6.2 Terms and conditions of employment
Employment contracts and agreements are to set out the information security responsibilities of both the individual and the organization. Purpose: make people understand, before they take a role, what it demands of them for security. Guidance: contractual obligations should be consistent with the top-level security policy and the topic policies that apply, and can also make clear: that people who will reach confidential information sign confidentiality or non-disclosure agreements before access (6.6); their legal rights and responsibilities, for example under copyright or data protection law (5.32, 5.34); their responsibilities for classifying information and managing the assets, facilities and services they handle (5.9 to 5.13); their responsibilities for information received from interested parties; and the consequences of ignoring security requirements (6.4). Security roles and responsibilities are communicated to candidates before employment, and personnel agree to security terms suited to the nature and extent of their access. The terms are reviewed when laws, regulations or policies change, and where appropriate some responsibilities continue for a set period after employment ends (6.5). A code of conduct is one way to express responsibilities for confidentiality, PII protection, ethics and proper use of assets; a supplier may sign on behalf of its individual staff; organizations without a legal entity or employees can use equivalent arrangements.
Source: ISO/IEC 27002:2022, 6.2. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open ISO/IEC 27002:2022 in the compliance library.
ISO/IEC 27002 is guidance on the Annex A controls; certification is against ISO/IEC 27001. Use this set when your sheet follows the 27002 numbering.
These are the artefacts auditors commonly ask for on this requirement, our guidance rather than text from the standard. Your assessor decides what is sufficient in your context, and asks for samples across the period when a report covers one.
system holds itEvidence a system already holds
none for this control
periodic reviewEvidence produced at each review
- Records showing terms were reviewed after changes in law, regulation or policy · Policy repository / GRC workspace
- A code of conduct covering confidentiality, PII, ethics and acceptable use, with acknowledgement records · Policy repository / GRC workspace
governing documentDocuments that govern the control
- Standard employment contract and contractor agreement templates with information security clauses reflecting the policies · Vendor register / contract repository
- Signed agreements for a sample of personnel, including confidentiality undertakings signed before access · Vendor register / contract repository
- Pre-employment communication of security roles and responsibilities to candidates · Policy repository / GRC workspace
- Clauses stating responsibilities that survive termination and for how long · HR system / LMS
First move
Common gaps auditors find
- Contracts contain a generic confidentiality clause but nothing about classification, handling or consequences
- Terms were never updated after policy or legal changes
- Contractor agreements lack the security terms employees sign
- Post-employment obligations are not defined, so they are unenforceable
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheet6.1 Screening · 6.3 Information security awareness, education and training