Control A.6.2Terms and conditions of employment
What it means in practice
The employment contractual agreements must state the personnel’s and the organisation’s responsibilities for information security.
The control that makes the obligations enforceable. Awareness under clause 7.3 tells people what is expected; this is what they have agreed to, and it is the foundation the disciplinary process in A.6.4 stands on.
What belongs in the agreement is the security responsibility in general terms, the reference to the policies that apply, the confidentiality obligation, and the responsibilities that survive the end of the employment — which A.6.5 and A.6.6 then carry.
The practical weakness is drift. Terms drafted years ago may not cover remote working, personal devices, cloud services or the use of generative tools, and a contract that does not address a practice the organisation now depends on leaves the expectation unstated. For contractors and agency staff the obligation sits in the commercial contract instead, and the two frequently say different things.
How to put this in place
Security duties only hold if they are written into the terms people sign. An ISMS project needs contracts and agreements to carry those duties, or discipline and enforcement later rest on nothing.
- List every contract template: employees, contractors, agency staff and interns.
- Add confidentiality and security responsibilities, referring to the policies, and state which duties continue after leaving.
- Have Legal review the wording and replace old templates everywhere they are still used.
- Make signature part of the joining checklist, before access starts.
- Review the templates when policies or law change.
Evidence an auditor usually looks for: current contract templates with the security clauses, and signed contracts for a sample of staff and contractors.
What is in the packs for this
Each one helps with this requirement.
- Excel
Annex A Control Implementation Library
in ISO 27001 Implementation & Certification ReadinessIts row in the Control Library: what it is for, practical steps, what an auditor samples, the usual owner, common mistakes and whether it usually applies. - Excel
Statement of Applicability Template
in ISO 27001 Implementation & Certification ReadinessHas its own row on the Statement of Applicability sheet, where you record whether it applies, why and how far it is implemented. - PowerPoint
New Joiner Security Induction Deck
in Security Awareness ProgrammeIts Framework References list this control. Supported by: Slide 12; how to run it.