content_image/483339.jpg
<img src='content_image/483339.jpg'>

## 5.3. Evaluation of compliance 

The IT Contractor shall have documented practices on how they will check and evaluate that the security measures and controls are effective and adequate to comply with ECHA’s security model. 

Whereas ECHA will assess and accept the IT Contractor’s documented evaluation and controlling practices separately, the following is the minimum requirement for IT Contractor Access belongs to the category “ High Level ” or “ Highest Level ”: Compliance and effectiveness of all security measures and controls must be reliably checked at least once a year,  covering all premises, systems and procedures related to the IT C ontractor’s access to ECHA. 

The IT Contractor shall also describe how the results of performed checks, reviews and audits will be reported to ECHA, in particular with respect to identified non-compliances and improvement needs. ECHA primarily verifies compliance of IT Contractor by checking the results of reported checks, reviews and audits that are performed and reported by the IT Contractor or its 3 rd  party independent auditors. 

