Information Centre

The Information Security Standard (ISS) for Accredited Registrars was established by the au Domain Administration (auDA) and developed in consultation with registrars and other industry participants. Its purpose is simple - to enhance security among Australian domain name registrars. 

.au Domain Administration Ltd (auDA) is the policy authority and industry self-regulatory body for Australia's .auThe ISS helps to protect .au registrants, while also assisting in preserving the integrity and stability of the .au domain space. AU enjoys a solid reputation and high degree of trust, and all stakeholders want it to remain that way.

ISS sets a mandatory minimum standard for information security aligned to well-established international standards ISO 27001 (Information security management) and PCI DSS (Payment Card Industry Data Security Standard).

Far from being a tick-and-flick type of exercise, the assessment process is very detailed and covers the following areas:

• Information Security Policy
• Information Security Organisation Framework
• Asset Management Plan
• Human Resources
• Physical Security Plan
• Operations Management
• Service Provider Security
• Malicious Code and Vulnerability Management
• Monitoring
• Access Control
• Systems Development
• Incident Management
• Business Continuity Management
• Regulatory Compliance

Assessment occurs in two stages.

First, the registrar must complete a self-assessment via the ISS Compliance Portal and action any issues identified. After this process, there is an extensive on-site assessment by an ISS Assessor.

Both stages must be successfully completed in order to gain auDA ISS certification.

Certification lasts 3 years, but some registrars may be required to undertake one or both assessment processes each year or at intervals determined by ISS Committee. 

Certified registrars are permitted to display the ISS certification logo as shown below:

ISS certification isn't optional. All existing domain name registrars had to be ISS compliant by 17 October 2017. After that time, the auDA reserved the right to suspend accreditation of non-compliant registrars, to issue public notices regarding non-compliance and terminate accreditation after 3 month suspension if certification isn't achieved.

Domain Name Registrar (Australia) Pty Ltd., trading as Domain Registration Services, attained ISS accreditation in November, 2015.

Further detail on the auDA Information Security Standard (ISS) for Accredited Registrars can be viewed here.