Confidentiality or Non-Disclosure Agreements - ISO 27001 Annex A Control
ISO 27001 Annex A 6.6
Where confidentiality matters, the agreement makes the obligation explicit and enforceable.
ISO 27001 Annex A 6.6 - Confidentiality or Non-Disclosure Agreements
Confidentiality agreements give the organisation a documented and enforceable position when sensitive information is shared with someone whose obligation might otherwise be unclear. Employees usually have confidentiality clauses in their main contracts, but contractors, consultants, business partners, third parties evaluating products or services, and other ad-hoc relationships often need a specific agreement to establish the position.
The agreement should be tailored to the situation. A standard NDA template covers most low-risk situations - a contractor receiving routine commercial information, for example. Higher-risk situations may need bespoke agreements - sharing source code, customer data or specific intellectual property typically warrants more specific terms covering the exact information, the permitted uses, the duration of obligations and the consequences of breach.
The control also asks for regular review. Old NDAs may reference outdated business arrangements, missing parties or information categories that no longer match the organisation's needs. Where standard templates are used, those templates should be reviewed periodically and aligned with current legal advice and business practice.
The audit question is whether the right confidentiality agreement is in place for each significant relationship. I will sample a range of third parties handling sensitive information and check that an appropriate agreement covers each. Gaps - relationships where sensitive information is shared without a documented confidentiality basis - are findings.
Practical Compliance Guidance
Confidentiality and non-disclosure arrangements are described in the IMS1 Manual in Section 8.2 on Information Security Arrangements. The F-HR15 Employment Letter and Contract can be used as this includes a confidentiality agreement.
| alphaZ document | How to use it |
|---|---|
| ISO 27001 Toolkit | The full alphaZ ISO 27001 toolkit including the IMS1 Manual, policies, procedures, registers and audit checklists. |
| F-HR15 Employment Letter and Contract | This is two separate HR file templates for providing a prospective employee with an offer of employment (F-HR15A) and a simple employment contract (F-HR15B). Includes a confidentiality agreement. |
Note - all the above files can be downloaded with an alphaZ subscription.
