Confidentiality or non-disclosure agreements

What the requirement asks

Confidentiality or non-disclosure agreements that match the organization's information protection needs are to be identified, written, reviewed regularly and signed by staff and by the outside parties concerned. Purpose: keep information that staff or outside parties can reach confidential. Guidance: agreements protect confidential information through legally enforceable terms and apply both to personnel and to interested parties. Their terms follow from the organization's security requirements, considering the kind of information handled, its classification, how it will be used and what access the other party is allowed. Elements to consider are: what information is protected; how long the agreement lasts, including cases where confidentiality must hold indefinitely or until the information becomes public; what must happen when it ends; signatories' duties and actions to prevent unauthorized disclosure; who owns the information, any trade secrets and any intellectual property, and what that means for keeping it confidential; permitted uses and the signatory's rights of use; a right to audit and monitor activity involving confidential information in highly sensitive cases; how unauthorized disclosure or leakage is notified and reported; return or destruction of information at the end; and the consequences of breaching the agreement. Enforceability in the applicable jurisdiction is considered (5.31 to 5.34), and requirements are reviewed periodically and whenever circumstances affecting them change. Other information: such agreements both protect the organization's information and remind signatories of their duty to handle it responsibly and only as authorized. In the ISMS the control is compared with the controls determined in risk treatment and recorded in the Statement of Applicability as included or excluded, with the reason and the implementation status.

What the guidance adds

Confidentiality agreements are expected to match the information the person will see. The guidance asks for the template, the signed copy, the duration and the return or destruction duty.

What good looks like

Put the control in the Statement of Applicability with an owner, a status and the risk it treats. Then keep approved NDA and confidentiality agreement templates covering definition of protected information, duration, termination actions, ownership, permitted use, audit rights, breach notification, return or destruction and non-compliance consequences and one live sample together.

Evidence an assessor asks for

• Confidentiality agreementsApproved NDA and confidentiality agreement templates covering definition of protected information, duration, termination actions, ownership, permitted use, audit rights, breach notification, return or destruction and non-compliance consequences
• Confidentiality agreementsSigned agreements for personnel and for relevant external parties, dated before access was granted
• Confidentiality agreementsA register of agreements in force with their parties and expiry or survival terms
• Confidentiality agreementsLegal review confirming enforceability in the relevant jurisdictions
• Confidentiality agreementsRecords of periodic review of agreement requirements and updates after relevant changes

The question an assessor will ask

An assessor will ask for approved NDA and confidentiality agreement templates covering definition of protected information, duration, termination actions, ownership, permitted use, audit rights, breach notification, return or destruction and non-compliance consequences, then trace it to the system it protects. For A.6.6 the test is whether that record ties to a live sample, not whether the control is named in a policy.

Common gaps

• NDAs are signed after access has already been given
• Templates are outdated and omit return or destruction of information at termination
• No register exists, so the organization cannot tell who is bound by what
• Agreements with suppliers or consultants are missing because procurement uses its own contract templates

Before the next audit

Before the next audit, check one live sample for this gap: ndas are signed after access has already been given.