Page  6  of  22 TEM-0129.01  Uncontrolled copy once printed. Ensure that the right version is in use.  1  ISO 27001/2 and CobiT Annex I Security Model  1. Introduction  IT Contractors' Remote Access  Document code:  POL-0016.04  Security level:  Internal  Effective date:  30/06/2020  ECHA adopts an information-centric approach to risk management in the context of this  policy; therefore focus is put on controlling access to data. The security model is defined  by categorising the IT Contractor’s access to ECHA’s IT  systems into four different access levels based on corresponding risk levels. A set of security rules and requirements is defined for each access category to address the  risks of that category. Industry good practices 1  and requirements 2  for Member States remote access are used as  a reference material for security rules and requirements and they are optimised to address  particularly risks related to IT Contractor’s access. The security model also defines a formal process to achieve assurance that the IT Contractor  implements the security model and keeps it up-to-date according to the aforementioned  annual risk assessment.  The Security Model describes the rules and requirements to mitigate the identified risks  associated to granting access for IT Contractors to ECHA IT systems and data. The Security Model also defines requirements for ECHA and describes how assurance of IT  Contractor s’ compliance is achieved and maintained. Primarily the following aspects are considered to establish the risk levels associated to the  IT Contractor’s access :  Which IT-systems need to be accessed and in which environment such systems are  located, possible integrations and  interfaces which can make other ECHA’s IT  systems accessible from the target systems. Criticalities of system based on  negative impact on ECHA in case of system compromised have been defined in  ECHA  ICT Security Management System  (Section 3.13 in PRO-0027).  2 Standard Security Requirements for MSCA’s access to ECHA  Information Systems  c) Type of remote connectivity applied. b) Level of privileges and which information the IT Contractor can access with such  privileges. a) Content of the targets to be accessed by the IT Contractor  1.1. Access Categories 