In the context of this document teleworking is used to describe any kind of remote access  outside Contractor’s protected office premises.  Additional teleworking requirements shall be  applied on top of all other applicable rules and requirements (Annex I, rules/requirements  R1  –  R33) with the exceptions due to the nature of teleworking. Thus, physical security  requirements for the  IT Contractor’s  office premises (Section 3.1. of Annex I,  rules/requirements R12  –  R18) are not required for the teleworking location. To compensate  missing physical security measures due to the nature of teleworking, there are the following  additional teleworking requirements:  1. Risk shall be assessed, and teleworking policy and rules must be in place:  a. A documented risk analysis has taken place to identify and assess risks related  to the teleworking. Teleworking can be allowed only when the risk level is  acceptable in comparison to the business benefits. b. A teleworking policy, that defines the purpose, procedures, conditions and  responsibilities for teleworking, shall be in place. The implemented teleworking  policy should be in line with the restrictions defined in ECHA policy on IT  Contractors’ remote access and take into account the results of the risk  assessment. c. Teleworking from public places is not permitted under any circumstances. ECHA  IT systems cannot be accessed for example in a train, airport lounge, hotel  lobby or other public places. On the other hand ECHA IT Systems can be  accessed at home (provided that family members or other people cannot  oversee ECHA information on screen and cannot access the workstation with  active connection to ECHA systems) or at Contractor’s other office premises  beyond the scope of the defined service delivery sites.  2. Teleworking-related security procedures a. The security awareness process in place shall ensure that the security  considerations relevant for teleworking are understood.  b. The incident reporting and response process in place must also cover  teleworking e.g. to limit the potential impact of loss or theft of equipment.  3. IT security requirements for teleworking access solution and the devices used for  teleworking:  TEM-0129.01  Uncontrolled copy once printed. Ensure that the right version is in use.  Page  21  of  22 Additional Teleworking Rules  for Access to ECHA’s Information  Systems by IT Contractors  Annex III  Document code:  POL-0016.04  Security level:  Internal  Effective date:  30/06/2020  IT Contractors' Remote Access 