content_image/465008.jpg
<img src='content_image/465008.jpg'>

## Risk management strategy 

The risk management strategy will focus on avoiding risks, reducing and mitigating unavoidable risks and accepting the (residual) risks over transferring the risk via contractual means to the contractor. 

## Risk identification and assessment 

Relevant risks related to IT Contractors’ remote access are identified according to the procedure described in ECHA ICT Security Management System  (Section 3.13 in PRO-0027). 

The relevant identified risks are assessed by comparing the risks of services performed on premise with the risks of the same services being performed off premise in the context of an outsourcing contract. 

In addition to such generic risk assessment, a specific risk analyses may be performed based on need as detailed in Annex I. 

## Risk mitigation 

A security model (see 3.3 in Annex I) with security rules and requirements is established to address the identified risks. Remote access for IT Contractors can be granted only when they comply with the security model. 

Additional risk mitigation actions may be requested case-by-case, based on the result of a specific risk assessment as detailed in Annex I. 

The mandatory requirements set in the security model cannot be relieved based on the result of a case-by-case specific risk assessment without an appropriate authorisation. 

## Changes in the risk profile 

As technology changes and new threats arise, a risk assessment is performed annually by ECHA (as detailed in Annex I) and, whenever a relevant change affecting the risk profile is detected, the security model is updated as needed and a process of propagation of the changes to the IT Contractors having access is performed. 

If a major change in ECHA’s IT architecture or system integration is proposed (a fundamental change or one having high risk or high impact potential –  in case of uncertainty the Architectural Focal Point (AFP) will make the decision), impact on risk related to IT Contractors’ access to ECHA IT systems is assessed and taken into account as part of the impact assessment described in ICT Governance (PRO-0027). 

## 3.3. Provisions for the application of this Policy 

There must be a contractual obligation to be compliant with the policy before remote access can be granted to IT Contractor. The Contract Manager is responsible for ensuring that the contractual obligation is in place to the extent possible within the used contractual framework and that the contractor is fully aware of the obligation. 

