Summary

  • The public 2025 audit of IANA’s Registry Assignment and Maintenance Systems gives a favorable opinion on security, availability and processing-integrity controls for 1 December 2024 through 30 November 2025. ICANN separately says the confidential SOC 2 examination found one exception in November 2025 and that it took immediate remedial steps.
  • IANA publishes the SOC 3 report while supplying the SOC 2 to contractual oversight bodies. The public record names neither the failed control nor the affected test. The audit’s own boundary runs from an assignment request to the published registry update; the policy that decides who qualifies is made elsewhere.

A verdict with a missing line item

There are two documents on the table. In the twelve-page public report, the independent auditor says ICANN’s assertion about controls within the PTI Registry Assignment and Maintenance Systems, or RAMS, is fairly stated in all material respects. The opinion covers a full year, from 1 December 2024 to 30 November 2025. The criteria are security, availability and processing integrity. The opinion is dated 12 May 2026.

In the announcement that released the audit results, ICANN says the companion SOC 2 audit identified one exception in November 2025. It says it took immediate steps to remedy the issue. That is the only public description of this exception in the checked records. A reader can know that an auditor found something and that the operator responded. The reader cannot tell whether the issue concerned access, an approval, a change, a recovery test or another control.

The favorable opinion and the exception are different levels of statement. The first is a conclusion about management’s assertion and the applicable criteria in all material respects. The second is one finding from an examination whose detailed report is confidential. Neither sentence cancels the other. Calling the public opinion a certificate of flawless operation would erase ICANN’s own disclosure. Calling the exception a registry failure would invent a transaction the public record never identifies.

That leaves a narrower, harder question: who can inspect the exception and judge the repair? IANA’s audit-program page says the SOC 2 report goes to relevant oversight bodies under the PTI–ICANN contract, the ICANN–IETF memorandum, and ICANN’s numbering-service agreement with the five regional Internet registries. The SOC 3 report is the version for everyone else. This is a designed division of access. It gives the public a result and gives specific counterparties the detailed examination.

The machine the auditor actually examined

The public report is useful precisely because it draws a line around its subject. RAMS covers the Root Zone Management System and Request Tracker, the tools through which IANA receives and processes requests across domain names, number resources and protocol parameters. The report says the boundary begins with a request to obtain an assignment or allocation. It ends when the approved record or update appears in a public registry. Between those points lie intake, status, approval handling, system access, change management and publication.

That is an important conveyor belt. A protocol parameter can be correctly registered only if the request and publication steps work. A number block allocated to a regional registry must be handled under the relevant authorization and service rules. A root-zone change must pass the appropriate technical and procedural checks before the public record changes. The audit gives evidence about the controls around that work. It also states that the auditor examined ICANN’s assertion, rather than offering a transaction-by-transaction guarantee for every row a reader might inspect today.

The policy that gives a request its meaning sits upstream. The same public report says PTI does not set policy for the services it operates. Stakeholder communities develop the rules; ICANN supports policy development for domain names and number resources; the IETF develops protocol specifications and associated parameter instructions. Then PTI implements. A well-controlled implementation can faithfully execute a rule that people still dispute. The rule’s mandate must be tested in its own forum, with its own decision record.

This separation is especially easy to lose when an audit result is used as a badge for an institution as a whole. The auditor did not examine whether a regional registry has the right to impose every condition it writes into an address policy. The auditor examined control effectiveness against stated service commitments and system requirements inside a defined processing system. “Audited” names the work done at one part of the chain. It cannot silently annex the decisions made before the request arrived.

The report also names a second perimeter. It describes third-party colocation and managed-service arrangements and the kinds of complementary controls expected there. The auditor explicitly excluded those providers’ services and controls from this examination. A reader who needs assurance across the entire hosting chain has to follow that dependency to its own evidence. That is a normal feature of scoped audits, but it matters when a broad headline compresses several separate systems into one word: “IANA.”

Two years of public visibility

The reporting architecture itself changed recently. In June 2025, ICANN said it had introduced a public SOC 3 report for RAMS alongside the existing SOC 2. The 2025-period report is the second public RAMS SOC 3. Opening that document gave outsiders an auditor’s opinion, the described system boundary and the principal service commitments. It made the control story less dependent on press-release adjectives.

The next year exposed the cost of the split. ICANN’s June 2026 announcement disclosed one exception in the confidential examination, while the public report continued to present a favorable opinion. The public has enough information to ask a specific question, yet not enough to answer it. “One exception” is a count, not a location. “Immediate steps” describes response timing, not the control tested afterward. A short public description of the affected control family, the time of correction and the validation performed would let a reader evaluate closure without exposing credentials or internal system details.

The official record checked here supplies none of those three points.

IANA publishes other operational evidence through its performance pages: service-level reports, root-zone operations data and statistics for number and protocol work. Those records can illuminate the handling of specific classes of request. They cannot locate a SOC 2 exception whose subject is undisclosed. Looking at a green service-level chart and guessing what happened in a confidential control test would just replace one missing record with a story.

The root-key result demands the same precision. ICANN announced a sixteenth consecutive exception-free audit of the DNS root Key Signing Key management system. That is the separate root-KSK SOC 3 examination. The one exception belongs to the RAMS SOC 2, as ICANN describes it. Combining them under the phrase “the IANA audit” would borrow a clean result from one system to tidy a disclosed finding in another.

Who holds the useful document

The contractual arrangement has a practical defense: a detailed control report can reveal sensitive infrastructure, access or test information. Its recipients have defined oversight relationships and can ask questions the public cannot. The public has a different interest. It relies on the integrity of names, number allocations and protocol registries, and its scrutiny of broad institutional claims needs more than a verdict detached from a known exception.

There is a reasonable middle between publishing every test and publishing no actionable description. ICANN could identify the control category and remedial verification at a level that protects operational secrets. The oversight bodies could then explain, within their own mandates, whether the exception touched the service they oversee. None of that requires the public to receive the confidential SOC 2. It requires a traceable bridge from the operator’s one-sentence disclosure to a reviewable outcome.

That bridge also keeps the three governance layers separate. Policy makers own the decision rule. PTI owns the processing machinery. Contractual overseers own their examination of the operator. The public verdict is strongest when it says exactly which of those layers it covers and when a disclosed exception can be closed with evidence. A favorable audit opinion should be read carefully. It deserves better than being used as a universal seal.