If IT systems are maintained remotely by third parties without a contractual basis, the responsibilities for remote maintenance may not be clearly defined. As a result, role separation can be circumvented, for example, or open remote maintenance access may not be documented.