content_image/482452.jpg content_image/482456.jpg
<img src='content_image/482452.jpg'>

## IT Contractors' Remote Access 

Applicability of the IT Security Requirements to different access levels: 

<img src='content_image/482456.jpg'>

X (a = At least: OS, web browser, PDF reader, Flash player, Java and office applications 

X (b = At least: Access from public network to IT Contractor’s network shall be controlled 

X (c = Antivirus on workstations at least 

X (d = Antivirus on workstations and filtering for incoming files at least 

X (e = A centralised log management and log correlation solution is required 

## 3.4. Information Security Management System (ISMS) 

An Information security management system (ISMS) is an overall framework for the whole information security work in an organisation. ISO/IEC 27001 certification (or an equivalent certification which requires that security management systems is assessed and verified regularly by an independent 3rd party auditor) is a confirmation that an organisation has formally defined and implemented ISMS. 

In case the IT Cont ractor’s remote access belongs to the category “Higher Level” or “Highest Level”, then the ISO/IEC 27001 certification (or an equivalent) is mandatory. The ISO/IEC 27001 certification (or equivalent) shall cover all systems, premises and procedures related to services which require “Higher Level” or “Highest Level” access to ECHA IT systems. 

