content_image/506607.jpg
<img src='content_image/506607.jpg'>

## 1. Purpose 

## IT Contractors’ Remote Access 

This Policy defines the security principles to be followed for granting remote access to IT service providers to ECHA’s IT systems containing data classified as public, internal, restricted or highly restricted (PRO-0085), in the context of outsourced services. 

The aim of this Policy is enabling ECHA to use modern sourcing models for IT services in a cost effective and highly secure manner, in line with legal requirements and state of the art security standards. 

## 2. Scope 

The scope of this policy is limited to the remote access of IT service providers (called IT Contractors hereafter) to ECHA’s IT systems while delivering services under a service contract with ECHA. 

Hosting services are out of scope for this policy. Also, data transmission and telephone services provided through public networks by Internet Service Providers (ISPs) and telecom operators are beyond the scope for the policy. 

## 3. Contents 

## 3.1. Policy statement 

IT Contractors providing off- site outsourced services to ECHA can access ECHA’s IT systems only when compliant with the security model as presented in Annex I to address the identified and regularly re-assessed security risks in that context. 

Access to IT Contractors is granted by ECHA in accordance with the principle of least privileges, as defined in ECHA ICT Security Management System (Section 3.13 in PRO- 0027). 

## 3.2. Risk management principles applied 

## Risk management approach 

Like other IT security risks, also security risks related to the outsourcing of IT services and notably to the IT C ontractor’s remote access are managed according to ECHA ICT Security Management System (Section 3.13 in PRO-0027). 

