Terms and conditions of employment

What the requirement asks

Employment contracts and agreements are to set out the information security responsibilities of both the individual and the organization. Purpose: make people understand, before they take a role, what it demands of them for security. Guidance: contractual obligations should be consistent with the top-level security policy and the topic policies that apply, and can also make clear: that people who will reach confidential information sign confidentiality or non-disclosure agreements before access (6.6); their legal rights and responsibilities, for example under copyright or data protection law (5.32, 5.34); their responsibilities for classifying information and managing the assets, facilities and services they handle (5.9 to 5.13); their responsibilities for information received from interested parties; and the consequences of ignoring security requirements (6.4). Security roles and responsibilities are communicated to candidates before employment, and personnel agree to security terms suited to the nature and extent of their access. The terms are reviewed when laws, regulations or policies change, and where appropriate some responsibilities continue for a set period after employment ends (6.5). A code of conduct is one way to express responsibilities for confidentiality, PII protection, ethics and proper use of assets; a supplier may sign on behalf of its individual staff; organizations without a legal entity or employees can use equivalent arrangements. In the ISMS the control is compared with the controls determined in risk treatment and recorded in the Statement of Applicability as included or excluded, with the reason and the implementation status.

What the guidance adds

Terms and conditions carry the security duties. The guidance asks for the clause, the acknowledgement, the review and the route when the terms change.

What good looks like

Put the control in the Statement of Applicability with an owner, a status and the risk it treats. Then keep standard employment contract and contractor agreement templates with information security clauses reflecting the policies and one live sample together.

Evidence an assessor asks for

• Employment termsStandard employment contract and contractor agreement templates with information security clauses reflecting the policies
• Employment termsSigned agreements for a sample of personnel, including confidentiality undertakings signed before access
• Employment termsPre-employment communication of security roles and responsibilities to candidates
• Employment termsRecords showing terms were reviewed after changes in law, regulation or policy
• Employment termsClauses stating responsibilities that survive termination and for how long
• Employment termsA code of conduct covering confidentiality, PII, ethics and acceptable use, with acknowledgement records

The question an assessor will ask

An assessor will ask for standard employment contract and contractor agreement templates with information security clauses reflecting the policies, then trace it to the system it protects. For A.6.2 the test is whether that record ties to a live sample, not whether the control is named in a policy.

Common gaps

• Contracts contain a generic confidentiality clause but nothing about classification, handling or consequences
• Terms were never updated after policy or legal changes
• Contractor agreements lack the security terms employees sign
• Post-employment obligations are not defined, so they are unenforceable

Before the next audit

Before the next audit, check one live sample for this gap: contracts contain a generic confidentiality clause but nothing about classification, handling or consequences.