content_image/473205.jpg content_image/473219.jpg
<img src='content_image/473205.jpg'>

## IT Contractors' Remote Access 

R14: Physical entrance to the premises or part of the premises used to deliver the services is monitored by recording CCTV for video surveillance. 

R15: Visibility of non-public ECHA information on screen shall be adequately restricted from outside of IT Contractor’s premises. 

R16: Intruder alarm systems on external doors and windows on the ground level are present. 

R17: Practices shall be in place to identify personnel, maintenance staff and authorised visitors. Badges with photographs (or equivalent visible identifiers) shall be used to identify the staff members. 

R18: IT Contractor’s visitors without clear business justification should not visit the areas or the rooms of the premises in which the activities that require access to ECHA IT systems are performed. Visitors are not allowed to be left in these areas or rooms without the host or his/her representative. The identity of all visitors entering the premises shall be checked and the visitors shall be registered when entering the IT Contractor’s premises. 

Applicability of the Physical Security Rules to different access levels: 

<img src='content_image/473219.jpg'>

## 3.2. HR Security related requirements for IT Contractor’s personnel who have remote access to ECHA’s IT -system 

R19: An up-to-date list of IT Contractor’s  service delivery staff members with their roles shall be maintained by the IT Contractor. 

R20: Personnel having access to ECHA IT systems must have a clean criminal record. The IT Contractor shall check their criminal records before their authorisation for the access. 

