Document code:  POL-0016.04  Security level:  Internal  Effective date:  30/06/2020  IT Contractors' Remote Access  In case the IT Contractor’s access belongs to the category “Basic” or “Increased”, it is  recommended but not mandatory to have a valid ISO/IEC 27001 certification (or  equivalent). Before granting remote access for an IT Contractor, ECHA shall assess the IT  Contractor’s  compliance with security rules and requirements, and record the results of such assessment. All cases of granted remote access shall be documented and the documentation maintained. ECHA shall supervise and control that IT Contractor maintains compliance with the rules  and requirements in the security model. This is primarily done by requesting and regularly  checking reports from the IT Contractor (e.g. IT  Contractor’s se lf-assessments and audits  reports  generated  by  3 rd party  auditors),  at  least  annually  if  the IT  Contractor’s access level is High Level or Highest Level . ECHA may also perform audits  in order to achieve adequate assurance of the IT  Contractor’s compliance . The details of the  assessment and the evaluation procedures are described in the chapter  “ 5. Assurance of  Compliance ” . ECHA shall provide and manage a secure remote access IT solution to support the IT  Contractor’s secure connectivity over the Internet with a strong encryption and  authentication. In case IT  Contractor’s access belongs to the category  High  or  Highest Level, remote access solution must be configured to allow connections only from IT Contra ctor’s  network, i.e.  IP source restrictions to limit access only from contractor’s IP addresses or  other similar controls. ECHA shall have technical preventive controls in place to restrict the IT  Contractor’s further  access to other ECHA IT systems from the target systems, particularly to prevent the IT  Contractor from achieving access that belongs to a higher level category.  ECHA shall have controls in place to have adequate traceability of IT  Contractor’s remote  access. In case the IT  Contractor’s remote access belongs to the category  High Access  or  Highest  Access , ECHA shall have a nominated counterpart for the IT  Contractor’s security contact  point. ECHA is in charge of ensuring that IT  Contractor’s security contact point has adequate knowledge of ECHA’s security rules and requirements. In case of high or highest access categories, also a security governance model shall be set  up together with the IT Contractor at framework contract level. Such governance model  shall cover at least: security incident response procedures, communication between  organisations, coordination of joint actions and preapproved containment actions, reporting.  Procedures set up in the context of the security governance shall be jointly tested by ECHA  and the IT Contractor.  IT  Contractors’ remote accesses shall be taken into account when changes in ECHA’s IT  architecture or major changes in ECHA’s IT systems are considered. Thus, ECHA’s IT change  Page  14  of  22 TEM-0129.01  Uncontrolled copy once printed. Ensure that the right version is in use.  4. ECHA ’s  security requirements and operational roles  4.1. Security requirements for ECHA