content_image/505029.jpg
<img src='content_image/505029.jpg'>

## Annex I 

## Security Model 

## 1. Introduction 

## IT Contractors' Remote Access 

ECHA adopts an information-centric approach to risk management in the context of this policy; therefore focus is put on controlling access to data. 

The security model is defined by categorising the IT Contractor’s access to ECHA’s IT systems into four different access levels based on corresponding risk levels. 

A set of security rules and requirements is defined for each access category to address the risks of that category. 

Industry good practices 1  and requirements 2  for Member States remote access are used as a reference material for security rules and requirements and they are optimised to address particularly risks related to IT Contractor’s access. 

The security model also defines a formal process to achieve assurance that the IT Contractor implements the security model and keeps it up-to-date according to the aforementioned annual risk assessment. 

The Security Model describes the rules and requirements to mitigate the identified risks associated to granting access for IT Contractors to ECHA IT systems and data. 

The Security Model also defines requirements for ECHA and describes how assurance of IT Contractor s’ compliance is achieved and maintained. 

## 1.1. Access Categories 

Primarily the following aspects are considered to establish the risk levels associated to the IT Contractor’s access : 

a) Content of the targets to be accessed by the IT Contractor 

Which IT-systems need to be accessed and in which environment such systems are located, possible integrations and interfaces which can make other ECHA’s IT systems accessible from the target systems. Criticalities of system based on negative impact on ECHA in case of system compromised have been defined in ECHA ICT Security Management System (Section 3.13 in PRO-0027). 

b) Level of privileges and which information the IT Contractor can access with such privileges. 

c) Type of remote connectivity applied. 

