content_image/466670.jpg content_image/466682.jpg
<img src='content_image/466670.jpg'>

R21: Personnel having access to ECHA IT systems shall be aware of the security rules and shall be subject to signed agreement(s) covering Non-Disclosure and Security Rules Compliance. 

Applicability of the HR Security Rules to different access levels: 

<img src='content_image/466682.jpg'>

X (a  = Written document is not required but it must be known by the IT Contractor who are delivering services for ECHA. 

X (b  = shall be only familiar with the rules 

## 3.3. Security requirements for the IT C ontractor’s IT systems used to access ECHA IT-systems 

R22: The IT C ontractor’s workstations and other systems used for “access to ECHA IT systems” are strictly security configured and hardened according to industry security good practices or a security hardening guideline from an operating system vendor. End users do not have privileges to change the security settings. 

R23: Only authorised users have access to IT C ontractor’s workstations and other systems used for “access to ECHA IT systems”. Access rights are controlled and managed according to a formal access right management process, are kept up-to-date and the principle of least privilege is followed. 

R24: Log-on into IT C ontractor’s workstations and other systems used for “access to ECHA IT systems” shall happen with a personal user account, i.e. no shared accounts are allowed. 

R25: IT C ontractor’s workstations used for “access to ECHA IT systems” are automatically locked after a short inactivity period. Workstations shall be locked always when users leave the device (e.g. by using a password protected screen saver). 

R26: Security updates are regularly installed on IT C ontractor’s work stations and other systems used for “access to ECHA IT systems”. Security patching shall cover all applications and software installed on workstations and systems used for “access to ECHA IT systems”. 

R27: The IT C ontractor’s workstations and other systems used for “access to ECHA IT systems” shall be dedicated for IT service delivery purposes and therefore they cannot be used for any non-business purposes (e.g. web browsing), reading emails or similar activities for which security concern is high. Direct access from the workstations to 

