Control A.6.6Confidentiality or non-disclosure agreements
Confidentiality or non-disclosure agreements reflecting the organisation’s needs for the protection of information must be identified, documented, regularly reviewed and signed by personnel and other relevant interested parties.
The control asks for more than a signature on file. The agreements must reflect the organisation’s actual needs — which information, for how long, with what exceptions — and be regularly reviewed, because needs change and an agreement drafted for a different business may not cover what the organisation now holds.
The scope is personnel and other relevant interested parties: contractors, suppliers, partners, prospective acquirers during due diligence, and anyone else who will see information they have no independent right to.
Two practical points. Duration matters and is frequently left indefinite where a defined period would be enforceable; and an agreement that purports to prohibit protected disclosures is not only unenforceable in that respect but reads badly in front of a regulator. The register of who has signed what is the part that is hardest to keep current.
How to put this in place
You will share confidential information with suppliers, customers and staff, and an ISMS project needs agreements in place before that happens. Information shared first and papered later cannot be protected afterwards.
- Decide which situations need an agreement and who can sign.
- Prepare standard templates with a defined end, a return or destruction clause and clear permitted use.
- Have Legal approve them and keep a register of who has signed.
- Require signature before confidential information is shared.
- Review the templates and the register at least yearly.
Evidence an auditor usually looks for: approved templates, the register of agreements, and signed copies for a sample of third parties with access to confidential information.
What is in the packs for this
From ISO 27001 Implementation & Certification Readiness. Each one helps with this requirement.
Annex A Control Implementation LibraryExcel
Its row in the Control Library: what it is for, practical steps, what an auditor samples, the usual owner, common mistakes and whether it usually applies.
Statement of Applicability TemplateExcel
Has its own row on the Statement of Applicability sheet, where you record whether it applies, why and how far it is implemented.
Mandatory ISMS Documentation ChecklistExcel
Annex A Documents sheet: lists signed confidentiality or non-disclosure agreements among the documents auditors commonly expect for this control.