Skip to main content

Security report for iana.org

Internet Assigned Numbers Authority · Technology · United States

Security score

64/100

Risk levelMedium

8 critical or high findings to fix

The Internet Assigned Numbers Authority (IANA) is a critical entity responsible for the global coordination of DNS Root, IP addressing, and other Internet protocol resources. Operated by Public Technical Identifiers (PTI), an affiliate of ICANN, IANA holds a central position in the Internet governance ecosystem, providing authoritative management of domain names, number resources, and protocol assignments. The website reflects this authoritative role with clear, technical content aimed at Internet infrastructure professionals and governance stakeholders. Technically, the website employs a custom-built platform utilizing jQuery and Google Custom Search Engine for enhanced search capabilities. The site is served over HTTPS with good performance and mobile optimization, though accessibility features are basic. SEO practices are well implemented with proper meta tags and structured navigation. The absence of a cookie consent mechanism and explicit security policy documents are minor gaps in compliance and transparency. From a security perspective, the site demonstrates a strong posture with enforced HTTPS, no exposed sensitive data, and deferred script loading to optimize security and performance. However, the lack of a published vulnerability disclosure policy or security.txt file suggests room for improvement in transparency and incident response readiness. The WHOIS data aligns perfectly with the website's claims, confirming the domain's legitimacy and long-standing role in Internet infrastructure. Overall, the website is highly trustworthy, professionally maintained, and serves its specialized audience effectively. Strategic recommendations include publishing formal security and vulnerability disclosure policies, enhancing accessibility, and implementing a cookie consent mechanism to improve privacy compliance and user trust.

Scanned

NIS2 and GDPR posture

NIS2 posture
2/ 100
GDPR posture
53/ 100
Checks completed
7of 7

Indicative only: based on publicly visible signals, not a certification or legal assessment. NIS2 signals relate to Article 21 of Directive (EU) 2022/2555; GDPR signals to Articles 7, 12, 13 and 32 of Regulation (EU) 2016/679 and Article 5(3) of the ePrivacy Directive.

Priority findings

8 findings rated critical or high. Fix these first.

  1. GDPR compliance

    These are the privacy signals visitors and data protection authorities look for under GDPR.

    • High

      No Cookie Policy found

      GDPR requires clear information about cookie usage

      What to do: Add a dedicated cookie policy explaining cookie usage and purposes

    • High

      No Cookie Consent Banner found

      GDPR requires explicit consent for non-essential cookies

      What to do: Implement a cookie consent banner that appears on first visit

  2. NIS2 compliance

    NIS2 expects organisations in scope to show basic security hygiene. These public signals are what an auditor or customer sees first.

    • High

      No information security framework found

      NIS2 requires documented cybersecurity and information security measures

      What to do: Implement and document information security policies and procedures

    • High

      No security policy documentation found

      NIS2 requires documented cybersecurity governance and risk management

      What to do: Create and publish cybersecurity policy and framework documentation

    • High

      No incident response procedures found

      NIS2 requires documented incident response and business continuity plans

      What to do: Implement and document incident response and business continuity procedures

Need hands-on remediation? Email guard@offseq.com

Keep watching iana.org

This scan found 30 issues across 7 checks. Monitoring re-runs every one of those checks daily, emails you when something material changes, and records each issue as it is resolved, so you can show the progress.

Daily monitoring

Recommended

€25per month

  • TLS certificates and expiry
  • DNS records
  • SPF, DKIM and DMARC
  • Security headers
  • GDPR and NIS2 posture
  • Exposed services
  • Third-party trackers
  • Risk score drift

Email alerts on material changes and an exportable JSON history of every change.

Billed monthly. Cancel anytime. The full timeline opens with your unlock code.

Full report

€39.90one-time

  • The complete analysis as a PDF you can cite
  • Email delivery with an unlock code
  • Lifetime access to this report

Prices incl. 21% vat. Payments by EveryPay; sold by SEQ SIA, Latvia.

Results by check

Each check with its score, findings and the evidence it collected.

Technical appendix

Business context, site observations and technical notes gathered during the scan, and the standards behind each reference.

Business context

Business profile

IANA operates as an essential non-profit entity within the technology and government sectors, managing critical Internet infrastructure resources globally. Its market position is unique and authoritative, with no direct competitors in its domain. The business model revolves around coordination and stewardship rather than commercial revenue generation. The target audience includes network operators, protocol developers, and Internet governance bodies worldwide. Partnerships with ICANN and PTI reinforce its legitimacy and operational framework. The website content and structure reflect a mature organization focused on transparency, technical accuracy, and service reliability.

Security posture

The security maturity of the IANA website is solid, with HTTPS enforced and no visible vulnerabilities or exposed sensitive information. The site lacks some advanced security transparency features such as a published security policy or vulnerability disclosure program, which are recommended best practices for organizations of this stature. Incident response contact is partially indicated via abuse information pages, but no direct security contact emails or DPO information are provided. Compliance with GDPR is implied through privacy policy references to ICANN's policies. Overall, the security posture is strong but could benefit from enhanced transparency and formalized security documentation.

Recommendations

  1. Publish a formal security policy page outlining security practices and commitments.
  2. Implement and publicize a vulnerability disclosure or security.txt file to encourage responsible reporting.
  3. Add a cookie policy and consent mechanism to comply with privacy regulations and improve user trust.
  4. Enhance website accessibility features to meet higher standards for all users.
  5. Provide explicit contact information for data protection officer or security team to improve incident response readiness.
Site observations

Automated reading of the public site. Ratings are indicative.

Business

Company
Internet Assigned Numbers Authority
Description
The global coordination of the DNS Root, IP addressing, and other Internet protocol resources is performed as the Internet Assigned Numbers Authority (IANA) functions.
Key services
DNS Root Zone Management, IP Address and AS Number allocation coordination, Protocol name and number registries, Time Zone Database management
Content quality
good
Branding
consistent

Technology

Stack
jQuery, Google Custom Search Engine
Performance
moderate
Mobile
good
Accessibility
basic
SEO
good

Security

Observed score
85/100
Good practices seen
  • HTTPS enforced
  • No exposed sensitive data in HTML
  • Use of deferred JavaScript loading

Analytics and tracking

Tracking level
minimal
Privacy compliance
good

Advertising

Ad networks
Google Adsense
Marketing tools
Google Custom Search Engine
Transparency
basic

Site quality

Design
good
User experience
good
Content relevance
excellent
Navigation
good
Professionalism
excellent
Trustworthiness
high

Key observations

  1. Website is official and authoritative for Internet number and protocol resource coordination
  2. Content is technical and targeted at Internet governance and infrastructure professionals
  3. No signs of malicious or suspicious activity
  4. Good use of HTTPS and modern web technologies
  5. Lacks explicit cookie consent mechanism
  6. No visible security.txt or vulnerability disclosure page
Technical notes

Notes

The website uses a custom content management approach with jQuery and Google Custom Search Engine integration for search functionality. The site is served over HTTPS with deferred JavaScript loading to optimize performance and security. While the site is mobile optimized and SEO friendly, accessibility features are basic and could be improved. No major technical debts or outdated libraries were detected. Hosting provider details are not explicitly disclosed. Overall, the technical infrastructure is stable and appropriate for the organization's needs, with opportunities for modernization in accessibility and privacy compliance.
Standards and sources

Reference chips under each finding point to the standard, regulation or specification the finding relates to. They are resolved at build time from the official datasets below and mapped conservatively: a finding with no defensible link shows none. NIS2 and GDPR references mark where a finding is relevant evidence, not a compliance verdict. Implementing Regulation (EU) 2024/2690 binds digital infrastructure and digital service providers; for other entities it is the most detailed public reading of the Article 21 measures.

Retrieved 2026-10-24

Reviews of this site

Share your experience with iana.org. Every review is verified by email and published after moderation.

Overall rating
Select a rating
4000 characters remaining

We’ll email you to confirm your review and keep your details private.

Community rating

Loading reviews…

Feedback on this report

Rate this report, add an optional comment, and tell us if you want a security specialist to follow up.

Overall report quality
Select a rating
2000 characters remaining

We only use your feedback to improve Guard reports. Contact details are never shared.