Document code:  POL-0016.04  Security level:  Internal  Effective date:  30/06/2020  IT Contractors' Remote Access  Risk management strategy  Risk identification and assessment  Risk mitigation  Changes in the risk profile  3.3. Provisions for the application of this Policy  TEM-0129.01  Uncontrolled copy once printed. Ensure that the right version is in use.  Page  3  of  22 There must be a contractual obligation to be compliant with the policy before remote access  can be granted to IT Contractor. The Contract Manager is responsible for ensuring that the  contractual obligation is in place to the extent possible within the used contractual  framework and that the contractor is fully aware of the obligation. If a major change in ECHA’s IT architecture or system integration is proposed (a  fundamental change or one having high risk or high impact potential  –  in case of uncertainty  the Architectural Focal Point (AFP) will make the decision), impact on risk related to IT  Contractors’ access to ECHA IT systems is assessed and taken into account as part of the  impact assessment described in ICT Governance (PRO-0027). As technology changes and new threats arise, a risk assessment is performed annually by  ECHA (as detailed in Annex I) and, whenever a relevant change affecting the risk profile is  detected, the security model is updated as needed and a process of propagation of the  changes to the IT Contractors having access is performed. The mandatory requirements set in the security model cannot be relieved based on the  result of a case-by-case specific risk assessment without an appropriate authorisation. Additional risk mitigation actions may be requested case-by-case, based on the result of a  specific risk assessment as detailed in Annex I.  A security model (see 3.3 in Annex I) with security rules and requirements is established to  address the identified risks. Remote access for IT Contractors can be granted only when  they comply with the security model. In addition to such generic risk assessment, a specific risk analyses may be performed based  on need as detailed in Annex I.  Relevant risks related to IT Contractors’ remote access are identified according to the  procedure described in  ECHA ICT Security Management System  (Section 3.13 in PRO-0027).  The relevant identified risks are assessed by comparing the risks of services performed on  premise with the risks of the same services being performed off premise in the context of  an outsourcing contract. The risk management strategy will focus on avoiding risks, reducing and mitigating  unavoidable risks and accepting the (residual) risks over transferring the risk via contractual  means to the contractor. 