The Internet Corporation for Assigned Names and Numbers (ICANN) has completed another year of audits of the key systems used to deliver the Internet Assigned Numbers Authority (IANA) functions. Several Systems and Organization Control (SOC) audits were conducted by the audit firm RSM US LLP: a SOC 2 and a SOC 3 audit of the Registry Assignment and Maintenance Systems (RAMS), and a SOC 3 audit of root zone Domain Name System Security Extensions (DNSSEC) services. The audits cover the period from 1 December 2024 to 30 November 2025.
For the sixteenth consecutive year, an exception-free audit has been completed for the management of the root zone DNSSEC Key Signing Key (KSK) securing the Domain Name System (DNS). The audit confirms the effectiveness of security, availability, and processing integrity controls for managing the root KSK.
This year also represents the second year of providing a SOC 3 report for the RAMS, complementing the existing SOC 2 audit. Covering the system used to perform IANA registry functions, the SOC 3 report enhances visibility for the broader Internet community and reflects ICANN's commitment to transparency.
Both public reports are available at https://www.iana.org/audits.
The SOC 2 audit identified one exception during the period. "When the exception was identified by the auditors in November 2025, ICANN took immediate steps to remedy the issue. These audits not only provide assurances to the broader community, but also useful insights that help us strengthen operational practices across the entire ICANN organization." said Kim Davies, Vice President of IANA Services and President of PTI.
SOC audits evaluate an organization's controls in relation to "trust services principles and criteria" and are managed by the American Institute of Certified Public Accountants (AICPA). These independent third-party audits form an important part of ICANN's multifaceted accountability for the IANA functions to the multistakeholder community.