A.6.6
Confidentiality or non-disclosure agreements
People controlsCheckpoints 6Evidence 6Cases 6
Control objective
This control ensures that the organization identifies requirements for confidentiality/non-disclosure agreements (NDAs) reflecting its need to protect information, documents them, obtains signatures from personnel and external parties, and reviews them regularly. Because information is inevitably shared with people during hiring, contracting, and collaboration, such agreements clarify each party's confidentiality obligations, the scope of the information covered, and the consequences of a breach, providing a legally enforceable basis. The control aims to deter disclosure in advance, establish confidentiality obligations that persist after a relationship ends, and give the organization grounds to act when a breach occurs.
Key checkpoints
- Are the requirements for confidentiality/non-disclosure agreements (covered information, obligations, validity period) identified and documented to reflect the sensitivity and protection needs of the information?
- Are agreements signed at the point of hiring/assignment for personnel and at contract conclusion for external parties, and are the records maintained?
- Do the agreements specifically include the definition of protected information, obligations for handling/returning/destroying information, and responsibilities and actions in case of breach?
- Is the duration of confidentiality obligations that continue after the employment/contract relationship ends clearly stated?
- Are the agreement templates reviewed and updated regularly in response to legal changes, organizational changes, and changes in the information environment?
- Is there a procedure to identify unsigned parties or those needing renewal and to carry out follow-up actions?
Implementation guidance
- Analyze the types and sensitivity of information requiring protection and define the requirements to include in the agreement (scope of covered information, confidentiality obligations, permitted/prohibited actions, validity period).
- Establish a procedure for personnel to sign early in hiring/assignment and for external parties (processors, partners, consultants, visitors) to sign before accessing information or at contract conclusion.
- Define protected information, use restrictions, return/disposal, unauthorized disclosure, and breach responsibilities. Include lawful exceptions and procedures for required or protected reporting/disclosure so the agreement does not improperly restrict them.
- Specify in the agreement the confidentiality obligations and their duration that persist after employment/contract termination, to prevent disclosure after the relationship ends.
- Record and manage signing status per individual, and run a follow-up procedure for unsigned parties or those requiring re-signature.
- Review the agreement templates regularly to reflect changes in laws, contractual requirements, and the threat environment, update them as needed, and assess whether existing parties should re-sign upon revision.
- Reflect applicable processing duties for specially protected information such as personal data. An employee or processor NDA does not substitute for data subject consent or another lawful processing basis; verify these separately.
Evidence
- Standard confidentiality/non-disclosure agreement templates (for personnel and for external parties)
- Signed security pledges/non-disclosure agreements per individual and a signature register
- Confidentiality clauses within external party (processor, partner) contracts or separate NDAs and their signature records
- Review/revision history of agreement templates and documents stating reasons for revision
- Records of identifying unsigned parties and follow-up actions
- Notification and confirmation documents on confidentiality obligations at employment/contract termination
Nonconformity examples
- A non-disclosure agreement template exists, but there are no actual signature records or only some parties signed, so implementation cannot be confirmed.
- External parties are granted access to information without securing a non-disclosure agreement or a relevant clause in the contract.
- The agreement does not state the scope of protected information or responsibilities for breach, so it is ineffective.
- Confidentiality obligations that persist after employment/contract termination and their duration are not stated in the agreement.
- The agreement template has not been reviewed/updated for years despite legal or organizational changes, so it does not reflect current requirements.
- Signatures were obtained, but the individuals processed them as a formality without understanding the agreement or their confidentiality obligations.