Document code:  PRO-0027.06  Security level:  Internal  Effective date:  15/01/2019  ICT Governance  Maintenance work  All work time and funds used for Maintenance work are  recorded to a Product specific code. The same code is  used for all maintenance code, irrespective of the  release.  Investment Closure  Triggers deactivation of all codes related to the  decommissioned IT Products and IT Services.  Activity / SECA codes should be allocated for all work foreseen in the Programme Plan  within one month from the approval of the Programme Plan.  During the implementation of a Framework Contract the Contractor’s performance shall be  monitored via Service Level Indicators (SLI) such as:  SLI02 = [number of deliverables handed over with compliant delivery dates] /  [total number of planned deliverables]  SLI01  =  [Total number of deliverables] / [Number of iterations needed to pass  the acceptance criteria]  It is important to mention that the above definition of the SLIs is the default definition  proposed for each SLI at the level of a given Framework Contract. New SLIs may be  introduced in the future, if needed. If those are not part of the specifications of a FWC,  then such addition should be agreed by both parties (ECHA and Contractor) in the context  of the FWC governance structure. The Contractor shall be responsible for monitoring and submitting reports to ECHA  describing SLIs performance. ECHA shall review these reports and make a judgement as  to their correctness. ECHA will use the SLIs as part of the Contractor’s overall performance assess ment in  order to make decisions concerning both the Framework Contract and the specific  contracts. The Contractor shall proactively use the SLIs to analyse its own performance  and propose actions and measures for improvement. While implementing the REACH, CLP, Biocides and PIC legislations ECHA receives, stores  and processes confidential business information e.g. submitted by the chemical industry.  Also, as a part of implementing these legislation, ECHA provides access for authorised  stakeholders to that information. Confidentiality of that information sets high security  requirements for ECHA IT systems and procedures. A major challenge is to achieve  compliance with the high IT security requirements by efficient and cost-effective way and  provide easy access to the information for authorised ECHA users and external  stakeholders. Page  74  of  92 TEM-0129.01  Uncontrolled copy once printed. Ensure that the right version is in use.  3.13. IT Security Management System  • Compliance with the delivery date  • Quality of the Deliverables  3.12.2. Service Level Management (SLM) Reporting of Outsourced Work 