Document code:  POL-0016.04  Security level:  Internal  Effective date:  30/06/2020  IT Contractors' Remote Access  Applicability of the General Security Rules to different access levels:  (a  = only security incidents and non-compliances with the security rules shall be reported  The IT Contractors with remote access to ECHA IT systems must be compliant with the  security requirements defined below, according to their access level category. Compliance can be achieved by having compensating controls which provides equivalent or  higher level security. Thus, security requirements are not absolute but used more to define  objectives of adequate level of protection.  TEM-0129.01  Uncontrolled copy once printed. Ensure that the right version is in use.  Page  9  of  22 R13: IT Contractor's physical access control is based on electronic keys. Electronic access  keys are revoked in case of loss. The revoking service for the lost keys shall be  available 24/7 unless a secondary access control mechanism is in place (e.g. a two- factor authentication with access key and PIN code).  R12: Access controls are in place on the premises or part of the premises used to deliver  the services, in order to guarantee that the physical access is restricted to authorised  individuals.  3.1. Physical security requirements for the IT C ontractor’s office  premises used for remote access to ECHA ’s  IT systems  3. Security Requirements for IT Contractors Rule /  Requirement #  Basic  Level  Increased  Level  Higher  Level  The Highest Level  R1  X  X  X  X  R2  -  X  X  X  R3  X  X  X  X  R4  -  -  X  X  R5  X  X  X  X  R6  X  X  X  X  R7  X  X  X  X  R8  -  -  X  X  R9  X (a X (a X (a X  R10  -  X  X  X  R11  X  X  X  X 