Document code:  POL-0016.04  Security level:  Internal  Effective date:  30/06/2020  IT Contractors' Remote Access  The requirements related to the contractual obligation are divided into the following  categories: The Executive Director authorises the duly motivated exceptions on the basis of a request  from the Director of Information Systems. The Director of Information Systems is responsible for the application of the policy. Advised  by the ICT Security Officer, s/he will approve risk mitigation options proposed by IT  Contractors, equivalence of compensating controls implemented by IT Contractors and  decides on the acceptance of residual risks of specific risk assessments. The ICT Security Officer performs annual assessments of the generic risk profile and, based  on the assessment, makes improvement proposals to the security model. The Data Protection Officer (DPO) is responsible that requirements and rules in the security  model for external IT Contractors are compliant with the EU privacy and data protection  legislation. The Information Security Officer is responsible that requirements and rules in the security  model are in line with ECHA’s information security principles. ECHA’s operational roles and responsibilities to apply the policy in practice are described in  the security model in the Annex I. Page  4  of  22 TEM-0129.01  Uncontrolled copy once printed. Ensure that the right version is in use.  3.4. Governance and responsibilities  • A temporary exception can be authorised if remote access to ECHA IT systems was  granted before this policy was approved. The exception allows keeping the existing  remote accesses for a temporary period required to implement the security  requirements and amend the contract with the compliance requirements.  • The existing framework contracts should be amended to incorporate the requirement  of compliance with the policy and related security model before new accesses can be  granted. • All new framework contracts for the outsourcing of IT services shall include a  requirement of compliance with this policy and related security model if granting  remote access is foreseen.