content_image/455719.jpg content_image/455728.jpg
<img src='content_image/455719.jpg'>

management procedure shall involve ICT security to assess potential impact of the change on the risk level related to IT Contractors’ remote access. 

ECHA shall continuously monitor threats and risks, and perform annual risk assessments. In case of a significant change in the risk profile a process to update security rules and requirements and adding additional mitigation factors is activated. 

## 4.2. ECHA’s operational roles and responsibilities 

The role of ICT Security Officer is to support the implementation of the policy and to advise the Director of Information Systems for what pertains to the application of this policy. 

Framework Contract Managers are responsible for the governance of security whenever applicable to the framework contracts they are responsible for. 

Contract Managers, Service Managers and other persons who have a key role in IT service outsourcing shall be aware of this policy and related security model. They are responsible for making sure that this policy and related security model are applied whenever remote access is granted. 

E CHA’s operational roles and related tasks to apply the policy are listed in more detail in the table below. 

<img src='content_image/455728.jpg'>

