<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
span.apple-converted-space
{mso-style-name:apple-converted-space;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style>
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal">Hi Alan,<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Thank you for your question regarding NIS2 at last month’s General Assembly. As promised, here is a detailed response (below my signature), provided by our Government Engagement colleagues. If you have any further questions, please do not
hesitate to reach out. I am copying the NARALO list so they can be informed of the response as well.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Best,<o:p></o:p></p>
<p class="MsoNormal">Joe<o:p></o:p></p>
<p class="MsoNormal">---<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><span style="color:black">The NIS2<span class="apple-converted-space"> </span>Directive<span class="apple-converted-space"> </span>will soon become law. A political agreement between the so-called co-legislators, the European Parliament
and the Council (the<span class="apple-converted-space"> </span>EU institution bringing together<span class="apple-converted-space"> </span>the 27 member states), was reached this summer (see the text<span class="apple-converted-space"> </span><a href="https://www.europarl.europa.eu/meetdocs/2014_2019/plmrep/COMMITTEES/ITRE/DV/2022/07-13/LettertoEP_Annex_1streading_NIS2_EN.pdf" title="https://www.europarl.europa.eu/meetdocs/2014_2019/plmrep/COMMITTEES/ITRE/DV/2022/07-13/LettertoEP_Annex_1streading_NIS2_EN.pdf"><span style="color:#0563C1">here</span></a>)
and the entire process should be concluded by the end of the year (expectedly in November).<o:p></o:p></span></p>
<p class="MsoNormal" style="font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;caret-color: rgb(0, 0, 0);word-spacing:0px">
<span style="color:black"> <o:p></o:p></span></p>
<p class="MsoNormal" style="font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;caret-color: rgb(0, 0, 0);word-spacing:0px">
<span style="color:black">The law should be then effective around Q3-Q4 2024,<span class="apple-converted-space"> </span>as a Directive<span class="apple-converted-space"> </span>is not directly applicable and member states will have to implement it nationally.<span class="apple-converted-space"> </span><o:p></o:p></span></p>
<p class="MsoNormal" style="font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;caret-color: rgb(0, 0, 0);word-spacing:0px">
<span style="color:black"> <o:p></o:p></span></p>
<p class="MsoNormal" style="font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;caret-color: rgb(0, 0, 0);word-spacing:0px">
<span style="color:black">The<span class="apple-converted-space"> </span>NIS2 imposes cybersecurity measures and cyber incident related reporting obligations to operators of essential and important entities<span class="apple-converted-space"> </span>and applies
to all providers of DNS services, with the exception of root servers.<o:p></o:p></span></p>
<p class="MsoNormal" style="font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;caret-color: rgb(0, 0, 0);word-spacing:0px">
<span style="color:black"> <o:p></o:p></span></p>
<p class="MsoNormal" style="font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;caret-color: rgb(0, 0, 0);word-spacing:0px">
<span style="color:black">The main responsibilities for DNS operators, as operators of essential services under NIS2 are: (a) implementation of appropriate and proportionate technical and organizational measures, (b) reporting obligations to the competent authorities
or the established computer security incident response teams (CSIRT) of any incident having a significant impact on the provision of their services, (c) provide contact details for the registry of essential entities to ENISA (d) if a DNS service provider is
not established in the EU and offers services in the EU, it should designate a representative.<o:p></o:p></span></p>
<p class="MsoNormal" style="font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;caret-color: rgb(0, 0, 0);word-spacing:0px">
<span style="color:black"> <o:p></o:p></span></p>
<p class="MsoNormal" style="font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;caret-color: rgb(0, 0, 0);word-spacing:0px">
<span style="color:black">The NIS2 also includes provisions on collection and access to registration data, in Article 23, that will require the contracted parties to take steps (both on public access and responding to requests for non-public data). The text,
as agreed, leaves leeway to member states to<span class="apple-converted-space"> </span>possibly<span class="apple-converted-space"> </span>introduce different requirements<span class="apple-converted-space"> </span>in the implementation of Article 23.<span class="apple-converted-space"> </span> and
there is the risk that member states would mandate different requirements. There could also be differences with ICANN’s policies.<o:p></o:p></span></p>
<p class="MsoNormal" style="font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;caret-color: rgb(0, 0, 0);word-spacing:0px">
<span style="color:black"> <o:p></o:p></span></p>
<p class="MsoNormal" style="font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;caret-color: rgb(0, 0, 0);word-spacing:0px">
<span style="color:black">Recital 62 provides that “the Commission may adopt guidelines” with regard to<span class="apple-converted-space"> </span>access to registration data.<o:p></o:p></span></p>
<p class="MsoNormal" style="caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;word-spacing:0px">
<span style="color:black"> <o:p></o:p></span></p>
<p class="MsoNormal" style="caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;word-spacing:0px">
<span style="color:black">As regards data collection and maintenance policies that<span class="apple-converted-space"> </span>TLD registries and the entities providing domain name registration services for the TLD should establish<span class="apple-converted-space"> </span>under
NIS2, Recital 61 provides that “policies and procedures should take into account to the extent possible the standards developed by the multi-stakeholder governance structures at international level”. The same wording is included in Recital 62 with regard to<span class="apple-converted-space"> </span>policies
and procedures for the publication and disclosure of registration data.<o:p></o:p></span></p>
<p class="MsoNormal" style="caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;word-spacing:0px">
<span style="color:black"> <o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal">-- <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><span style="color:black">Joe Catapano<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black">Stakeholder Engagement Senior Manager<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black">Internet Corporation for Assigned Names and Numbers<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black">Direct: +1.202.249.7544<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black">Mobile: +1.202.550.6018<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black">Twitter: @JosephCatapano <o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</body>
</html>