Document code:  POL-0016.04  Security level:  Internal  Effective date:  30/06/2020  IT Contractors’ Remote Access 1. Purpose  2. Scope  3. Contents 3.1. Policy statement  3.2. Risk management principles applied  Risk management approach  IT Contractors providing off- site outsourced services to ECHA can access ECHA’s IT systems  only when compliant with the security model as presented in Annex I to address the  identified and regularly re-assessed security risks in that context. Access to IT Contractors is granted by ECHA in accordance with the principle of least  privileges, as defined in ECHA ICT Security Management System (Section 3.13 in PRO- 0027). Like other IT security risks, also security risks related to the outsourcing of IT services and  notably to the IT C ontractor’s  remote access are managed according to  ECHA ICT Security  Management System  (Section 3.13 in PRO-0027).  Hosting services are out of scope for this policy. Also, data transmission and telephone  services provided through public networks by Internet Service Providers (ISPs) and telecom  operators are beyond the scope for the policy. The scope of this policy is limited to the remote access of IT service providers (called IT  Contractors hereafter)  to ECHA’s IT systems  while delivering services under a service  contract with ECHA.  The aim of this Policy is enabling ECHA to use modern sourcing models for IT services in a  cost effective and highly secure manner, in line with legal requirements and state of the art  security standards. This Policy defines the security principles to be followed for granting remote access to IT  service providers to ECHA’s IT systems containing data classified as public, internal,  restricted or highly restricted (PRO-0085), in the context of outsourced services. TEM-0129.01  Uncontrolled copy once printed. Ensure that the right version is in use.  Page  2  of  22