Document code:  Security level:  Effective date:  ICT Governance  PRO-0027.06  Internal  15/01/2019  In order to achieve this goal, ECHA has implemented a formal IT Security Management  System which is described in this section. IT Security Management System is a systematic approach to manage security risks related  to IT systems. It is implemented as an efficient and effective set of procedures, rules and  controls, and strongly supported by the IT security service.  ECHA IT Security  Management System is applicable to all ECHA’s  IT systems and IT  governance processes. Also, the risk-driven methodology defined in this document is  followed when an IT-service is outsourced or planned to be outsourced. The entire life cycle of IT systems, services, and processes  is within the scope of ECHA’s  IT Security Management System. Thus, the risk driven approach is used, for example,  when While all IT systems are in scope of the IT Security Management system, it is not  necessary feasible or even doable to change all legacy applications or systems to be fully  compliant with the requirements defined in the system. Thus, the risks related to  incompliance are assessed and the decisions are made based on the cost-benefit - assessment 2 , as a part of requirement specification of a new version of the  application/system.  • new IT systems and solutions are designed, procured, developed 1 , tested and  released  • a new IT infrastructure is designed or existing one changed, or other architectural  and major changes are designed, planned and implemented • IT services and processes are designed, changed, managed and run  • the existing IT systems and solutions are maintained and changed, and when the  data media are disposed in the end of their life cycle 3.13.1. Overall Description of IT Security Management System  TEM-0129.01  Uncontrolled copy once printed. Ensure that the right version is in use.  1 “ Secure Application Design and Development Guideline ” describes in more detail  security practices and  procedures for application development  2  Risk assessment and cost-benefit assessment will be discussed later in this document  Proactive attitude.  Usually, it is costly, difficult or even impossible to implement  security later if it was not considered at the right time. The ECHA IT security  management system supports initiating and taking the correct security actions at the  right time, for example ensuring that security is considered in requirement  Risk driven approach . Instead of strictly following any formal security standard or  best practice, ECHA’s  IT security is based on identifying, assessing and mitigating  security risks; the security measures are grounded on the risk management decisions.  The risk driven approach is followed to ensure that IT security focuses on the relevant  security risks and in order to keep the security controls and risks in balance. The Main characteristics of the IT security management system are the following:  Characteristics and Objectives Page  75  of  92