6.6 Confidentiality or non-disclosure agreements
Confidentiality or non-disclosure agreements that match the organization's information protection needs are to be identified, written, reviewed regularly and signed by staff and by the outside parties concerned. Purpose: keep information that staff or outside parties can reach confidential. Guidance: agreements protect confidential information through legally enforceable terms and apply both to personnel and to interested parties. Their terms follow from the organization's security requirements, considering the kind of information handled, its classification, how it will be used and what access the other party is allowed. Elements to consider are: what information is protected; how long the agreement lasts, including cases where confidentiality must hold with no end date or until the information is made public; what must happen when it ends; signatories' duties and actions to prevent unauthorized disclosure; who owns the information, any trade secrets and any intellectual property, and what that means for keeping it confidential; permitted uses and the signatory's rights of use; a right to audit and monitor activity involving confidential information in highly sensitive cases; how unauthorized disclosure or leakage is notified and reported; return or destruction of information at the end; and the consequences of breaching the agreement. Enforceability in the applicable jurisdiction is considered (5.31 to 5.34), and requirements are reviewed periodically and whenever circumstances affecting them change. Other information: such agreements both protect the organization's information and remind signatories of their duty to handle it responsibly and only as authorized.
Source: ISO/IEC 27002:2022, 6.6. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open ISO/IEC 27002:2022 in the compliance library.
ISO/IEC 27002 is guidance on the Annex A controls; certification is against ISO/IEC 27001. Use this set when your sheet follows the 27002 numbering.
These are the artefacts auditors commonly ask for on this requirement, our guidance rather than text from the standard. Your assessor decides what is sufficient in your context, and asks for samples across the period when a report covers one.
system holds itEvidence a system already holds
none for this control
periodic reviewEvidence produced at each review
- Legal review confirming enforceability in the relevant jurisdictions · Vendor register / contract repository
- Records of periodic review of agreement requirements and updates after relevant changes · Vendor register / contract repository
governing documentDocuments that govern the control
- Approved NDA and confidentiality agreement templates covering definition of protected information, duration, termination actions, ownership, permitted use, audit rights, breach notification, return or destruction and non-compliance consequences · HR system / LMS
- Signed agreements for personnel and for relevant external parties, dated before access was granted · Vendor register / contract repository
- A register of agreements in force with their parties and expiry or survival terms · Vendor register / contract repository
First move
Common gaps auditors find
- NDAs are signed after access has already been given
- Templates are outdated and omit return or destruction of information at termination
- No register exists, so the organization cannot tell who is bound by what
- Agreements with suppliers or consultants are missing because procurement uses its own contract templates
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheet6.5 Responsibilities after termination or change of employment · 6.7 Remote working