Summary

  • RIPE NCC says its new enterprise register begins with an organisation-wide, top-down view of high-impact risks.
  • The Board tied some mitigations to correct budget levels, but the Draft minutes name no risks, owners, amounts, deadlines or metrics.

Analysis

At its 14–15 September meeting, the RIPE NCC Executive Board heard the first public description of a new enterprise risk register. Chief Information Security Officer Eleonora Petridou presented an organisation-wide view focused on the risks that matter most to RIPE NCC. The Draft minutes say these risks came from holistic top-down analysis, rather than the bottom-up register presented in the past. This changes how the enterprise picture is assembled; it does not say team-level risk work has ended.

The discussion moved to treatment. Petridou described organisation-level management and operational measures; Managing Director Hans Petter Holen outlined plans already in place. Board members said some mitigations depended on correct budget levels. Holen agreed spending should be examined for good outcomes. The record establishes a budget dependency, not a funding gap: it names no affected risk, amount, owner, deadline or progress measure. The same update called for more regular government and regulator engagement. Final minutes from December 2025 describe annual team-level register reviews, so the new view does not prove those stopped.

September minutes remain Draft and identify no specific impact on members.

At the next Board meeting, on 23 September, directors approved publication of the Draft Activity Plan and Budget 2027. Its minutes record EUR 42.5 million in expected income, EUR 44.2 million in costs and a EUR 1.1 million overall budgeted deficit. They also describe a EUR 5–10 million decision range for IT infrastructure investment, with a EUR 5 million route carrying lower resilience. The minutes do not map those figures or projects to a named enterprise risk. They provide budget context, not evidence that a particular mitigation was funded or left unfunded.

Sources