Summary

  • The September 2026 recommended draft would require each RIR to maintain continuity and redundancy procedures and regularly share enough records, data, regional-policy implementation procedures and systems for a temporary operator to provide services if needed.
  • The draft sets safeguards—escrow or data-protection controls, a limited service scope, a 90-day renewal boundary, public rationale and a post-event review—but it is not yet an adopted operating rule, and no real handover is documented here.

A continuity plan that begins when a registry is already unable to work is not much of a plan. The new draft from the Number Resource Organization (NRO) tries to move the first difficult decisions earlier: before a failure, each Regional Internet Registry (RIR) would need to keep procedures and the information needed for a temporary operator to sustain selected services.

The pivotal sentence sits in Section 4.1(m) of the ASO AC Recommended Draft RIR Governance Document, version 3. It would require an RIR to maintain continuity and redundancy procedures. It would also require the RIR, regularly and subject to appropriate escrow or data-protection controls, to share records, data, regional-policy implementation procedures and systems sufficient to let a Temporary Emergency Operator perform RIR services if necessary.

That list matters. An emergency operator may need more than a copy of a registry database. The draft names policy implementation procedures and systems as well as records and data. It describes a readiness relationship that exists before an emergency, rather than an improvised export after an outage. The obligation is qualified: the material must be sufficient for the service, and protection controls apply. The text does not say that all data become public or that every system moves to a second operator.

The draft’s definition of RIR Services includes number-resource delegation and the services resource holders need to use those resources, together with accurate information about who holds them. It specifically includes allocation, registration, directory services and related technical services. That scope makes the handover operationally consequential: bad or stale records could undermine service, while an overbroad transfer could expose sensitive information or give the temporary operator more authority than continuity requires.

The plan is broader than the 90-day clock

Section 5.1 provides the activation path. If an RIR cannot adequately provide all or part of its services—whether for reasons inside or outside its control—a Temporary Emergency Operator may provide the affected part. The RIR itself may initiate an arrangement for its own services. Alternatively, ICANN and two-thirds of the other RIRs may initiate or renew one after discussion with the affected RIR and its community where reasonably possible.

An arrangement may not exceed 90 days unless renewed under the same section. The NRO Number Council’s rationale for version 3 says the draft lowered the activation threshold from unanimity to ICANN plus two-thirds of the RIRs, added the affected RIR’s ability to initiate its own continuity arrangement, and retained the 90-day limit to keep temporary operation from becoming the default. A renewal means 90 days is a decision boundary, not a cumulative maximum.

The affected RIR must cooperate in a temporary handover and keeps the right to resume relevant services once operational capability is restored and verified. The initiating party may increase or decrease the service scope during an arrangement or on renewal. That makes the handover reversible in principle. It also raises practical questions: who verifies recovery, which tests count, how data are reconciled, and how authority expires after return?

The draft does require a public record. ICANN must publish the rationale and scope promptly; community engagement must begin as soon as reasonably practicable. After the arrangement ends, the RIRs and ICANN must jointly publish a review covering the event, services provided, duration, return process, operator performance, community feedback and recommendations. Those records could make a future emergency auditable, but only if scope and measures are specific enough to compare the promise with what happened.

This mechanism is not the same as derecognition. Section 6 makes derecognition a separate process for material non-compliance after a reasonable chance to remedy it. A derecognized RIR must transfer its services under a Transition Plan and cease responsibility. Emergency continuity instead permits temporary service substitution while the affected RIR retains a route back. Section 6.9 connects the two by requiring collective readiness to transfer services in either circumstance; it does not collapse them into one decision.

The drafting status matters

Version 3 is a recommended draft, not an adopted rule. The NRO’s 28 July announcement says the ASO Address Council delivered the draft to the NRO Executive Council, which would coordinate next stages toward a final version. AFRINIC’s 1 September publication presents the draft, redline and rationale and says any further opportunity for input would be announced by the NRO EC. The draft itself anticipates jointly adopted implementation procedures. Those procedures can set minimum requirements, while the text says their absence does not prevent the document’s enforceability once in force.

The most useful next evidence would not be another statement of intent. It would be an implementation plan specifying what is escrowed, how often it is refreshed, how access is authorized and logged, which services can be activated independently, what proves recovery, and how the temporary copy is revoked or reconciled. A tabletop exercise could test the transition without claiming that production services have failed. A public report should separate what was made available from what the temporary operator actually used.

The draft’s advance-sharing duty is a meaningful change in design: it moves continuity preparation into ordinary operations. Whether it produces resilience will depend on whether “regularly,” “sufficient,” “appropriate controls” and “verified” become testable arrangements rather than words left for the crisis itself.

Sources

As of 15 October, the NRO’s process timeline still lists final drafting as in progress: updates are scheduled at ICANN 87 (17–22 October), LACNIC 46 (19–22 October), ARIN 58 and RIPE 93, with approval and adoption listed for Q4 2026.