content_image/491904.jpg
<img src='content_image/491904.jpg'>

3.9. ICT Governance Bodies ........................................................................... 56 

3.9.1. IT Director’s Programme Board (IT DPB)  ............................................................... 56 

3.9.2. Programme Board (PgM)..................................................................................... 57 

3.9.3. Project Board (PB) ............................................................................................. 58 

3.9.4. Change Advisory Board (CAB) ............................................................................. 59 

3.9.5. ECHA IT Change Management Board (iCAB) .......................................................... 60 

3.10. ICT Governance Roles and Responsibilities ........................................... 61 

3.10.1. Roles and Responsibilities –  IT DPB .................................................................... 61 

3.10.2. Roles and Responsibilities - Programme Management ........................................... 61 

3.10.3. Roles and Responsibilities –  Service Management ................................................ 62 

3.10.4. Roles and Responsibilities –  Management of Project Work ..................................... 65 

3.10.5. Roles and Responsibilities - Deployment and Operations ....................................... 67 

3.10.6. Roles and Responsibilities - IT Security ............................................................... 70 

3.10.7. Roles and Responsibilities - Contract Management ............................................... 71 

3.11. IT Horizontal Functions ......................................................................... 72 

3.12. IT Procurement and Outsourcing of IT Work ......................................... 73 

3.12.1. Cost Accounting and activity / SECA Code Allocation............................................. 73 

3.12.2. Service Level Management (SLM) Reporting of Outsourced Work ........................... 74 

3.13. IT Security Management System ........................................................... 74 

3.13.1. Overall Description of IT Security Management System......................................... 75 

3.13.2. IT Security Risk Assessment .............................................................................. 77 

3.13.3. Designing and Planning of Risk Mitigation Actions................................................. 81 

3.13.4. Implementation of the IT Security Measures and Improvements ............................ 84 

3.13.5. IT Security Evaluation and Monitoring.................................................................85 

3.13.6. Corrective Actions and Improvements in IT Security ............................................. 87 

3.14. Exceptions to ICT Governance ............................................................... 87 

4.$_{ }$ Flowchart.........................................................................................88$_{ }$ 

5.$_{ }$ Definitions .......................................................................................88$_{ }$ 

6.$_{ }$ Records............................................................................................92$_{ }$ 

7.$_{ }$ Annexes ...........................................................................................92$_{ }$ 

