content_image/464232.jpg
<img src='content_image/464232.jpg'>

ICT Governance 

For ECHA IT systems, comprehensive set of IT security controls are implemented and maintained to allow ECHA to focus on its primary mission. As it is not realistic to prevent from all security threats, and, actually a high degree of prevention is nowadays even more challenging than before due to continuous evolving sophistication of threats and attacks.,, Thus, also reactive and monitoring controls have an important role in ECHA’s IT security system. 

IT security controls can also be divided to the following categories according to their nature: 

• Physical controls,  e.g. physical access control to the data center premises 

• Procedural controls,  e.g .  security incident response processes, security guidelines and rules, security awareness and training 12 ; 

• Technical / logical controls,  e.g. user authentication , antivirus software, firewalls; 

• Contractual controls,  e.g. security contracts and NDAs with the service providers, security declaration with 3 rd  parties 

At ECHA, feasible controls from different categories have been selected and combined in order to achieve efficient and effective risk management objectives. 

According to the principle of “s implicity and standardisation “ , the controls are standardised as much as possible. Thus, the same IT-controls are applied at the organization level (common controls). Usually common controls are more IT-infrastructure related than applications level due to higher level of standardisation at infrastructure layer. 

In addition to common controls, there are also system-specific controls. Usually, system- specific controls are additional security controls to complement required security measures, which are applied only to one or a few systems. Also, system specific control can also be a compensating control 13,  which is implemented instead of a common control. 

## 3.13.5. IT Security Evaluation and Monitoring 

The existing security measures are regularly evaluated and vulnerabilities identified in order to make sure that all the security measures are still in place, effective and fit for purpose as well as the existing vulnerabilities and weaknesses are identified before exploited. Active monitoring of security events support to achieve view of current state of security. .Thus, security evaluation and monitoring covers two different aspects: 

• preventive evaluation of security measures and detection of existing vulnerabilities, and 

