1. Risk management Giovanni Seppia giovanni@centr.org wwTLD meeting
Mar Del Plata, 3 March 2005

2. What is risk?
“Risk can be defined as the combination of the probability of an event and its consequences. In all types of undertaking, there is the potential for events and consequences that constitute opportunities for benefits (upside) or threats to success (downside).”

3. CENTR approach, first step
Questionnaire with 5 questions designed not to be too invasive (circulated in September 04)
12 replies

4. CENTR questionnaire (1)
Has your registry developed a contingency plan in case of natural disasters or business failure?
Only 4 registries have a complete plan
For the others, it is not complete or “in progress”
In certain cases the lack of the business failure plan could depend on the “institutional/public nature” of the registry

5. CENTR questionnaire (2)
Do you have any insurance that covers risky aspects of your business?
2 registries have no insurance
Most of the others has partial insurance cover
Do you store data backups in a remote location?
Almost all positively replied

6. CENTR questionnaire (3)
Do you periodically review your network security?
All positively replied
Are you interested in learning more about mitigating risks?

7. CENTR approach, second step
Large interest of all members for this subject
Decision to develop a tool to make registries able to evaluate the risk context
Creation of a working group to tailor-make the template according to the specific need of most registries
Willingness to provide CENTR members with a dynamic instrument that will be periodically updated

8. How to read the template (1)
The online template should help registries’ managers to:
Identify the risk their registry can cope with
Quantify the level of the risk
Prepare necessary countermeasures in case “it happens”

9. How to read the template (2)
Risks are classified as:
Financial
Regulatory
Distractional
Reputational
Procedural
Premises (including external data centres)
People
Corporate governance
Obsolescence
Health and safety
Technical

10. Countermeasures Classified in five areas:
Minimise likelihood of the event happening
Lessen its impact if it does happen
Transfer the risk to a third party
Live with the risk, but insure against it
Plan the reaction: what to do when the event happens

11. Risk template

12. Risk profile results

13. Conclusions Murphy’s law can teach you a lot
Always remember that many external and internal factors have an impact on your activities
Think constantly about the level of service you like to provide to your customers
Do not be scared to look for help
Do not make any risk or threat to find you unprepared

14. Conclusions Registries can “fight” risks through:
Strategic-contingency plans
Operational plans
Insurance policies
Whatever you can do, never forget that the solution lies in your hands and that it is impossible to build a plan to avoid all risks

15. Thanks for your attention
Giovanni Seppia
wwTLD meeting
Mar Del Plata, 3 March 2005