Document code:  POL-0016.04  Security level:  Internal  Effective date:  30/06/2020  IT Contractors' Remote Access  5.2. Documentation and change management for IT  Contractor’s  security measures The IT Contractor shall have up-to-date documentation, shared with ECHA, of the security  measures and controls implemented to fulfil the security model. As a part of that  documentation IT  Contractor’s  premises (or part of the premises) used for remote access  to ECHA IT systems are listed. Also, IT  Contractor’s relevant IT systems related to remote  access to ECHA IT Systems are described. The IT Contractor is allowed to change security measures and controls only if the changed  security measures and controls are still compliant with ECHA's security model. Therefore IT  Contractor shall have a formal change management procedure to ensure compliance with  ECHA’s security rules and requirements . Potential changes to security measures and  controls shall be communicated to ECHA for approval, prior to their implementation.  TEM-0129.01  Uncontrolled copy once printed. Ensure that the right version is in use.  Page  17  of  22