content_image/493039.jpg
<img src='content_image/493039.jpg'>

The employees and/or agents of the contractor shall: 

## ACCESS TO EMSA INFORMATION SYSTEMS 

$_{–}$ not access services for which they have not been explicitly granted authorisation, whether or not the services in question belong to the Agency; 

$_{–}$ not disclose authentication procedures or share them with third parties unless required to do so by the needs of the performance of the FWC; authorised users shall be responsible for action taken in their name; any action constituting a breach of security may be recorded; 

$_{–}$ not install or use on computers supplied by the Agency for the implementation of the FWC (work stations, local or central servers, etc.) any equipment or programmes developed outside the Agency, whether free of charge or not, from portable storage media or downloaded from external repositories, unless as part of the performance of the FWC; 

$_{–}$ not install connections on computers supplied by the Agency with networks outside the Agency without explicit authorisation; 

$_{–}$ notify the Project Officer and the security staff of the Agency as soon as they spot any failure or incident or vulnerability affecting the Agency’s information systems; 

$_{–}$ not investigate the security of the information systems themselves, unless authorised and supervised by the Project Officer and the security staff of the Agency. 

## REMOTE ACCESS 

The contractor might be granted remote access to EMSA IT Systems on a per-project/per-need basis, on EMSA’s sole decision. The current model for remote access follows the following process: 

1) EMSA authorises remote access for the contractor to specific IT systems on a strict per-need basis; 

2) The contractor connects via Virtual Private Network (VPN) to the EMSA Security Gateway; 

3) The EMSA Security Gateway will only allow the contractor to execute a remote desktop session from his PC to a working console hosted at EMSA and dedicated specifically to the contractor and to its project; 

4) From the working console hosted at EMSA, the contractor will have access rights strictly limited to the environments relevant to the project, normally a test environment only and related development services. 

Specific remote access technologies, and the remote access model itself, might evolve over time following the evolution of IT security and systems at EMSA. The contractor should inquire about the specific technologies and access model details at the time of implementation of the contract, and be able to comply with it in terms of installation of the required software (i.e. VPN client, certificates, tokens for two factor authentication etc.) and in terms of security requirements (i.e. antivirus or patches might have to be installed on the client connecting via VPN to EMSA, and only specific versions of Windows client might be able to connect). 

When the specific remote access technologies, and the remote access model itself, will be changed during the execution of the contract following the evolution of IT security and systems at EMSA, the contractor will receive via email the implementing details of the new model and technologies. The contractor has to comply with it within 1 month and must confirm its compliance by answering to the email. 

