content_image/510116.jpg content_image/510127.jpg
<img src='content_image/510116.jpg'>

Applicability of the General Security Rules to different access levels: 

<img src='content_image/510127.jpg'>

(a  = only security incidents and non-compliances with the security rules shall be reported 

## 3. Security Requirements for IT Contractors 

The IT Contractors with remote access to ECHA IT systems must be compliant with the security requirements defined below, according to their access level category. 

Compliance can be achieved by having compensating controls which provides equivalent or higher level security. Thus, security requirements are not absolute but used more to define objectives of adequate level of protection. 

## 3.1. Physical security requirements for the IT C ontractor’s office premises used for remote access to ECHA ’s  IT systems 

R12: Access controls are in place on the premises or part of the premises used to deliver the services, in order to guarantee that the physical access is restricted to authorised individuals. 

R13: IT Contractor's physical access control is based on electronic keys. Electronic access keys are revoked in case of loss. The revoking service for the lost keys shall be available 24/7 unless a secondary access control mechanism is in place (e.g. a two- factor authentication with access key and PIN code). 

