A.6.2
Terms and conditions of employment
People controlsCheckpoints 6Evidence 6Cases 6
Control objective
This control ensures that the employment contract and equivalent agreements state the information security responsibilities of both the employee and the organization, establishing a documented basis for security obligations from the point of hiring, through employment, and for a defined period after the employment ends. If a contract carries no security responsibilities, the justification and enforceability of action after a violation are weak, and personnel struggle to understand the exact scope of their obligations. The control requires terms and conditions to reflect confidentiality, acceptable use of assets, policy compliance, and the consequences of violations, and requires personnel to be aware of and accept them.
Key checkpoints
- Does the employment contract (or a separate agreement/pledge) state the employee's information security responsibilities and the organization's responsibilities?
- Are confidentiality obligations for confidential information and personal data, and their duration (during and after employment), defined in the contract?
- Are security obligations differentiated by role/grade/access level reflected in the contract or pledge?
- Is there a procedure for personnel to sign or acknowledge compliance with information security policies and rules of conduct at the point of hiring/assignment?
- Does the contract include clauses on intellectual property rights, return of assets, and action on violation (such as disciplinary measures)?
- Are equivalent security terms applied across various employment forms, such as temporary, fixed-term, and dispatched workers?
Implementation guidance
- Include the employee's information security responsibilities, policy compliance obligations, and consequences of violation clearly in the employment contract or a supporting document (such as a security pledge).
- State confidentiality obligations that persist during and after employment along with their duration, and reflect legal obligations related to personal data protection.
- Reflect additional security obligations that arise from role characteristics and access level (key-duty personnel, administrators, personal data handlers, and so on) in the contract or pledge.
- Brief personnel on policies and rules of conduct at hiring/assignment/role change, and secure and record awareness and acceptance through signature or electronic consent.
- Include in the terms the organization's rights over its information and assets, ownership of intellectual property, and the obligation to return assets and access rights on departure.
- Provide standard wording and management procedures so that equivalent security terms apply regardless of employment form (permanent, fixed-term, dispatched, intern, and so on).
Evidence
- Standard employment contract template that includes information security responsibility clauses
- Security pledge or non-disclosure pledge signed by personnel
- Records of policy and rules-of-conduct briefing and consent at hiring/assignment
- Additional security obligation pledges by role/authority (key-duty personnel, personal data handlers, and so on)
- Documents applying security terms to fixed-term/dispatched/outsourced personnel
- Register for storage/renewal of pledges and contract documents
Nonconformity examples
- The employment contract has no clause on information security responsibilities or confidentiality obligations, so there is no basis for action on a violation.
- The duration of confidentiality obligations is not stated, so the scope of obligations after departure is unclear.
- Only some new joiners complete a security pledge while others are missed, so awareness/acceptance records are inconsistent.
- Only permanent staff sign a pledge, while fixed-term and dispatched personnel are not subject to equivalent security terms.
- Additional security obligations required of key-duty personnel or personal data handlers are not reflected in the contract or pledge.
- Pledges are collected but not stored or managed, so whether a specific person signed cannot be confirmed.