Summary

  • ARIN's newly posted security deck counts 217 SOC 2 controls. Its departmental breakdown puts 59% with Engineering and 15% with Information Security.
  • More than half the controls span both organization-wide and ARIN Online/RPKI systems; ARIN is preparing to bring ARIN Online into its SOC 2 program.

A security certificate may hang on one wall. The paperwork lives in several departments. In its ARIN 58 information-security slides, ARIN gives that usually invisible workload a sharp outline: 217 controls in its SOC 2 program, with Engineering accounting for 59% of the departmental breakdown. Information Security accounts for 15%, human resources 12%, executive functions 5%, Finance 5% and Governance 4%.

The figures describe ARIN's control map, not a stopwatch for staff hours. They do show where the registry says a large share of accountable control work sits. The slide adds that most controls need evidence from multiple teams and systems. An engineer may operate a system, a security specialist may review it, and an auditor still needs a trail that joins their records. The rubber stamp comes last.

ARIN also splits the 217 controls by reach. Twenty-seven percent are organization-wide, 22% are specific to a product or service such as ARIN Online or RPKI, and 51% apply to both. That last group is the awkward bridge: a common policy has to meet the machinery that customers actually use. If the evidence stops at a policy document, the bridge has only one bank.

The scope is moving. ARIN's standing security page says its RPKI platform completed a SOC 2 Type II audit in October 2023. The new deck says ARIN is preparing to add ARIN Online to its SOC 2 program. Its separate PCI DSS scope already covers ARIN Online's payment-card environment. Bringing the broader account portal into SOC 2 would put more customer-facing workflows inside the evidence map; the deck presents that as preparation, not a completed 2026 audit.

ARIN reports monthly vulnerability scanning and review, phishing exercises, Board and internal incident-response exercises, and support for its Risk & Cybersecurity Committee. Its security page says outside audit findings go to the Board and remediation is scheduled when needed. The governance story is in that chain: a control owner, evidence from the operating system, review across teams, and a Board able to ask what changed. ARIN has published the department-sized map. The next useful public milestone is the actual scope and result when ARIN Online joins the audit program.