Summary

  • LACNIC’s Board approved policy version DIR-POL-005.05 after recording that maximum-rated residual risks should reach the Board Risk Committee immediately, receive a treatment within no more than 90 days, and be moved out of that zone in less than 120 days.
  • The public minute gives the durations but not the start event, acceptance event or exit evidence. A privacy-safe clock receipt would make the governance promise auditable without exposing the risk itself.

A strong rule in a compressed record

Deadlines are easy to applaud because numbers look like discipline. LACNIC’s Board minute for 23 February 2026 offers three of them, or close equivalents, in one short paragraph. Residual risks in the zone of maximum valuation are to be reported immediately to the Board Risk Committee. A treatment is to be presented within no more than 90 days. The objective is to lower the risk out of that zone in less than 120 days. The Board then approved the updated Risk Management Policy unanimously as version DIR-POL-005.05.

That is a stronger public signal than the usual promise to “monitor” a problem. It identifies a severity state, an oversight body, an intermediate action and a desired terminal state. It also distinguishes residual risk—the exposure left after controls—from an unqualified list of possible hazards. On the face of the minute, a maximum-zone residual risk is not meant to sit indefinitely in a dashboard. It enters a governed sequence.

The strongest defence of LACNIC should come before the criticism. Serious institutional risks can concern vulnerabilities, suppliers, staff, financial contingencies or response plans whose disclosure would make the organisation less safe. The minute does not need to name them. It also shows that operational management, a Board committee and the full Board occupy different parts of the authority chain. A later minute, for the meeting of 24 May, says staff presented a summary of risk revaluation, treatment and mitigating controls that had already gone to the Board Risk Committee. There is visible governance here.

The gap is narrower. The public record tells readers the length of two clocks without telling them where the clocks begin.

Three verbs, three states

The February text compresses three different acts: inform, present and lower. They should not be read as synonyms.

“Inform immediately” is an escalation event. It should change who knows about the risk and who may demand action. “Present a treatment” is a governance event. A plan can be delivered, returned for revision, accepted with conditions or superseded; presentation alone does not reduce exposure. “Lower it out of the zone” is a risk-state event. It requires a new assessment under the applicable methodology, not merely a document on a committee agenda.

The distinction matters because the two numerical limits can overlap in several ways. Both might run from the moment a residual risk is classified in the maximum zone. The 120-day objective might instead begin after committee notification, after treatment approval, or after an assessment becomes final. A contested classification could pause neither clock, one clock or both. A risk that drops below the threshold and then returns could retain its original case, reopen it, or acquire a new one.

None of those possibilities is evidence of how LACNIC actually operates. They are exactly the possibilities the public minute leaves unresolved. The full policy may answer every one of them. Internal systems may timestamp the sequence perfectly. The minutes checked for this article do not expose those fields, so an outside reader cannot reconstruct the promised lifecycle from the public evidence alone.

That boundary also prevents a tempting but invalid conclusion. The minute does not say that any maximum-zone risk existed. It does not show that a 90-day or 120-day period started. It therefore supplies no basis for saying a deadline was met, missed or extended. A general rule is not an incident report.

What the May update does—and does not—close

The May Board minute gives the next visible piece of the institutional rhythm. Staff summarized work on revaluation, treatment and mitigating controls, and the minute records that the material had previously been presented to the Board Risk Committee. That is consistent with the oversight arrangement described in February. It is useful evidence that risk work continued through the committee channel.

It is not a risk-by-risk receipt. The May record does not say whether its summary included a risk in the maximum zone, whether any February clock had been activated, which treatment belonged to which assessment, or whether a risk had crossed a threshold. The responsible reading is neither “nothing happened” nor “the deadlines were satisfied.” It is simply that the aggregate update and the lifecycle proof are different evidence objects.

The November 2024 minute helps with version lineage. It records unanimous approval of DIR-POL-005.04. In a nearby discussion about document histories, management said earlier versions were stored separately and a director argued that a compilation exercise was unnecessary. That does not prove the current policy is unavailable, nor does it establish what .05 contains beyond the February description. It shows why minutes and version identifiers should be treated as a trail, not as substitutes for one another.

A clock needs a receipt

A public deadline becomes verifiable when five things can be joined: the trigger, the clock basis, the accountable authority, the completion event and the correction history. LACNIC could publish that join without revealing a risk description.

The practical unit would be a maximum-risk clock receipt. It could use an opaque identifier and record the timestamp at which the residual risk entered the maximum zone; the timestamp of immediate notice to the Board Risk Committee; the stated basis for each clock; the treatment deadline and the event that counts as submission or acceptance; the accountable owner and approving authority; the target exit date; the current zone; and a coarse evidence class. Exception, pause, reopening and correction fields would keep the record honest when reality refuses to follow a straight line.

An entry might therefore say that confidential risk R-27 entered a governed state on one date, was notified on another, had a treatment accepted under a named authority, and later left or remained in the zone. It need not say whether the underlying matter was a security weakness, a provider dependency or a financial exposure. Public governance needs the state transitions, not the exploit instructions.

The receipt should also preserve the exact force of the February language. The 90-day phrase is a maximum period for presenting treatment. The under-120-day phrase is an objective for leaving the zone. Turning the second into a guarantee would make the public account more definite than the Board’s own record. Turning the first into proof of mitigation would collapse a plan into an outcome. Good evidence resists both upgrades.

Why network operators should care

LACNIC sits inside the operating fabric of Internet number resources in Latin America and the Caribbean. Its registry, allocation, routing-security and community functions depend on institutional continuity, even when the risk in question is not itself a routing event. Members and operators do not need access to a sensitive risk register to ask whether a high-severity governance rule produces a traceable sequence.

The same distinction applies inside networks. An alert, an approved remediation plan and a changed residual-risk score are not one event. If they are stored as one status, accountability becomes a matter of narrative reconstruction after the fact. If their timestamps and authorities are joined, management can see delay without exposing the payload that made the case sensitive.

LACNIC’s February minute has already done the difficult part: it has made time part of the rule. The modest next step is to show what starts that time and what stops it. Two clocks are a governance promise. A receipt is what lets the public read them.

Sources