ECHA/2020/666  Annex 1 to Tender Specifications  Technical Specifications Restricted  29 (77) Table 4: IT Enterprise Architecture & Strategy deliverables (WP 2.1)  4.2.1.4. Pricing  4.2.2. Security (WP 2.2)  4.2.2.1. Objectives  4.2.2.2. Activities  4.2.2.3. Deliverables  As the nature of the assignments may vary ECHA may decide on all contracting mode  namely, Quoted time and means, Time and Means or Fixed Price.  The applicable ECHA security rules and requirements fall into the following categories,  which are further elaborated in Annex 20  –  IT security requirements:  The objective of this work package is to ensure the proper implementation of the ECHA IT  security policies across all services of this FWC666 including implementation of preventive  measures, risk management, comprehensive monitoring and effective coordination of  remedial actions/plans in case of incidents.  The below are non-exhaustive lists of activities and deliverables expected.  The contractor must have all aspects of the security solution in place, up and running at  the required standard,  at the latest within 3 months  from the signing of the FWC666.  ECHA request that the timescale is shorter than this if possible; however, the timescale  should not be fast at the expense of not having a high-quality security solution.  P.O. Box 400, FI-00121 Helsinki, Finland | Tel. +358 9 686180 | echa.europa.eu  • Create security reports  • Perform the eventual decommissioning of the security solution at the end of the  Framework Contract;  • Adapt to the possibility that ECHA may choose to suspend usage of all or part of  the remote access solution for any period of time;  • Complete and continued adherence with the ECHA’s security standards including any updates in the security requirements and follow up those changes with proper  change management;  • Set up and maintain their (contractor ’s) security measures and controls, including  preparing the relevant documents and reports, to be fully compliant with the  requirements defined in ECHA’s security policy on IT  contractors ’ Remote Access (Annex 12); • Security responsibilities related to application management (e.g. patch ECHA’s  middleware components and databases, security monitoring tasks to be done in  ECHA's application environment, falling under the scope of this FWC666) • Requirements for secure application design and development • Security rules and requirements for remotely delivered services entailing access  to ECHA IT systems. (Principally this defines how the contractor needs to take  into account security in the contractor's IT environment, physical premises, HR  processes etc., which are related to remote access to ECHA) • General security requirements for all services