Document code:  POL-0016.04  Security level:  Internal  Effective date:  30/06/2020  IT Contractors' Remote Access  FWC Manager  • Represent the first escalation point  • Represent ECHA in the security governance  Contract Manager  • Ensuring the application of the policy and the security model are followed whenever remote access has to be granted  ICT Security Officer  • Regular review the content of reports delivered by the IT  Contractor (Ch. 5.3 below)  • Assessments of compliance of changes to security measures  proposed by IT Contractor • Daily co-operation with security contact point (incidents,  new threats). Actively work in the security governance  (tactical level)  • Ensure that IT  Contractor’s security contact point has  adequate  knowledge  of  ECHA’s  security  rules  and  requirements  • Develop and improve joint security incident response  procedures and co-operation (coordination, communication,  interfaces). Arrange rehearsals based on needs. • Reporting to FWC Manager and Director of Information  Systems  Compliance of ECHA’s IT environment with requirements Director of Information  Systems  • Supervising and providing required resources Service managers  • Technical maintenance and management of remote access  system in line with the requirements  • Implement and maintain required controls to have adequate  traceability of IT  Contractor’s remote acce ss.  Change manager  • Ensure that impact on security of IT  Contractor’s access is  evaluated when changes in ECHA IT-environment are  planned ICT Security Officer  • Regular reviews that ECHA have required security measures  and controls in place • Monitoring of new threats and risks, carry out annual risks  assessment 5. Assurance of Compliance  5.1. Granting access to a IT Contractor While the new IT framework contracts will always have the requirements included by design,  the workflow below is intended to describe how ECHA proceed to achieve assurance of  compliance for granting access to an existing IT Contractor.  TEM-0129.01  Uncontrolled copy once printed. Ensure that the right version is in use.  Page  16  of  22