ICT Governance  Document code:  PRO-0027.06  Security level:  Internal  Effective date:  15/01/2019  For ECHA IT systems, comprehensive set of IT security controls are implemented and  maintained to allow ECHA to focus on its primary mission. As it is not realistic to prevent  from all security threats, and, actually a high degree of prevention is nowadays even  more challenging than before due to continuous evolving sophistication of threats and  attacks.,, Thus, also reactive and monitoring controls have an  important role in ECHA’s  IT  security system.  IT security controls can also be divided to the following categories according to their  nature:  • Physical controls,  e.g. physical access control to the data center premises • Procedural controls,  e.g .  security incident response processes, security  guidelines and rules, security awareness and training 12 ;  • Technical / logical controls,  e.g. user authentication , antivirus software,  firewalls;  • Contractual controls,  e.g. security contracts and NDAs with the service  providers, security declaration with 3 rd  parties  At ECHA, feasible controls from different categories have been selected and combined in  order to achieve efficient and effective risk management objectives. According to  the principle of “s implicity and standardisation “ , the controls are standardised  as much as possible. Thus, the same IT-controls are applied at the organization level  (common controls). Usually common controls are more IT-infrastructure related than  applications level due to higher level of standardisation at infrastructure layer. In addition to common controls, there are also system-specific controls. Usually, system- specific controls are additional security controls to complement required security  measures, which are applied only to one or a few systems. Also, system specific control  can also be a compensating control 13,  which is implemented instead of a common control. The existing security measures are regularly evaluated and vulnerabilities identified in  order to make sure that all the security measures are still in place, effective and fit for  purpose as well as the existing vulnerabilities and weaknesses are identified before  exploited. Active monitoring of security events support to achieve view of current state of  security. .Thus, security evaluation and monitoring covers two different aspects: 3.13.5. IT Security Evaluation and Monitoring  • preventive evaluation of security measures and detection of existing vulnerabilities,  and 12  At ECHA, procedural controls are documented  e.g. in “IT Security Handbook” (HAN - 0012) and “ Practical  instructions for handling of ECHA equipment (lost items) and access to ECHA premises ” (HAN -0011). 13  A compensating control may be considered when it is not feasible to implement a common control explicitly as  stated, due to legitimate technical or documented business constraints. The compensating control should  sufficiently mitigate the same risk(s) which are mitigated by the associated common control  TEM-0129.01  Uncontrolled copy once printed. Ensure that the right version is in use.  Page  85  of  92