Document code:  POL-0016.04  Security level:  Internal  Effective date:  30/06/2020  IT Contractors' Remote Access  The four categories of access are:  Risk levels  very low ,  low ,  moderate ,  high  and  very high  are defined in ECHA ICT Security  Management System (Section 3.13 in PRO-0027).  Usually IT Contractors must have high privileges to live data for development, testing or  supporting purposes. Therefore the default access level is the  Highest Level . Lower levels  can be applied only based on the result of a specific risk assessment with clear justifications. In order to support applying access level categories in practice, some concrete examples of  IT Contractor s’ accesses belong to different levels are described in the Annex II. The general security rules listed below are mandatory and absolute by their nature which  means that compliance with the general security rules cannot be achieved by implementing  any compensating or alternative security measures or controls. TEM-0129.01  Uncontrolled copy once printed. Ensure that the right version is in use.  Page  7  of  22 R3: Subcontractors having remote access to ECHA IT systems must be fully compliant with  security rules and requirements in this policy. The IT Contractor is in charge of the  R2: All service delivery facilities  used to access ECHA’s IT systems  must be located within  the European Union Member States. R1: Access to ECHA’s content stored and processed by ECHA’s IT systems is allowed only  on need to know basis, in the context of the services performed. Unless explicitly  requested in writing by ECHA, ECHA ’s content classified as Restricted or Highly  Restricted shall not be downloaded or copied from ECHA's IT systems to the IT  Contractor's or any other environment, by the IT Contractor. This includes also printing  out or copying such data on a screen (screenshots).  2. General Security Rules for IT Contractors Category  Definition  1 Basic Level  Risk related to the IT Contractor ’s access is  low  or  very low  and mitigation requires only basic security measures. 2 Increased Level  The IT Contractor still has limited and controlled access but risk  is increased to  moderate  level.  3 High Level  Risk related to this access level would be  high  without adequate  mitigation and therefore strong security measures are required.  This access level is comparable to MSCA access to ECHA IT Systems. 4 Highest Level  The risk level is higher than risks of any remote access granted  to normal users. The highest level of mitigation is required. 