Audit Programs

We are committed to ensuring the security and stability of the Internet's unique identifier systems. As part of this commitment, we conduct audits each year on different aspects of the IANA functions we provide. These audits evaluate our system and organization controls (SOCs) against the “Trust Services Principles and Criteria”, and are conducted by an independent accounting firm.

Root Zone KSK System

This audit validates the internal controls in place to meet the availability, processing integrity and security objectives for our role as the DNSSEC Root Zone Key Signing Key manager. This system is audited according to the SOC 3 framework.

SOC 3 Report Latest

Covering 1 December 2024 to 30 November 2025.

Registry Assignment and Maintenance Systems

This audit validates the internal controls in place to meet the availability, processing integrity and security objectives for the key systems used to support the IANA function’s transaction processing. These systems are referred to as our Registry Assignment and Maintenance Systems (RAMS), and include the Root Zone Management System, and the systems used to manage IETF protocol parameter registries and number allocation requests. The RAMS are audited according to both the SOC 2 and SOC 3 framework.

The SOC 2 audit report is a confidential report provided to the relevant oversight bodies to fulfill a requirement of the contract between PTI and ICANN; the Memorandum of Understanding between ICANN and the IETF; and the SLA contract between ICANN and the five Regional Internet Registries. The SOC 3 report is published here.

SOC 3 Report Latest

Covering 1 December 2024 to 30 November 2025.

About the Trust Services Principles and Criteria

The Trust Services Principles and Criteria is an international set of principles and criteria developed and managed jointly by the American Institute of Certified Public Accountants (AICPA) and the Canadian Institute of Chartered Accountants (CICA). The SOC 2 and SOC 3 examination is a rigorous process developed by the AICPA and CICA to provide independent assurance that an organization's systems are reliable. Our SOC certification and reports focus on the following Trust Services principles:

• Availability — the system was available for operation and use, as committed or agreed
• Processing Integrity — the system processing was complete, accurate, timely, and authorized
• Security — the system was protected against unauthorized access

Each principle is supported by well-defined and detailed criteria that encompass a company's infrastructure, software, data, people, and procedures.

Audit Archive