content_image/510009.jpg content_image/510021.jpg
<img src='content_image/510009.jpg'>

The four categories of access are: 

<img src='content_image/510021.jpg'>

Risk levels very low , low ,  moderate , high  and very high  are defined in ECHA ICT Security Management System (Section 3.13 in PRO-0027). 

Usually IT Contractors must have high privileges to live data for development, testing or supporting purposes. Therefore the default access level is the Highest Level . Lower levels can be applied only based on the result of a specific risk assessment with clear justifications. 

In order to support applying access level categories in practice, some concrete examples of IT Contractor s’ accesses belong to different levels are described in the Annex II. 

## 2. General Security Rules for IT Contractors 

The general security rules listed below are mandatory and absolute by their nature which means that compliance with the general security rules cannot be achieved by implementing any compensating or alternative security measures or controls. 

R1: Access to ECHA’s content stored and processed by ECHA’s IT systems is allowed only on need to know basis, in the context of the services performed. Unless explicitly requested in writing by ECHA, ECHA ’s content classified as Restricted or Highly Restricted shall not be downloaded or copied from ECHA's IT systems to the IT Contractor's or any other environment, by the IT Contractor. This includes also printing out or copying such data on a screen (screenshots). 

R2: All service delivery facilities used to access ECHA’s IT systems must be located within the European Union Member States. 

R3: Subcontractors having remote access to ECHA IT systems must be fully compliant with security rules and requirements in this policy. The IT Contractor is in charge of the 

