content_image/504447.jpg
<img src='content_image/504447.jpg'>

In case the IT Contractor’s access belongs to the category “Basic” or “Increased”, it is recommended but not mandatory to have a valid ISO/IEC 27001 certification (or equivalent). 

## 4. ECHA ’s security requirements and operational roles 

## 4.1. Security requirements for ECHA 

Before granting remote access for an IT Contractor, ECHA shall assess the IT Contractor’s compliance with security rules and requirements, and record the results of such assessment. 

All cases of granted remote access shall be documented and the documentation maintained. 

ECHA shall supervise and control that IT Contractor maintains compliance with the rules and requirements in the security model. This is primarily done by requesting and regularly checking reports from the IT Contractor (e.g. IT Contractor’s se lf-assessments and audits reports generated by 3 rd party auditors), at least annually if the IT Contractor’s access level is High Level or Highest Level . ECHA may also perform audits in order to achieve adequate assurance of the IT Contractor’s compliance . The details of the assessment and the evaluation procedures are described in the chapter “ 5. Assurance of Compliance ” . 

ECHA shall provide and manage a secure remote access IT solution to support the IT Contractor’s secure connectivity over the Internet with a strong encryption and authentication. In case IT Contractor’s access belongs to the category High  or Highest Level, remote access solution must be configured to allow connections only from IT Contra ctor’s network, i.e. IP source restrictions to limit access only from contractor’s IP addresses or other similar controls. 

ECHA shall have technical preventive controls in place to restrict the IT Contractor’s further access to other ECHA IT systems from the target systems, particularly to prevent the IT Contractor from achieving access that belongs to a higher level category. 

ECHA shall have controls in place to have adequate traceability of IT Contractor’s remote access. 

In case the IT Contractor’s remote access belongs to the category High Access  or Highest Access , ECHA shall have a nominated counterpart for the IT Contractor’s security contact point. ECHA is in charge of ensuring that IT Contractor’s security contact point has adequate knowledge of ECHA’s security rules and requirements. 

In case of high or highest access categories, also a security governance model shall be set up together with the IT Contractor at framework contract level. Such governance model shall cover at least: security incident response procedures, communication between organisations, coordination of joint actions and preapproved containment actions, reporting. 

Procedures set up in the context of the security governance shall be jointly tested by ECHA and the IT Contractor. 

IT Contractors’ remote accesses shall be taken into account when changes in ECHA’s IT architecture or major changes in ECHA’s IT systems are considered. Thus, ECHA’s IT change 

