Document code:  POL-0016.04  Security level:  Internal  Effective date:  30/06/2020  IT Contractors' Remote Access  5.3. Evaluation of compliance  TEM-0129.01  Uncontrolled copy once printed. Ensure that the right version is in use.  Page  18  of  22 The IT Contractor shall also describe how the results of performed checks, reviews and  audits will be reported to ECHA, in particular with respect to identified non-compliances and  improvement needs. ECHA primarily verifies compliance of IT Contractor by checking the  results of reported checks, reviews and audits that are performed and reported by the IT  Contractor or its 3 rd  party independent auditors. Whereas ECHA will assess and accept the IT  Contractor’s documented evaluation and  controlling practices separately, the following is the minimum requirement for IT Contractor  Access belongs to the category “ High Level ”  or  “ Highest Level ”:  Compliance and  effectiveness of all security measures and controls must be reliably checked at least  once  a year,  covering all premises, systems and procedures related to the IT C ontractor’s access  to ECHA. The IT Contractor shall have documented practices on how they will check and evaluate that  the security measures and controls are effective and adequate to comply with ECHA’s  security model.