6.6 Confidentiality or non-disclosure agreements
Requires confidentiality or non-disclosure agreements matching the organisation's need to protect information to be identified, documented, reviewed on a regular basis and signed by personnel and by other relevant partie
5
artefacts
0
held by a system
4
at each review
hard
to go live
Vendor register / contract repository
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
none for this control
periodic reviewEvidence produced at each review
- The confidentiality or non disclosure agreements in use, and the assessment showing they reflect the organisation's protection needs · Vendor register / contract repository
- Signed agreements for personnel and for third parties with access, held and retrievable · Vendor register / contract repository
- Evidence of regular review of the agreement terms and of who is covered · Vendor register / contract repository
- Records of the duration of the obligation and of what happens on termination · HR system / LMS
governing documentDocuments that govern the control
- Evidence agreements are in place before access is granted, not afterwards · Vendor register / contract repository
First move
This control is evidenced by people and documents, not systems. Put the document under version control with an owner and review date, and log each review as a record with reviewer and date. Do not try to automate it.
Common gaps auditors find
- Agreements signed at onboarding and never reviewed as the business or the information changed
- Coverage gaps for contractors, interns, auditors and visitors who nonetheless see confidential information
- Signed copies unretrievable, so the obligation cannot be evidenced when it must be enforced
- Obligation expiring at termination of employment, leaving no protection at the point of highest risk
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheet6.5 Responsibilities after termination or change of employment · 6.7 Remote working