Summary

  • ARIN's security chief said on 23 October that ARIN Online entered the SOC 2 program for the first time in 2026, alongside RPKI. The expanded audit was near completion; its report was not yet available.
  • The SOC 3 report currently linked on ARIN's security page names the RPKI Platform alone and covers 1 October 2024 to 30 September 2025. Its system boundary and clock matter more than a generic assurance badge.

A registry account can authorize changes to valuable number records. The security of that account portal is therefore a member concern, not a decorative line in an annual slide deck. At ARIN 58, Chief Information Security Officer Christian Johnson said ARIN Online had joined the SOC 2 program for the first time in 2026. He expected the larger audit's report within weeks or about a month. On 23 October it was still unfinished. That sequence is in ARIN's meeting transcript.

The downloadable SOC 3 report answers a different, narrower question. Its cover and auditor's opinion identify ARIN's RPKI Platform and the period from 1 October 2024 through 30 September 2025. The opinion is dated 6 November 2025. A member looking for independent evidence about the newly included account portal cannot get it by reading the old RPKI scope as though the words “ARIN Online” appeared there. A report is useful precisely because it names the system, period, criteria and opinion.

Johnson described about 217 security controls, with evidence drawn across departments and products. ARIN reports training, phishing exercises and vulnerability scans. Those activities help explain the work behind the audit, but a control count cannot substitute for the auditor's signed conclusion on the enlarged boundary. He also identified PCI DSS as covering the payment-card environment within ARIN Online. That is a focused payment scope; the SOC 2 expansion concerns the portal and RPKI as named systems.

ARIN's security page tells customers how to request its fuller SOC 2 Type II report through Ask ARIN and links the public SOC 3. It still points readers to the RPKI-only report. This is an unusually clean evidence test for a registry: ask for the 2026 opinion, check whether ARIN Online appears in the system description, read the audit period and examine any exceptions. The calendar is the issue now. A promised audit is an activity; the signed report is the artifact members can inspect.

The 2026 auditor opinion and its precise system boundary are the missing facts. When ARIN releases them, the gap between expanded scope and public evidence closes—or becomes a finding in its own right.