ISO 27001 Annex A 6.2 Terms and conditions of employment for security
What it says
The employment contractual agreements shall state the personnel's and the organization's responsibilities for information security.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure job agreements state everyone's info security duties clearly.
This control is about making sure everyone's job agreements, like contracts, clearly explain what they need to do to protect the organisation's information. It's important because if people don't understand their responsibilities, they might accidentally jeopardise sensitive data or cause a security breach.
Free. Save your status, tasks and notes.
Why it matters
If employment agreements omit information security duties, personnel may mishandle data, causing breaches, compliance failures and loss of trust.
How to implement
The HR manager should ensure that all new job contracts include sections on information security responsibilities.
This can be done by adding clauses that specify the employee's duties to keep information safe according to the organisation's policies and relevant legal requirements.
The IT manager should collaborate with HR to review and update information security policies referenced in employment agreements.
This involves aligning the contracts with the organisation's information security policy and ensuring these are reviewed whenever there are changes in laws or regulations.
HR should organise training for new hires so they understand their information security duties from day one.
This involves explaining what's in the contract about data protection and perhaps providing a simple guide or code of conduct on how to manage confidential information.
The leadership team should make sure there's a process for regularly reviewing employment terms related to information security.
When laws or company policies change, HR needs to update the relevant sections in the employment agreements to ensure compliance.
Legal advisors should assist in drafting and reviewing confidentiality agreements and other legal responsibilities linked with employment contracts.
This involves ensuring these documents are clear on what actions are considered a breach of security requirements and what the consequences are.
Keep it running
Review and update employment contracts at onboarding and periodically to include clear information security responsibilities, confidentiality and reporting duties.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Ask for recent employment contract templates.
Look at
Check if the contracts have clear clauses on information security responsibilities.
Good evidence
Contracts explicitly outline responsibilities for protecting data, aligning with the organisation's security policies.
- Check 2 of 5What an auditor asks for
Ask for
Request records of information security training provided to employees.
Look at
Verify the training content covers the security duties as per the employment contracts.
Good evidence
Training records show that employees received clear instructions about their security responsibilities promptly after hiring.
- Check 3 of 5What an auditor asks for
Ask for
Ask for evidence of a procedure for reviewing contracts when legal changes occur.
Look at
Look for a documented process or policy explaining how and when updates are made to employment terms.
Good evidence
There is a documented procedure that is followed regularly to update employment contracts in response to legal and regulatory changes.
- Check 4 of 5What an auditor asks for
Ask for
Request examples of confidentiality or non-disclosure agreements signed by employees.
Look at
Ensure these agreements are comprehensive and signed before access is granted to sensitive information.
Good evidence
Documents confirm that all individuals with access to sensitive data have signed up-to-date confidentiality agreements.
- Check 5 of 5What an auditor asks for
Ask for
Ask for records of any security incidents involving breaches of employment terms.
Look at
Check how the organisation responded and any updates made to employment contracts afterward.
Good evidence
Security incidents are followed up with a review of employment contracts, and necessary updates are made promptly.
Mappings
Closest match in ASD Information Security Manual: ISM-2035, Document security roles for software development, which partially overlaps with this control.
ASD Information Security Manual: 2 mappings
This control partially overlaps ISM-2035.
Annex A 6.2 requires that employment contractual agreements state personnel and organisational responsibilities for information security. ISM-2035 relates by requiring identification and documentation of security roles, responsibilities, and knowledge requirements for the software development life cycle, which are responsibilities that may need to be reflected in role descriptions and employment terms for relevant staff. ISM-2035 is limited to SDLC-related roles and competence requirements, while Annex A 6.2 applies broadly and is specifically about contractual agreements.
This control partially overlaps ISM-2036.
Annex A 6.2 requires employment contractual agreements to explicitly state information security responsibilities of personnel and the organisation. ISM-2036 overlaps by requiring that security responsibilities for software developers are identified and documented, which are responsibilities that should be incorporated into developer role descriptions and employment conditions where applicable. ISM-2036 is narrower (developer-specific and documentation-focused), whereas Annex A 6.2 is broader and specifically concerned with contractual articulation across personnel categories.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.
Get help with this control
ISO 27001 training
Mindset Cyber runs PECB-accredited ISO/IEC 27001 training that maps directly to the controls in this library.
Need this as a written policy?
PolicyMint drafts the ISO 27001 documentation this control expects, customised to your business and checked by three independent verifiers before you see it. Not a boilerplate template you have to fight into shape. First document free.
Draft your ISO 27001 documentation