementation, definition of desired outcomes, as well as ways to measure current state and progress toward the desired outcome.
Timely and thorough reporting on the progress of implementation.
Are there positive or negative community impacts?

This Board action is expected to have a positive impact on the community by acknowledging and highlighting an effective completion of implementation of SSAC2 Review Recommendations. The completed implementation of the SSAC2 organizational review demonstrates SSAC's commitment to continuous improvement.

Are there fiscal impacts or ramifications on ICANN (strategic plan, operating plan, budget); the community; and/or the public?

This Board action is anticipated to have no additional fiscal impact. The Board notes that most recommendations require the help of the ICANN org SSAC support staff to execute, which would be done as part of support staff's standard duties. The ramifications of this resolution on the ICANN organization, the community and the public are anticipated to be positive, as this Board action signifies an important milestone for organizational reviews.

Are there any security, stability or resiliency issues relating to the DNS?

This Board action is not expected to have a direct effect on security, stability or resiliency issues relating to the DNS.

How is this action within ICANN's mission and what is the public interest served in this action?

The Board's action is consistent with ICANN's commitment pursuant to Article 4, Section 4.1 of the Bylaws to ensure ICANN's multistakeholder model remains transparent and accountable, and to improve the performance of its supporting organizations and advisory committees. This action will serve the public interest by fulfilling ICANN's commitment to maintaining and improving its accountability and transparency.

Is public comment required prior to Board action?

This is an Organizational Administrative Function not requiring public comment.