RIPE NCC Consistency & Auditing Activity
                                                       Crain, Caslav

                ____________________________________________________




                      RIPE NCC Consistency & Auditing Activity

                                     John Crain
                                    Paula Caslav
                                 Document: ripe-170
                                 Date: Dec. 1, 1997


                                   ABSTRACT


                          This document describes the concept
                     of the Consistency & Auditing Activity of
                     the RIPE NCC in general and the procedures
                     involved in particular.



    1.  Introduction

                At the 1996 Contributors Committee Meeting, the con-
                tributors agreed that the RIPE NCC should signifi-
                cantly increase its efforts to actively check the
                quality and validity of registry data. This should
                also include the production of statistics on address
                space usage. In order to ensure a fair address space
                distribution, the RIPE NCC will regularly check that
                assignment guidelines are applied equally. See the
                contributors meeting minutes (ripe-145) and the 1997
                activity plan (ripe-144) for more information.

                Some of this activity is separated from the other
                registration activities because it needs to be
                defined and executed somewhat independently from the
                day-to-day processing of requests. Of course consis-
                tency checking and auditing will still be performed
                within other activities.

    2.  Goals

                This activity will promote consistent and fair
                application of assignment criteria with regard to
                conservation and registration of address space and
                aggregation of routing information. This activity
                will also help to identify parts of the procedures
                themselves that cause problems. These observations
                will be reported back to the RIPE Local IR working
                group for further investigation and improvement of
                the procedures.

                ____________________________________________________
                ripe-170.txt                                  Page 1
                            RIPE NCC Consistency & Auditing Activity
                                                       Crain, Caslav

                ____________________________________________________

                To verify that Local Internet Registries are apply-
                ing the assignment criteria correctly and to aid
                them in operating within the criteria, the RIPE NCC
                has started this activity on auditing and consis-
                tency checking.


    3.  Previous Practice

                Previously, the RIPE NCC mainly checked how Reg-
                istries follow procedures in the course of making a
                new allocation to a Registry. The RIPE NCC also fol-
                lowed up on external complaints about Registries.
                However, until recently, there have not been enough
                resources to devote to these activities full time.
                Auditing and consistency checking has mainly been
                done on a time-permitting basis.


    4.  New Auditing Procedures


    4.1.  Principles

                The global assignment policies agreed upon by IANA
                and the RIPE community, as described in the "Euro-
                pean Internet Registry Policies and Procedures" doc-
                ument (currently ripe-159), will be used as criteria
                to evaluate the Registry's assignment decisions.

                When performing an audit a member of the RIPE NCC
                Registration Services staff will be looking at the
                following information:

                Database Consistency

                1    Is the information stored in the RIPE database
                     concerning the assignments within Registry's
                     allocation correct (separate up-to-date entries
                     pointing to all individual customer assign-
                     ments)?

                2    Is it stored in the correct manner (are nic-
                     handles used, are admin-c's located on-site, no
                     overlapping entries, etc..)?

                Assignment Criteria

                1    Were all requests above the Registry's Assign-
                     ment Window sent to the RIPE NCC for approval?

                2    Is proper documentation regarding the request
                     and the assignment gathered and archived by the
                ____________________________________________________
                ripe-170.txt                                  Page 2
                            RIPE NCC Consistency & Auditing Activity
                                                       Crain, Caslav

                ____________________________________________________

                     Local Internet Registry? For a request that is
                     within a Registry's Assignment Window, it is
                     not necessary to have an entire "European IP
                     Address Space Request Form" (currently
                     ripe-141), however some similar format with all
                     the information necessary to evaluate the
                     request should be available. The information
                     should show what kind of organisation is using
                     the addresses, what their network looks like
                     (an addressing plan), and their current address
                     space usage.



                3    Have the correct assignment policies been fol-
                     lowed? The documentation will be checked for
                     the following:

                          o The completeness of provided documenta-
                          tion.

                          o The efficiency of IP usage (25% usage
                          immediately and 50% usage in year 1, if
                          these usage rates are lower, clear docu-
                          mentation should be available showing how
                          the growth will occur and that the cus-
                          tomer has concrete plans to use the
                          address space efficiently).

                          o The use of classless assignments.

                When the data about the assignments is produced, the
                requests are evaluated as to their compliance with
                the procedures and policies as they were at the time
                of the assignment.


    4.2.  Types of Audits

                The External Auditing will be carried out on two
                levels.


    4.2.1.  Routine auditing by Hostmasters.

                With every request for a new allocation, the usage
                of previous allocations are monitored. The RIPE NCC
                will ask for the documentation on several sample
                requests (usually three) to see what the LIR's based
                their assignment decision on. This is important to
                align assignment criteria and to make sure LIR's
                gather the necessary set of information.

                ____________________________________________________
                ripe-170.txt                                  Page 3
                            RIPE NCC Consistency & Auditing Activity
                                                       Crain, Caslav

                ____________________________________________________

                As the Local Internet Registries should be keeping
                documentation of all IP assignment requests avail-
                able (see ripe-159) this should, under normal cir-
                cumstances, be a formality. Only where the LIR has
                failed to archive such requests may these create
                delay in the allocation procedure.

                If a delay is likely and the LIR urgently needs
                additional address space to serve customers, the
                RIPE NCC may decide to allocate a small range of
                address space to the LIR so that they can continue
                business during the audit procedure.


    4.2.2.  Special Auditing by the Consistency Checking & Auditing
    Team.

                This type of auditing will be started according to
                one of three situations.

    A. At the request of the Registration Services Department

                If, during the course of normal Registration Ser-
                vices work (for example during an "allocation
                check"), a Hostmaster has difficulty obtaining sat-
                isfactory answers from a LIR, the audit can be
                passed on to the Consistency Checking & Auditing
                Team. Also, if procedural errors are discovered, the
                Hostmaster involved can either transfer the request
                to the Consistency Checking & Auditing Team or con-
                tinue the audit under its supervision.

    B. As reaction to an external complaint about procedural dis-
    crepancies.

                Consistency Checking & Auditing Team will handle
                external complaints about noncompliance with poli-
                cies and procedures. It will investigate these com-
                plaints and try to ascertain if they have any valid-
                ity before approaching the registry against which
                the complaint has been lodged. Complaints that do
                not have some form of collaborative evidence, either
                given by the plaintive or discovered during
                research, will not be pursued.

                To ensure confidentiality, the identity of the
                plaintive will be kept confidential unless written
                permission is given for disclosure. All information
                about the Registry being audited will also remain
                confidential and the outcome of the audit will not
                be disclosed.


                ____________________________________________________
                ripe-170.txt                                  Page 4
                            RIPE NCC Consistency & Auditing Activity
                                                       Crain, Caslav

                ____________________________________________________

    C. Pro-active Audits of LIR's with which the RIPE NCC has little
    contact.

                The Consistency Checking & Auditing Team will audit
                LIR's with whom we have little contact. Some Reg-
                istries, due to the nature of their business and
                their Assignment Window need very little co-ordina-
                tion from the RIPE NCC. It is useful to audit these
                from time to time so as to ensure that they are
                aware of the latest policies and procedures.


    4.3.  Methodology:

                The auditing of LIR's will be performed in such a
                way that registries who work according to the guide-
                lines will have as little disturbance to their busi-
                ness as possible. Impartiality, quality and confi-
                dentiality will be of highest priority. The <host-
                master@ripe.net> role mailbox will be used for all
                auditing related discussions with Registries. The
                <ncc@ripe.net> role mailbox can be used by a non-
                registry for initial contact about auditing-related
                issues. Most correspondence should be send via e-
                mail. However, documentation (such as a topology
                map) only accessible in hardcopy can be sent by fax.
                All documentation and discourse will be logged and
                archived using the RIPE NCC's Ticket Tracking Sys-
                tem. Details are explained in "RIPE NCC Request
                Tracking and Ticketing" (ripe-183).


    4.4.  Corrective Measures:

                Any registry that is audited, for whatever reason,
                will be given ample opportunity to show that they
                are following the correct procedures.  The Consis-
                tency Checking & Auditing Team will first attempt to
                discuss the problem with the Registry involved and
                educate them about the correct procedures and poli-
                cies. If the discussion fails, or if serious fail-
                ings are shown, further will action be taken to rec-
                tify this. This action can take various forms
                including the lowering of the Registry's Assignment
                Window. If an Assignment Window is lowered it will
                then be raised in the normal manner, not necessarily
                directly to the original level. A major part of the
                activity will be in helping the registries to under-
                stand and follow the correct policies and proce-
                dures. Lowering a Registry's Assignment Window is
                meant to help them get better acquainted with the
                current policies because they receive more feed-back
                on their requests.
                ____________________________________________________
                ripe-170.txt                                  Page 5
                            RIPE NCC Consistency & Auditing Activity
                                                       Crain, Caslav

                ____________________________________________________

                At times, it will be necessary for the Consistency
                Checking & Auditing Team to withhold allocating a
                new block to a Registry that is being audited, or to
                make a small temporary allocation and allocate the
                rest of the block later, when certain conditions
                have been met. Making a small temporary allocation
                will allow the RIPE NCC to better monitor the
                assignments made by the Registry.

                If a Local IR consistently violates the policies
                established by IANA or within the RIPE community, in
                spite of multiple warnings and if other corrective
                measures fail, then it may be closed by the RIPE NCC
                (see section 6.4.1 of ripe-159).


    5.  Reporting:

                In order to get a better overview of the needs of
                the Registries, the RIPE NCC will keep statistics on
                the results of the audits. These statistics, which
                will include the type of complaints and problems
                found, will be made public. The statistics will only
                show the types of problems and the solutions taken.
                They will not mention any registry by name. The
                information will also be used to help the RIPE NCC
                to adapt their information dissemination to suit the
                needs of Registries.  A good example of where this
                would be useful is in deciding what the content of
                the "Local Internet Registries" training courses
                should be, or improving the documentation available
                to Local Registries.


    6.  Appeals:

                A formal appeals procedure will be developed in
                early 1998. Until that time, any complaints about
                the procedures of the Consistency Checking & Audit-
                ing Team should be taken up with the Quality Assur-
                ance Manager, and if an agreement is not reached, it
                will be taken to the senior Management of the RIPE
                NCC. If an agreement is also not reached at that
                level, the issue can be taken to the IANA for arbi-
                tration.








                ____________________________________________________
                ripe-170.txt                                  Page 6