content_image/478796.jpg
<img src='content_image/478796.jpg'>

Internet is not allowed (Internet access for business purposes can be allowed only through the web proxy that filters out access to malicious websites or via other similar arrangements). 

R28: Access from public network to IT C ontractor’s network shall be controlled. Network access to workstations and other systems used for “access to ECHA IT systems” shall be strictly controlled also from other systems within IT Contractor’s internal network, for example by isolating them to a dedicated network segment (VLAN). 

R29: The risks of malware infection are mitigated by the IT Contractor. It shall include 

- Malware prevention software (anti-virus) is running on all such systems that are generally vulnerable to malware infections. Its signatures are regularly and frequently updated and it is monitored. 

- All incoming files (sent by email, downloaded from public network and so on) are scanned and malicious files are filtered out at the gateway level in the network boundary before transferred to internal network and processed on internal systems. Also, controls are in place to filter out dangerous incoming files based on their types. 

- Security rules are in place to control joining mass memories (external hard drives, USB stick etc.) to workstations. Users are allowed to joint only separately authorised mass memories with justified business reasons to the workstations used for “access to ECHA IT systems”. 

R30: Application installation to IT Contractor’s workstations and other systems used for “access to ECHA IT systems” is controlled so that only responsible workstation administrators have privileges to install applications, i.e. users do not have (local admin) privileges to install applications to their own workstations. Only applications with justified business reasons are installed. 

R31: Access and audit logs from all IT C ontractor’s systems related to “access to ECHA IT systems”, including logs from firewalls and other network devices, are re corded. Logs are protected from unauthorised tampering or removal and regularly monitored in order to detect unusual activities. 

R32: An intrusion detection or prevention system is in place in the IT C ontractor’s IT - environment used for “access to ECHA IT systems”. It is monitored, and suspected intrusions and unusual activities are promptly investigated and responded to. 

R33: The IT Contractor shall have an adequate computer security incident response readiness to react on suspected security incidents (investigate unusual events, collect evidences, and perform containment and remediation actions). 

