Document code:  POL-0016.04  Security level:  Internal  Effective date:  30/06/2020  IT Contractors' Remote Access  Applicability of the IT Security Requirements to different access levels: Rule /  Requirement  #  Basic Level  Increased  Level  Higher  Level  The Highest Level  R22  -  -  X  X  R23  X  X  X  X  R24  -  X  X  X  R25  X  X  X  X  R26  X (a X (a X  X  R27  -  -  -  X  R28  X (b X (b X (b X R29  X (c X (c X (d X  R30  -  -  X  X (e R31  -  X  X  X  R32  -  -  X  X  R33  -  -  X  X  X (a  = At least: OS, web browser, PDF reader, Flash player, Java and office applications  X (b  = At least: Access from public network to IT  Contractor’s network shall be controlled X (c  = Antivirus on workstations at least X (d  = Antivirus on workstations and filtering for incoming files at least X (e  = A centralised log management and log correlation solution is required  3.4. Information Security Management System (ISMS)  An Information security management system (ISMS) is an overall framework for the whole  information security work in an organisation. ISO/IEC 27001 certification (or an equivalent  certification which requires that security management systems is assessed and verified  regularly by an independent 3rd party auditor) is a confirmation that an organisation has  formally defined and implemented ISMS.  In case the IT Cont ractor’s remote access belongs to the category “Higher Level” or “Highest  Level”, then the ISO/IEC 27001 certification (or an equivalent) is mandatory. The ISO/IEC  27001 certification (or equivalent) shall cover all systems, premises and procedures related  to services which require “Higher Level” or “Highest Level” access to ECHA IT systems. TEM-0129.01  Uncontrolled copy once printed. Ensure that the right version is in use.  Page  13  of  22