Justifying the blocking of a TLD

The recent arrival of the .zip TLD and others spurred a debate on my team. If asked, how do we justify blocking a specific TLD to bureaucrats? Do any of you use some sort of risk register to help quantify the risk of a TLD? Or are you just trusted to make the right call?

blocking cybersecurity register risk sort team tld zip