ISO 27001 Annex A 6.6 Confidentiality and non-disclosure agreements
What it says
Confidentiality or non-disclosure agreements reflecting the organization's needs for the protection of information shall be identified, documented, regularly reviewed and signed by personnel and other relevant interested parties.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure all relevant parties sign agreements to protect confidential information.
This control makes sure that anyone who has access to confidential information, like employees or partners, signs an agreement to keep that information secret. It's important because without these agreements, sensitive information could be shared, leading to competitive harm or legal trouble.
Free. Save your status, tasks and notes.
Why it matters
Without confidentiality/NDAs, staff and third parties may disclose sensitive information, causing legal action, competitive harm and loss of customer trust.
How to implement
HR department should draft confidentiality agreements for all employees.
Use a simple format that defines what is considered confidential and explains the employee's responsibilities regarding this information. Regularly update these agreements in line with changes in company policy and legislation like the Privacy Act 1988.
Legal team should review and approve all non-disclosure agreements (NDAs) used with external parties.
Ensure these NDAs include key elements such as the definition of confidential information and the duration of confidentiality. Align this process with ISO 27002:2022 guidance to ensure comprehensive coverage.
IT manager should ensure that any type of information classified as confidential is adequately protected with appropriate access controls.
This includes using strong passwords and access limits to sensitive areas on your network, aligning with ASD Essential Eight strategies.
Board members should ensure that reviewing and signing NDAs is a standard procedure before sharing any sensitive information with third parties.
Establish clear guidelines on situations that require such agreements to ensure wide organisational compliance.
The compliance officer should organise regular training sessions for all staff on the importance of confidentiality.
These sessions should cover the legal and organisational requirements for protecting confidential information, which are aligned to CPS 234 obligations.
Keep it running
Maintain a register of required confidentiality/NDAs, ensure onboarding/contracting includes signature capture, and review clauses at least annually for legal and business changes.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
A sample of signed confidentiality agreements.
Look at
The presence of all required elements such as definition of confidential information and termination conditions.
Good evidence
Complete agreements containing all essential elements as per ISO 27002:2022 guidelines.
- Check 2 of 5What an auditor asks for
Ask for
Records of NDA reviews by the legal department.
Look at
The frequency and depth of these reviews. GOOD involves regular reviews occurring at least annually, with updates reflecting current legal and business requirements.
- Check 3 of 5What an auditor asks for
Ask for
Documentation on employee training about confidentiality.
Look at
Attendance records and training content. GOOD would show that all relevant personnel attended training sessions that covered organisational policy and legal requirements.
- Check 4 of 5What an auditor asks for
Ask for
A list of third-party NDAs.
Look at
Whether agreements are current and align with business relationships. GOOD NDAs are up to date, with clear definitions of responsibility and signed by authorised representatives.
- Check 5 of 5What an auditor asks for
Ask for
Policies on handling confidential information.
Look at
How policies ensure NDAs are signed before information is shared. GOOD policies clearly outline processes to gain signed agreements before any information is disclosed.
Mappings
Closest match in ASD Information Security Manual: ISM-0072, Document security requirements in contractual arrangements, which partially overlaps with this control.
ASD Information Security Manual: 1 mapping
This control partially overlaps ISM-0072.
Annex A 6.6 requires the organisation to identify, document, regularly review and obtain signed confidentiality or non-disclosure agreements (NDAs) from personnel and other relevant interested parties. This overlaps with ISM-0072 because both controls require security expectations to be captured in formal contractual instruments and kept current through regular review. Specifically, confidentiality obligations are a common contractual requirement in service provider agreements. ISM-0072 is limited to service provider contractual arrangements and extends beyond confidentiality to include integrity and availability requirements, while Annex A 6.6 is focused on NDAs/confidentiality agreements across a broader set of parties.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.
Get help with this control
ISO 27001 training
Mindset Cyber runs PECB-accredited ISO/IEC 27001 training that maps directly to the controls in this library.