Document code:  POL-0016.04  Security level:  Internal  Effective date:  30/06/2020  IT Contractors' Remote Access  compliance of its subcontractors. The IT Contractor must verify and report to ECHA  the compliance before remote access is granted, and continuously during the  subcontracting. R4: By default, remote access can be granted only from the IT C ontractor’s protected  premises. Teleworking access from outside the IT Contr actor’s premises needs exp licit  authorisation from ECHA when justification exists and the teleworking access is at  least compliant with ECHA's security rules for teleworking (indicative teleworking rules  are presented in Annex III). R5: Only the IT C ontractor’s authorised users with  valid business justification may have  access rights to ECHA IT systems. All access rights are kept up-to-date and the  principle of least privilege is followed. IT  Contractor’s access rights to ECHA systems  are regularly (at least twice a year) reviewed by the IT Contractor. History of access  rights granted is kept by the IT Contractor for the duration of the Contract.  R6: IT C ontractor’s  remote access to ECHA IT Systems is allowed only through the remote  access systems approved by ECHA. R7: All factors, physical or logical (e.g. hardware tokens, PIN codes, passwords) used for  authentication to ECHA IT systems must be carefully protected against being lost,  stolen or disclosed. Authentication factors are not allowed to be given or revealed to  unauthorised people. Passwords, PIN codes and other similar authentication factors  shall be appropriately protected against disclosure when used or stored, and must be  encrypted if stored electronically. R8: The IT Contractor shall have a nominated person responsible for the implementation  and maintenance of ECHA’s security requirements , i.e. the IT Contractor shall ensure  that adherence to the security rules is incorporated into their day-to-day working  practices when delivering services to ECHA. This nominated person shall act as  Security Contact Point for ECHA.  R9: All occurred security incidents, identified significant security weaknesses and risks  related to IT  Contractor’s premises, IT -systems or processes used to deliver services  for ECHA as well as any non-compliances with the security rules shall be reported by  the IT Contractor to ECHA without delay. Incident reports shall contain the following  elements: Executive summary, Context, Identification and Impact of the incident,  Course of Events including actions taken, Communication to ECHA, Root Cause  Assessment, and Conclusions.  R11: The Contractor shall accept to comply with the changes to the security model  stemming from the regular risk assessment performed by ECHA as foreseen by the IT  Contractors Remote Access Policy. Otherwise the access can be revoked.  R10: The IT Contractor will allow and support ECHA to conduct regular audits, on request.  TEM-0129.01  Uncontrolled copy once printed. Ensure that the right version is in use.  Page  8  of  22