content_image/453348.jpg
<img src='content_image/453348.jpg'>

## Table 4: IT Enterprise Architecture & Strategy deliverables (WP 2.1) 

## 4.2.1.4. Pricing 

As the nature of the assignments may vary ECHA may decide on all contracting mode namely, Quoted time and means, Time and Means or Fixed Price. 

## 4.2.2. Security (WP 2.2) 

The applicable ECHA security rules and requirements fall into the following categories, which are further elaborated in Annex 20 –  IT security requirements: 

• General security requirements for all services 

• Security rules and requirements for remotely delivered services entailing access to ECHA IT systems. (Principally this defines how the contractor needs to take into account security in the contractor's IT environment, physical premises, HR processes etc., which are related to remote access to ECHA) 

• Requirements for secure application design and development 

• Security responsibilities related to application management (e.g. patch ECHA’s middleware components and databases, security monitoring tasks to be done in ECHA's application environment, falling under the scope of this FWC666) 

## 4.2.2.1. Objectives 

The objective of this work package is to ensure the proper implementation of the ECHA IT security policies across all services of this FWC666 including implementation of preventive measures, risk management, comprehensive monitoring and effective coordination of remedial actions/plans in case of incidents. 

The below are non-exhaustive lists of activities and deliverables expected. 

## 4.2.2.2. Activities 

• Set up and maintain their (contractor ’s) security measures and controls, including preparing the relevant documents and reports, to be fully compliant with the requirements defined in ECHA’s security policy on IT contractors ’ Remote Access (Annex 12); 

• Complete and continued adherence with the ECHA’s security standards including any updates in the security requirements and follow up those changes with proper change management; 

• Adapt to the possibility that ECHA may choose to suspend usage of all or part of the remote access solution for any period of time; 

• Perform the eventual decommissioning of the security solution at the end of the Framework Contract; 

• Create security reports 

## 4.2.2.3. Deliverables 

The contractor must have all aspects of the security solution in place, up and running at the required standard, at the latest within 3 months from the signing of the FWC666. ECHA request that the timescale is shorter than this if possible; however, the timescale should not be fast at the expense of not having a high-quality security solution. 

