This is a procedural document that describes the audit activity of the RIPE NCC.
Abstract
1. Introduction Link: #1
2. Goals Link: #2
3. Principles Link: #3
4. Types Link: #4
5. Process Link: #5
6. Compliance Measures Link: #6
7. Appeals Link: #7
At the 1996 Contributors Committee Meeting the RIPE NCC was asked to significantly increase its efforts to ensure the validity of registry data. Audit has been a specific activity of the RIPE NCC since that time.
Audit activity is done to ensure fair and neutral application of policies set by the RIPE community, to the general benefit of the Internet.
Auditing can also provide the RIPE community with information about specific policy areas where problems are occurring, helping to ensure the efficient investment of resources in appropriate areas. This can include policy areas that need revision by the RIPE community, or areas where the RIPE NCC can improve compliance through better education and communication with the membership.
Audit evaluation is based on compliance with the RIPE community policies current at the time of the audit. Audits are conducted with the intent to educate RIPE NCC members on how to achieve compliance.
Members that are already working in compliance with the RIPE community policies will have as little disturbance to their operations as possible.
Impartiality and confidentiality are given the highest priority throughout the audit process.
The member to be audited is chosen by the RIPE NCC at random.
A member is selected because of an internal report or due to a lack of contact between the RIPE NCC and the member.
The member has requested the audit themselves or there has been a community complaint made against them that requires investigation.
The RIPE NCC informs the member that they are in audit and then provides individual assistance in checking LIR data, resource records and validity of RIPE Database records.
The RIPE NCC has a mandate from the RIPE community to keep an up-to-date and correct Internet number resource registry (RIPE Registry).
RIPE community policies are based on current policies and on the service agreements signed with RIPE NCC members.
The RIPE NCC will provide audit subjects with individual assistance and education, and will make every effort to help members comply with the policies. If the member is found to be unable to comply with the RIPE community policies, further measures may be necessary. This may include, but is not restricted to, a review of the audited organisation's membership status.
This document outlines the audit activity the RIPE NCC performs.
Every party that has entered into an agreement with the RIPE NCC is contractually obliged to provide the RIPE NCC with complete, updated and accurate information necessary for the provision of RIPE NCC services and to assist the RIPE NCC with audits and security checks (Article 6.2. of the RIPE NCC Standard Service Agreement Link: http://www.ripe.net/publications/docs/ssa , RIPE NCC procedural document “Due Diligence for the Quality of the RIPE NCC Registration Data Link: http://www.ripe.net/publications/docs/due-diligence ”).
More specifically, it is the contractual obligation of:
For the purposes of this document either of the above is referred to as “Resource Holder”.
The Internet number resources that may be subject to an audit are:
http://www.ripe.net/ripe/docs/arbitration.html Link: http://www.ripe.net/ripe/docs/arbitration.html
Depending on the reason an audit is initiated, the RIPE NCC performs the following types of audits:
The Assisted Registry Check (ARC) is an audit the RIPE NCC performs with the aim of providing personalised support to a Resource Holder that is a RIPE NCC member in order to help them keep their data in the RIPE Registry correct and accurate.
An ARC may be initiated upon a RIPE NCC member’s request or the RIPE NCC’s selection of a member on a random basis or due to a specific matter regarding this member.
During an ARC the RIPE NCC, together with the relevant member, will review the member’s data in the RIPE Registry, including the accuracy of their legal name, address, contact details, their registered contact persons, and the correctness of the registration of the relevant Internet number resources in the RIPE Database, etc.
The RIPE NCC may initiate an audit on its own initiative when there are suspicions that a Resource Holder is maintaining inaccurate data in the RIPE Registry, is in violation of the RIPE Policies and/or the RIPE NCC procedures.
Depending on the reason a selected audit was initiated and when this is considered appropriate, the RIPE NCC may inform the relevant Resource Holder that they are being audited and request any relevant information.
A reported audit may be initiated as a reaction to a complaint submitted to the RIPE NCC by a third party.
Upon receipt of such a complaint, the RIPE NCC will evaluate its merits and if sufficient evidence is provided by the reporting party, the RIPE NCC will initiate the audit and investigate the matter further.
Unless it is proven that the reporting party has a valid claim on the Internet number resources under audit, the RIPE NCC will not report its findings to the reporting party due to confidentiality reasons.
Note
For the purposes of the RIPE NCC audit activity ‘’Hijacking’’ is referred to any attempt to gain control of, or acquire, Internet number resources under false pretenses. In cases of suspected Hijacking, any type of audit, as deemed appropriate by the RIPE NCC and described in Section 2.0 of this document, may be initiated regardless of the reason that triggered its initiation.
During an audit the RIPE NCC may request any documentation relevant to the under audit matter and it is the Resource Holder’s obligation to assist the RIPE NCC and provide the requested information.
A non-exclusive indication of information and documentation the RIPE NCC may request during an audit is:
The RIPE NCC reserves the right to check the validity of the provided documentation by requesting support from third parties and/or by undertaking any other action necessary to this regard (e.g. request for the documents to be notarised). For more information, see the RIPE NCC procedural document “Due Diligence for the Quality of the RIPE NCC Registration Data Link: http://www.ripe.net/publications/docs/due-diligence ”.
It shall not be expected that the RIPE NCC will conduct a full audit of all registration data held by a Resource Holder or of their compliance with RIPE Policies, if this is not related to the reason the audit was initiated. It is up to the RIPE NCC to decide to restrict an audit to the particular issue that triggered its initiation or to extend its scope to other matters as well.
The time required for each audit depends on the complexity of each case. However, an audit may not be ongoing for an indefinite period of time.
The RIPE NCC will set concrete time frames within which the requested information must be provided by the Resource Holder under audit and will inform them accordingly. Failure to provide the requested information within the set time frame may constitute the failure of the Resource Holder to comply with the RIPE NCC audits and thus may lead to the termination of the relevant contractual agreement (see points A.1.2.2.h, C.1.2.2.h of the RIPE NCC procedural document “Closure of Members, Deregistration of Internet Resources and Legacy Internet Resources Link: http://www.ripe.net/publications/docs/closure ”).
Once all the appropriate actions are undertaken by the RIPE NCC or by the Resource Holder as requested by the RIPE NCC, the audit will be concluded.
The RIPE NCC may provide recommendations to the under audit Resource Holder and if necessary, request that they make any updates and corrections to their data in the RIPE Registry. The Resource Holder shall comply with the given recommendations in a timely manner.
If the Resource Holder does not assist the RIPE NCC with the audit, remains unresponsive or fails to cooperate with the RIPE NCC’s requests regarding the under audit matter, the RIPE NCC has the right to terminate the relevant contractual agreement (the RIPE NCC Standard Service Agreement Link: http://www.ripe.net/publications/docs/ssa , RIPE NCC Services for Legacy Internet Resources Agreement (Legacy Agreement) Link: http://www.ripe.net/publications/docs/legacy-internet-resources-agreement ) and, when applicable, proceed with the deregistration of their Internet number resources in accordance with the RIPE NCC procedural document, “Closure of Members, Deregistration of Internet Resources, and Legacy Internet Resources Link: http://www.ripe.net/publications/docs/closure ” (see Section A.1.2.2.d).
If during an audit it is proven that the Resource Holder has provided the RIPE NCC with incorrect or fraudulent information either during the audit, upon the conclusion of the relevant agreement with the RIPE NCC or during its term, the RIPE NCC has the right to terminate the relevant agreement and, when applicable, proceed with the deregistration of their Internet number resources in accordance with the RIPE NCC procedural document “Closure of Members, Deregistration of Internet Resources, and Legacy Internet Resources Link: http://www.ripe.net/publications/docs/closure ” (see Section A.1.2.2.g). In particular, if the information the Resource Holder has provided the RIPE NCC with is fraudulent, the RIPE NCC will file a report to the relevant authorities for their further investigation.
In case of Hijacking and in cases where a transfer of Internet number resources has taken place under false or incorrect information and documentation, the RIPE NCC reserves the right to reverse or update the data in the RIPE Registry.
If considered necessary, and in cases where another RIR is involved (e.g. in cases of Inter-RIR transfers), the RIPE NCC may hand information regarding the audit to the relevant RIR for their actions on the matter under audit.
If the Resource Holder does not agree with the outcome of the performed audit, they can apply for the initiation of the RIPE NCC Conflict Arbitration Procedure Link: http://www.ripe.net/publications/docs/arbitration .