Internet Corporation for Assigned Names and Numbers (ICANN)

United States · owned by Independent (United States) · www.icann.org · 10 vendors

ICANN (Internet Corporation for Assigned Names and Numbers) is a nonprofit organization responsible for coordinating the maintenance and procedures of several databases related to the namespaces and numerical spaces of the Internet, including the management of the Domain Name System (DNS), IP address allocation, and protocol identifier assignment. It operates as a multi-stakeholder governance body that ensures the stable and secure operation of the Internet's unique identifier systems. ICANN was incorporated in California in 1998 and operates under a contract with the U.S. Department of Commerce, though it functions as an independent, internationally representative body.

Resilience scores

Disruption prediction

Internet Corporation for Assigned Names and Numbers (ICANN) has an estimated 40% probability of disruption in the next 6 months.

3 of Internet Corporation for Assigned Names and Numbers (ICANN)'s 10 vendors monitored for disruptions.

Technology vendors

Services catalogue

6 services in catalogue across 3 categories; runs on 10 sub-vendors.

Insights

Last updated 2026-08-14 · revision 2

10 direct vendors, 142 subvendors

Direct vendors by controlling owner country (sample)

Subvendors by controlling owner country (sample)

Migration Readiness: 5/10

Assessed by AI based on technology stack characteristics (cloud-native vs legacy, containerization, microservices), regulatory environment, data residency requirements, financial stability, and vendor lock-in risks. The score ranges from 0-10, where higher scores indicate better readiness for technology migration.

ICANN's migration readiness is moderate, primarily due to the highly specialized and critical nature of its core infrastructure, which is not easily transferable to a generic cloud-native environment. Services like the L-Root DNS, relying on Anycast Routing, BIND, DNSSEC, and HSMs, are deeply integrated and optimized for their current distributed, on-premise (or specialized co-location) operation. Migrating these foundational components would require significant re-architecture rather than a simple lift-and-shift. The web application frameworks (Ruby on Rails, Drupal) are stable but not inherently cloud-native or microservices-based, requiring effort for containerization and cloud optimization. A significant challenge for migration is the stringent regulatory environment, particularly GDPR and NIS2 compliance. As an 'Essential Entity' under NIS2, any migration would necessitate meticulous planning to ensure continuous adherence to data sovereignty, security, and operational resilience requirements, potentially increasing complexity and cost. Data residency requirements are not specified, which could introduce further constraints if strict rules apply. On the positive side, ICANN's stable financial position (USD 157.9M operating revenue) provides the capacity to fund a complex migration. The organization also demonstrates comfort with external cloud services through its use of SaaS solutions like Okta, Salesforce, and Oracle Taleo. The use of Python and PostgreSQL in its tech stack also indicates components that are generally well-suited for cloud environments. The vendor data is ambiguous, stating 'Total Vendors: 0' but then listing vendor geographic diversity. If 'Total Vendors: 0' is taken literally, it implies minimal vendor lock-in, which would be a strong positive for migration readiness. However, if there are vendors, the 'Vendor lock-in risk' is unknown, posing a potential challenge. Overall, while ICANN has the financial means and some cloud-friendly technologies, the specialized core infrastructure and high regulatory burden temper its overall migration readiness.

Compliance

10 in-scope frameworks identified; showing 3.

IANA Functions Oversight & US Government Regulatory Framework — Compliant

ICANN performs the IANA functions under a contract with the US Department of Commerce (historically via NTIA). Following the 2016 IANA Stewardship Transition, ICANN's PTI (Public Technical Identifiers) subsidiary now performs IANA functions under a Service Level Agreement with ICANN. The transition removed direct US government oversight, replacing it with a multistakeholder accountability framework. Risk is Medium because: (1) ICANN operates under US federal oversight frameworks and California state law, (2) the post-transition accountability mechanisms (Empowered Community, IANA functions review) are relatively new and untested at scale, (3) US government interest in internet governance remains high.

Evidence: https://www.icann.org/en/governance, https://www.icann.org/en/news/in-focus/accountability/mechanisms, https://www.icann.org/ec, https://www.icann.org/en/about/agreements, https://pti.icann.org

WHOIS — Partially Compliant

ICANN's WHOIS/RDAP system is at the intersection of multiple regulatory frameworks including GDPR, law enforcement access requirements, and ICANN's own contractual obligations with registries and registrars. The tension between GDPR's data minimization requirements and law enforcement/intellectual property community demands for full WHOIS data access has created ongoing compliance challenges. Risk is High because: (1) multiple stakeholder groups (law enforcement, IP rights holders, security researchers, privacy advocates) have conflicting demands, (2) ICANN faces potential legal challenges from multiple directions, (3) the EPDP Phase 2 recommendations on System for Standardized Access/Disclosure (SSAD) remain under implementation, (4) non-compliance with GDPR in WHOIS data handling could result in significant fines.

Evidence: https://gnso.icann.org/en/group-activities/active/gtld-registration-data-epdp, https://rdrs.icann.org/, https://www.icann.org/dataprotectionprivacy, https://whois.icann.org/en, https://www.icann.org/en/data-protection

NIS2 (source) — Assessment Required

NIS2 applies to entities providing digital infrastructure services in the EU, and ICANN's role as the global coordinator of the Internet's DNS and IP address systems places it squarely within the 'digital infrastructure' essential entity category under NIS2 Annex I. ICANN operates the IANA functions, coordinates the DNS root zone, and its operations are foundational to EU internet infrastructure. However, ICANN itself is a US-based non-profit and the direct NIS2 obligations typically fall on EU-established entities or entities offering services within the EU. ICANN's Brussels office and its contractual relationships with EU-based registries and registrars create a nexus. Risk is Medium because: (1) NIS2 obligations may fall primarily on ICANN's EU-based contracted parties (registries/registrars) rather than ICANN directly, (2) ICANN's unique quasi-governmental status creates regulatory ambiguity, (3) enforcement against a US-based non-profit coordinating body is legally complex, but (4) ICANN's critical role in EU digital infrastructure means regulators may seek to extend NIS2 obligations.

Evidence: https://www.icann.org/en/ssac, https://www.icann.org/en/rssac, https://www.icann.org/locations, https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32022L2555

Financials

Three-year financials

Financial Resilience Score: 8/10

ICANN exhibits very strong financial resilience despite operating deficits in recent years. The organization holds $556M in unrestricted net assets and ~$535M in funds under management against only ~$59M in liabilities, resulting in an essentially unlevered balance sheet with total assets exceeding liabilities by roughly 10:1. A Reserve Fund of ~$201M provides well over a year of operating expenses, significantly above the internal minimum target of three months. Revenue is highly stable and contractually locked in, with ~95% coming from long-term agreements with gTLD registry operators and ICANN-accredited registrars, based on fees tied to domain registrations, renewals, and transfers. Fee increases (registry operators in January 2025 and registrars in July 2025) are designed to align funding with inflation. Additionally, $236M in New gTLD Auction Proceeds is earmarked for the ICANN Grant Program off the operating balance sheet. However, ICANN posted structural operating deficits (net assets before other income) of −$13M, −$36M, and −$20M in FY23–FY25, with positive changes in net assets in FY23 and FY25 depending on investment gains ($20M and $35M respectively). Management responded with a cost-reduction program (33 positions eliminated in May 2024) that cut operating expenses by ~$14M in FY25. Revenue concentration among two constituencies (registries and registrars) and heavy dependence on the .com Registry Agreement with VeriSign represent additional structural risks.

Key strengths: Very strong balance sheet: $556M unrestricted net assets vs ~$59M liabilities, Reserve Fund of ~$201M covering well over a year of operating expenses, ~95% of funding is contractually recurring from registries and registrars, Fee increases activated in Jan 2025 (registries) and July 2025 (registrars), Successful FY25 cost reduction (~$14M) restoring positive change in net assets, $236M off-balance-sheet New gTLD Auction Proceeds earmarked for Grant Program, Investment portfolio generated $20M-$35M gains in FY23 and FY25

Risk factors: Structural operating deficits of −$13M, −$36M, and −$20M in FY23–FY25, Positive net assets change depends on volatile investment gains, Revenue concentration: ~95% from just two constituencies (registries and registrars), Heavy dependence on .com Registry Agreement with VeriSign, Multi-year cost pressure from New gTLD Program: Next Round through 2026, Geopolitical exposure including WSIS+20 review and UN Global Digital Compact, Investment portfolio exposed to global financial market volatility, Grant Program execution risk in distributing ~$200M+ over program lifetime

Revenue by geography

Revenue by product/service

Workforce by country

Signed-in users can see whether their own company is exposed to this vendor's disruption, plus the full sub-vendor list and country breakdowns, every in-scope compliance framework plus gaps and next steps, and alerts when any of it changes.

View the full interactive report