content_image/456982.jpg content_image/456983.jpg
<img src='content_image/456982.jpg'>

<img src='content_image/456983.jpg'>

## 5.2. Documentation and change management for IT Contractor’s security measures 

The IT Contractor shall have up-to-date documentation, shared with ECHA, of the security measures and controls implemented to fulfil the security model. As a part of that documentation IT Contractor’s premises (or part of the premises) used for remote access to ECHA IT systems are listed. Also, IT Contractor’s relevant IT systems related to remote access to ECHA IT Systems are described. 

The IT Contractor is allowed to change security measures and controls only if the changed security measures and controls are still compliant with ECHA's security model. Therefore IT Contractor shall have a formal change management procedure to ensure compliance with ECHA’s security rules and requirements . Potential changes to security measures and controls shall be communicated to ECHA for approval, prior to their implementation. 

