Document code:  POL-0016.04  Security level:  Internal  Effective date:  30/06/2020  IT Contractors' Remote Access  R21: Personnel having access to ECHA IT systems shall be aware of the security rules and  shall be subject to signed agreement(s) covering Non-Disclosure and Security Rules  Compliance.  R22: The IT C ontractor’s workstations and other systems used for “access to ECHA IT  systems” are strictly security configured and hardened according to industry security  good practices or a security hardening guideline from an operating system vendor.  End users do not have privileges to change the security settings.  R23: Only authorised users have access to IT C ontractor’s workstations and other systems  used for “access to ECHA IT systems”. Access rights are controlled and managed  according to a formal access right management process, are kept up-to-date and the  principle of least privilege is followed.  R24: Log-on into IT C ontractor’s workstations and other systems used for “access to ECHA  IT systems” shall happen with a personal user account, i.e. no shared accounts are  allowed.  R25: IT C ontractor’s workstations used for “access to ECHA IT systems” are automatically  locked after a short inactivity period. Workstations shall be locked always when users  leave the device (e.g. by using a password protected screen saver).  R26: Security updates are regularly installed on IT C ontractor’s work stations and other  systems  used for “access to ECHA IT systems”. Security patching shall cover all  applications and software installed on workstations and systems used for “access to  ECHA IT systems”. R27: The IT C ontractor’s workstations and other systems used for “access to ECHA IT  systems” shall be dedicated for IT service delivery purposes and therefore  they cannot  be used for any non-business purposes (e.g. web browsing), reading emails or similar  activities for which security concern is high. Direct access from the workstations to  TEM-0129.01  Uncontrolled copy once printed. Ensure that the right version is in use.  Page  11  of  22 3.3. Security requirements for the IT C ontractor’s  IT systems used  to access ECHA IT-systems Applicability of the HR Security Rules to different access levels:  Rule /  Requirement  #  Basic Level  Increased  Level  Higher  Level  The Highest Level  R19  X (a X (a X  X  R20  -  -  -  X  R21  -  X (b X  X  X (a  = Written document is not required but it must be known by the IT Contractor who are  delivering services for ECHA. X (b  = shall be only familiar with the rules