content_image/454615.jpg
<img src='content_image/454615.jpg'>

## IT Contractors' Remote Access 

compliance of its subcontractors. The IT Contractor must verify and report to ECHA the compliance before remote access is granted, and continuously during the subcontracting. 

R4: By default, remote access can be granted only from the IT C ontractor’s protected premises. Teleworking access from outside the IT Contr actor’s premises needs exp licit authorisation from ECHA when justification exists and the teleworking access is at least compliant with ECHA's security rules for teleworking (indicative teleworking rules are presented in Annex III). 

R5: Only the IT C ontractor’s authorised users with valid business justification may have access rights to ECHA IT systems. All access rights are kept up-to-date and the principle of least privilege is followed. IT Contractor’s access rights to ECHA systems are regularly (at least twice a year) reviewed by the IT Contractor. History of access rights granted is kept by the IT Contractor for the duration of the Contract. 

R6: IT C ontractor’s remote access to ECHA IT Systems is allowed only through the remote access systems approved by ECHA. 

R7: All factors, physical or logical (e.g. hardware tokens, PIN codes, passwords) used for authentication to ECHA IT systems must be carefully protected against being lost, stolen or disclosed. Authentication factors are not allowed to be given or revealed to unauthorised people. Passwords, PIN codes and other similar authentication factors shall be appropriately protected against disclosure when used or stored, and must be encrypted if stored electronically. 

R8: The IT Contractor shall have a nominated person responsible for the implementation and maintenance of ECHA’s security requirements , i.e. the IT Contractor shall ensure that adherence to the security rules is incorporated into their day-to-day working practices when delivering services to ECHA. This nominated person shall act as Security Contact Point for ECHA. 

R9: All occurred security incidents, identified significant security weaknesses and risks related to IT Contractor’s premises, IT -systems or processes used to deliver services for ECHA as well as any non-compliances with the security rules shall be reported by the IT Contractor to ECHA without delay. Incident reports shall contain the following elements: Executive summary, Context, Identification and Impact of the incident, Course of Events including actions taken, Communication to ECHA, Root Cause Assessment, and Conclusions. 

R10: The IT Contractor will allow and support ECHA to conduct regular audits, on request. 

R11: The Contractor shall accept to comply with the changes to the security model stemming from the regular risk assessment performed by ECHA as foreseen by the IT Contractors Remote Access Policy. Otherwise the access can be revoked. 

