Changes to RIPE NCC Audit Activity

Abstract Introduction

This is a The RIPE NCC has a mandate from the RIPE community to keep an up-to-date and correct Internet number resource registry (RIPE Registry). insert: </p>

After Internet number resources have been registered in the RIPE Registry, the RIPE NCC performs audits to ensure compliance with the RIPE Policies and to actively check the quality and validity of the data in the RIPE Registry (Section 2 of the RIPE NCC procedural document that describes “ insert: <a href="http://www.ripe.net/publications/docs/due-diligence" data-linktype="external" data-val="http://www.ripe.net/publications/docs/due-diligence"> Due Diligence for the Quality of the RIPE NCC Registration Data insert: </a> ”). insert: </p>

This document outlines the audit activity of the RIPE NCC. delete: </p> delete: <p> delete: </p> delete: <hr size="1" width="100%" /> the RIPE NCC performs. insert: </p>

Table of Contents contents

insert: <li>
1. Scope of the Audit Activity insert: </li>
insert: <li>
2. Types of Audits insert: </li>
insert: <li>
3. Process insert: </li>
insert: <li>
4. Appeal insert: </li>
insert: </ol>

1. Introduction Scope of the Audit Activity insert: </h2>

Every party that has entered into an agreement with the RIPE NCC is contractually obliged to provide the RIPE NCC with complete, updated and accurate information necessary for the provision of RIPE NCC services and to assist the RIPE NCC with audits and security checks (Article 6.2. of the insert: <a href="http://www.ripe.net/publications/docs/ssa" data-linktype="external" data-val="http://www.ripe.net/publications/docs/ssa"> RIPE NCC Standard Service Agreement delete: <br /> delete: <a href="#2"> 2. Goals , RIPE NCC procedural document “ insert: <a href="http://www.ripe.net/publications/docs/due-diligence" data-linktype="external" data-val="http://www.ripe.net/publications/docs/due-diligence"> Due Diligence for the Quality of the RIPE NCC Registration Data delete: <br /> delete: <a href="#3"> 3. Principles ”). insert: </p>

More specifically, it is the contractual obligation of:  insert: </p>

insert: <li>
• The RIPE NCC members for the RIPE NCC services they receive, including the Internet number resources they hold or they are responsible for as sponsoring LIRs, with either case including Legacy resources insert: </li>
insert: <li>
• The Legacy Internet number resource holders that have entered into a contractual relationship with the RIPE NCC insert: </li>
insert: </ul>

For the purposes of this document either of the above is referred to as “Resource Holder”. insert: </p>

The Internet number resources that may be subject to an audit are:  insert: </p>

insert: <li>
• Internet number resources registered in the RIPE Registry in accordance with the relevant RIPE Policies insert: </li>
insert: <li>
• Legacy Internet number resources subject to a contractual relationship with the RIPE NCC or a sponsoring LIR as described in the RIPE Policy “ insert: <a href="http://www.ripe.net/publications/docs/ncc-services-to-legacy-holders" data-linktype="external" data-val="http://www.ripe.net/publications/docs/ncc-services-to-legacy-holders"> RIPE NCC Services to Legacy Internet Resource Holders delete: <br /> delete: <a href="#4"> 4. Types delete: </a> delete: <br /> delete: <a href="#5"> 5. Process delete: </a> delete: <br /> delete: <a href="#6"> 6. Compliance Measures delete: </a> delete: <br /> delete: <a href="#7"> 7. Appeals delete: </a> delete: </p> delete: <h2> delete: <a name="1"> delete: </a> 1. Introduction delete: </h2> delete: <p> At the 1996 Contributors Committee Meeting the RIPE NCC was asked to significantly increase its efforts to ensure the validity of registry data. Audit has been a specific activity of the RIPE NCC since that time. delete: </p> delete: <h2> delete: <a name="2"> delete: </a> 2. Goals delete: </h2> delete: <p> Audit activity is done to ensure fair and neutral application of policies set by the RIPE community, to the general benefit of the Internet. delete: </p> delete: <p> Auditing can also provide the RIPE community with information about specific policy areas where problems are occurring, helping to ensure the efficient investment of ” insert: </li>
insert: <li>
• Legacy Internet number resources in appropriate areas. This can include policy areas that need revision by the RIPE community, or areas where the RIPE NCC can improve compliance through better education and communication with the membership. delete: <strong> delete: <br /> delete: </strong> delete: </p> delete: <h2> delete: <a name="3"> delete: </a> 3. Principles delete: </h2> delete: <p> Audit evaluation is based on compliance with the RIPE community policies current at the time of the audit. Audits are conducted with the intent to educate RIPE NCC members on how to achieve compliance. delete: </p> delete: <p> Members that are already working in compliance with the RIPE community policies will have as little disturbance to not subject to a contractual relationship with the RIPE NCC or a sponsoring LIR, for which a Resource Holder requests the RIPE NCC to update their operations as possible. delete: </p> delete: <p> Impartiality and confidentiality are given the highest priority throughout the audit process. delete: </p> registration data insert: </li>
insert: </ul>

delete: <a name="4"> delete: </a> 4. 2. Types of Audits

delete: <strong> delete: <a name="4.1"> delete: </a> Random: delete: </strong> delete: </p> Depending on the reason an audit is initiated, the RIPE NCC performs the following types of audits: insert: </p>

2.1. Assisted Registry Check (ARC) insert: </h3>

The Assisted Registry Check (ARC) is an audit the RIPE NCC performs with the aim of providing personalised support to a Resource Holder that is a RIPE NCC member to in order to help them keep their data in the RIPE Registry correct and accurate. insert: </p>

An ARC may be audited is chosen by the RIPE NCC at random. delete: </p> delete: <p> delete: <strong> delete: <a name="4.2"> delete: </a> Selected: delete: </strong> delete: </p> delete: <p> A initiated upon a RIPE NCC member’s request or the RIPE NCC’s selection of a member is selected because of an internal report on a random basis or due to a lack of specific matter regarding this member. insert: </p>

During an ARC the RIPE NCC, together with the relevant member, will review the member’s data in the RIPE Registry, including the accuracy of their legal name, address, contact between the RIPE NCC and the member. delete: </p> delete: <p> delete: <strong> delete: <a name="4.3"> delete: </a> Reported: delete: </strong> delete: </p> details, their registered contact persons, and the correctness of the registration of the relevant Internet number resources in the RIPE Database, etc. insert: </p>

2.2. Selected insert: </h3>

The member has requested the audit themselves or RIPE NCC may initiate an audit on its own initiative when there has been a community complaint made against them are suspicions that requires investigation. delete: </p> delete: <h2> delete: <a name="5"> delete: </a> 5. Process delete: </h2> delete: <p> The RIPE NCC informs the member a Resource Holder is maintaining inaccurate data in the RIPE Registry, is in violation of the RIPE Policies and/or the RIPE NCC procedures. insert: </p>

Depending on the reason a selected audit was initiated and when this is considered appropriate, the RIPE NCC may inform the relevant Resource Holder that they are in audit and then provides individual assistance in checking LIR data, resource records and validity of RIPE Database records. delete: </p> delete: <h2> delete: <a name="6"> delete: </a> 6. Compliance Measures delete: </h2> delete: <p> All measures used to ensure compliance with RIPE community policies are based on current policies and on the service agreements signed with RIPE NCC members. delete: </p> delete: <p> The RIPE NCC will provide audit subjects with individual assistance and education, and will make every effort to help members comply with the policies. If the member is found to be unable to comply with the RIPE community policies, further measures being audited and request any relevant information. insert: </p>

2.3. Reported insert: </h3>

A reported audit may be necessary. This may include, but is initiated as a reaction to a complaint submitted to the RIPE NCC by a third party. insert: </p>

Upon receipt of such a complaint, the RIPE NCC will evaluate its merits and if sufficient evidence is provided by the reporting party, the RIPE NCC will initiate the audit and investigate the matter further. insert: </p>

Unless it is proven that the reporting party has a valid claim on the Internet number resources under audit, the RIPE NCC will not restricted to, a review of the audited organisation's membership status. report its findings to the reporting party due to confidentiality reasons. insert: </p>

Note
For the purposes of the RIPE NCC audit activity ‘’Hijacking’’ is referred to any attempt to gain control of, or acquire, Internet number resources under false pretenses. In cases of suspected Hijacking, any type of audit, as deemed appropriate by the RIPE NCC and described in Section 2.0 of this document, may be initiated regardless of the reason that triggered its initiation.

delete: <a name="7"> 3. Process insert: </h2>

3.1 Supporting Documentation insert: </h3>

During an audit the RIPE NCC may request any documentation relevant to the under audit matter and it is the Resource Holder’s obligation to assist the RIPE NCC and provide the requested information. insert: </p>

A non-exclusive indication of information and documentation the RIPE NCC may request during an audit is: insert: </p>

insert: <li>
1. Supporting documentation proving the Resource Holder’s existence (e.g. registration papers from the local authorities of the country the relevant organisation is registered, proof of identification in case of a natural person, confirmation by an authorised representative of the organisation) insert: </li>
insert: <li>
2. Contact details of the parties involved insert: </li>
insert: <li>
3. Any additional documentation such as relevant agreements, declarations proving the accuracy and correctness of the data under audit in the RIPE Registry, or court decisions establishing, recognising or ordering a change on the data of the relevant Internet number resources insert: </li>
insert: </ol>

The RIPE NCC reserves the right to check the validity of the provided documentation by requesting support from third parties and/or by undertaking any other action necessary to this regard (e.g. request for the documents to be notarised). For more information, see the RIPE NCC procedural document “ insert: <a href="http://www.ripe.net/publications/docs/due-diligence" data-linktype="external" data-val="http://www.ripe.net/publications/docs/due-diligence"> Due Diligence for the Quality of the RIPE NCC Registration Data 7. Appeals ”. insert: </p>

It shall not be expected that the RIPE NCC will conduct a full audit of all registration data held by a Resource Holder or of their compliance with RIPE Policies, if this is not related to the reason the audit was initiated. It is up to the RIPE NCC to decide to restrict an audit to the particular issue that triggered its initiation or to extend its scope to other matters as well. insert: </p>

3.2 Time Frame   insert: </h3>

The time required for each audit depends on the complexity of each case. However, an audit may not be ongoing for an indefinite period of time. insert: </p>

The RIPE NCC will set concrete time frames within which the requested information must be provided by the Resource Holder under audit and will inform them accordingly. Failure to provide the requested information within the set time frame may constitute the failure of the Resource Holder to comply with the RIPE NCC audits and thus may lead to the termination of the relevant contractual agreement (see points A.1.2.2.h, C.1.2.2.h of the RIPE NCC procedural document “ insert: <a href="http://www.ripe.net/publications/docs/closure" data-linktype="external" data-val="http://www.ripe.net/publications/docs/closure"> Closure of Members, Deregistration of Internet Resources and Legacy Internet Resources insert: </a> ”). insert: </p>

Once all the appropriate actions are undertaken by the RIPE NCC or by the Resource Holder as requested by the RIPE NCC, the audit will be concluded. insert: </p>

3.3 Possible Outcomes of an Audit insert: </h3>

The RIPE NCC may provide recommendations to the under audit Resource Holder and if necessary, request that they make any updates and corrections to their data in the RIPE Registry. The Resource Holder shall comply with the given recommendations in a timely manner. insert: </p>

If the Resource Holder does not assist the RIPE NCC with the audit, remains unresponsive or fails to cooperate with the RIPE NCC’s requests regarding the under audit matter, the RIPE NCC has the right to terminate the relevant contractual agreement (the insert: <a href="http://www.ripe.net/publications/docs/ssa" data-linktype="external" data-val="http://www.ripe.net/publications/docs/ssa"> RIPE NCC Standard Service Agreement insert: </a> , insert: <a href="http://www.ripe.net/publications/docs/legacy-internet-resources-agreement" data-linktype="external" data-val="http://www.ripe.net/publications/docs/legacy-internet-resources-agreement"> RIPE NCC Services for Legacy Internet Resources Agreement (Legacy Agreement) insert: </a> ) and, when applicable, proceed with the deregistration of their Internet number resources in accordance with the RIPE NCC procedural document, “ insert: <a href="http://www.ripe.net/publications/docs/closure" data-linktype="external" data-val="http://www.ripe.net/publications/docs/closure"> Closure of Members, Deregistration of Internet Resources, and Legacy Internet Resources insert: </a> ” (see Section A.1.2.2.d). insert: </p>

If during an audit it is proven that the Resource Holder has provided the RIPE NCC with incorrect or fraudulent information either during the audit, upon the conclusion of the relevant agreement with the RIPE NCC or during its term, the RIPE NCC has the right to terminate the relevant agreement and, when applicable, proceed with the deregistration of their Internet number resources in accordance with the RIPE NCC procedural document “ insert: <a href="http://www.ripe.net/publications/docs/closure" data-linktype="external" data-val="http://www.ripe.net/publications/docs/closure"> Closure of Members, Deregistration of Internet Resources, and Legacy Internet Resources insert: </a> ” (see Section A.1.2.2.g). In particular, if the information the Resource Holder has provided the RIPE NCC with is fraudulent, the RIPE NCC will file a report to the relevant authorities for their further investigation. insert: </p>

In case of Hijacking and in cases where a transfer of Internet number resources has taken place under false or incorrect information and documentation, the RIPE NCC reserves the right to reverse or update the data in the RIPE Registry. insert: </p>

If considered necessary, and in cases where another RIR is involved (e.g. in cases of Inter-RIR transfers), the RIPE NCC may hand information regarding the audit to the relevant RIR for their actions on the matter under audit. insert: </p>

4. Appeal

Audits are carried out in a completely neutral and transparent manner. However, if at any time a RIPE NCC member feels it is appropriate, If the Resource Holder does not agree with the outcome of the performed audit, they may appeal any decision of the auditing team. An appeal is made by applying can apply for arbitration, as described in the RIPE NCC arbitration process: delete: </p> delete: <p> delete: <a href="http://www.ripe.net/membership/arbitration.html"> http://www.ripe.net/membership/arbitration.html the initiation of the insert: <a href="http://www.ripe.net/publications/docs/arbitration" data-linktype="external" data-val="http://www.ripe.net/publications/docs/arbitration"> RIPE NCC Conflict Arbitration Procedure delete: </p> delete: <p> delete: <a href="http://www.ripe.net/ripe/docs/arbitration.html"> http://www.ripe.net/ripe/docs/arbitration.html delete: </a> delete: </p> . insert: </p>