content_image/504629.jpg
<img src='content_image/504629.jpg'>

The requirements related to the contractual obligation are divided into the following categories: 

• All new framework contracts for the outsourcing of IT services shall include a requirement of compliance with this policy and related security model if granting remote access is foreseen. 

• The existing framework contracts should be amended to incorporate the requirement of compliance with the policy and related security model before new accesses can be granted. 

• A temporary exception can be authorised if remote access to ECHA IT systems was granted before this policy was approved. The exception allows keeping the existing remote accesses for a temporary period required to implement the security requirements and amend the contract with the compliance requirements. 

## 3.4. Governance and responsibilities 

The Executive Director authorises the duly motivated exceptions on the basis of a request from the Director of Information Systems. 

The Director of Information Systems is responsible for the application of the policy. Advised by the ICT Security Officer, s/he will approve risk mitigation options proposed by IT Contractors, equivalence of compensating controls implemented by IT Contractors and decides on the acceptance of residual risks of specific risk assessments. 

The ICT Security Officer performs annual assessments of the generic risk profile and, based on the assessment, makes improvement proposals to the security model. 

The Data Protection Officer (DPO) is responsible that requirements and rules in the security model for external IT Contractors are compliant with the EU privacy and data protection legislation. 

The Information Security Officer is responsible that requirements and rules in the security model are in line with ECHA’s information security principles. 

ECHA’s operational roles and responsibilities to apply the policy in practice are described in the security model in the Annex I. 

