content_image/455122.jpg
<img src='content_image/455122.jpg'>

## Annex III 

## IT Contractors' Remote Access 

## Additional Teleworking Rules for Access to ECHA’s Information Systems by IT Contractors 

In the context of this document teleworking is used to describe any kind of remote access outside Contractor’s protected office premises.  Additional teleworking requirements shall be applied on top of all other applicable rules and requirements (Annex I, rules/requirements R1 –  R33) with the exceptions due to the nature of teleworking. Thus, physical security requirements for the IT Contractor’s office premises (Section 3.1. of Annex I, rules/requirements R12 –  R18) are not required for the teleworking location. To compensate missing physical security measures due to the nature of teleworking, there are the following additional teleworking requirements: 

1. Risk shall be assessed, and teleworking policy and rules must be in place: 

a. A documented risk analysis has taken place to identify and assess risks related to the teleworking. Teleworking can be allowed only when the risk level is acceptable in comparison to the business benefits. 

b. A teleworking policy, that defines the purpose, procedures, conditions and responsibilities for teleworking, shall be in place. The implemented teleworking policy should be in line with the restrictions defined in ECHA policy on IT Contractors’ remote access and take into account the results of the risk assessment. 

c. Teleworking from public places is not permitted under any circumstances. ECHA IT systems cannot be accessed for example in a train, airport lounge, hotel lobby or other public places. On the other hand ECHA IT Systems can be accessed at home (provided that family members or other people cannot oversee ECHA information on screen and cannot access the workstation with active connection to ECHA systems) or at Contractor’s other office premises beyond the scope of the defined service delivery sites. 

2. Teleworking-related security procedures 

a. The security awareness process in place shall ensure that the security considerations relevant for teleworking are understood. 

b. The incident reporting and response process in place must also cover teleworking e.g. to limit the potential impact of loss or theft of equipment. 

3. IT security requirements for teleworking access solution and the devices used for teleworking: 

