Table of contents
ISO 27001 Terms and Conditions of Employment
ISO 27001 Annex A 6.2 Terms and Conditions Of Employment is an ISO 27001 control that requires an organisation to have contracts in place with employees that set out their responsibilities for information security.
Terms of Employment are the conditions and agreements that define the relationship between an employer and an employee. These terms typically outline the rights and responsibilities of both parties.
Purpose
The purpose of ISO 27001 Annex A 6.2 is to ensure that employees are fully aware of their information security responsibilities in relation to their role.
Definition
ISO 27001 defines ISO 27001 Terms and Conditions of Employment as:
The employment contractual agreements should state the personnel’s and the organisations responsibilities for information security.
ISO 27001:2022 Annex A 6.2 Terms and Conditions Of Employment
Watch the Tutorial
In the video ISO 27001 Terms and Conditions of Employment Explained – ISO27001:2022 Annex A 6.2 I show you how to implement it and how to pass the audit.
Implementation Guide
General Guidance
You are going to have to
- engage with a legal professional for professional advice
- engage with a HR professional for professional advice
- put in place contracts that include the personnel and the organisations responsibilities for information security
- ensure you have contractual agreements with all personnel that are legally binding
- ensure you adhere to all applicable laws and regulations
ISO 27001 Policies
The contract should consider your ISO 27001 policies. That is the main information security policy and any ISO 27001 topic specific policies. Policies are statements of what you do for information security and what is expected of people.
What to include in the employment contract
The following can be considered:
- NDA, non disclosure agreements
- confidentiality agreements
- legal rights
The following are guidance and I am not really sure they sit well in contractual agreements but to be aware that the standard has them as guidance
- Classification of information
- management of information
- management of assets
- information processing facilities
- information services
- handling information you get from third parties and interested parties
- what actions will be taken if you don’t follow the information security requirements
Communication
You will communicate roles and responsibilities for information security during the pre employment phase of your process.
Agreement
Information security requirements should be agreed which usually is the case of the employee signing the contract and you having a copy of the contract on file.
Appropriateness of terms
You want to make sure that any terms and requirements are appropriate to the person, their role, what they do and the access they have.
Review of terms
As a process of continual improvement be sure to review the terms you have, especially if you change your policies or the laws, or regulations change.
Non Disclosure Agreement ISO 27001
There are certain things that will remain in place after employment and this is usually defined for a set period of time. Consider things like an ISO 27001 non disclosure agreement and confidentiality agreement that you may want in place for 12 months post employment ending.
Employee hand book /code of conduct
Having an employee hand book or code of conduct is a fantastic way to share and communicate information security responsibilities and key messages and I have seen this work well in many organisations.
Employees that come from agency / third party
If you have employees that you do not employ directly but rather you use and agency of third party then the agency of third party should really enter into a contract on behalf of those people.
Implementation Checklist
1. Develop a Standardised Employment Contract Template
Challenges
- Ensuring the template covers all necessary information security requirements.
- Keeping the template updated with legal and regulatory changes.
Solutions
- Involve legal and HR professionals in the development process.
- Regularly review and update the template based on legal and regulatory changes.
2. Include Clear Information Security Clauses
Challenges
- Communicating complex security concepts in an understandable manner.
- Ensuring all employees understand and agree to their information security obligations.
Solutions
- Use clear and concise language.
- Provide employee training and awareness sessions on information security policies and procedures.
- Obtain signed acknowledgments from employees confirming their understanding of their obligations.
3. Address Confidentiality Obligations
Challenges
- Defining and classifying confidential information.
- Ensuring employees understand the consequences of breaching confidentiality.
Solutions
- Develop a clear ISO 27001 data classification policy.
- Include specific clauses regarding confidentiality and non-disclosure agreements (NDAs).
- Implement appropriate disciplinary measures for confidentiality breaches.
4. Outline Acceptable Use of Company Resources
Challenges
- Defining acceptable use of company devices, systems, and networks.
- Monitoring employee activity without violating privacy rights.
Solutions
- Develop and communicate a clear ISO 27001 acceptable use policy (AUP).
- Implement appropriate monitoring and logging controls.
- Provide regular training on the AUP and its implications.
5. Define Employee Responsibilities for Data Protection
Challenges
- Ensuring employees understand their role in protecting personal data.
- Implementing effective data protection controls across all departments.
Solutions
- Provide data protection training to all employees.
- Implement data protection policies and procedures, such as data minimisation and appropriate data handling practices.
- Assign data protection roles and responsibilities to specific individuals or teams.
6. Address Remote Work Considerations
Challenges
- Ensuring the security of remote work environments.
- Managing the use of personal devices for work purposes.
Solutions
- Develop and implement an ISO 27001 remote work policy that addresses security risks.
- Provide employees with secure remote access solutions.
- Implement appropriate security measures for personal devices used for work.
7. Incorporate Data Breach Notification Procedures
Challenges
- Ensuring employees know how to report suspected data breaches.
- Implementing a timely and effective incident response process.
Solutions
- Establish clear reporting procedures for suspected data breaches.
- Provide training to employees on how to recognise and report suspicious activity.
- Implement an incident response plan to effectively handle data breaches.
8. Review and Update Employment Contracts Regularly
Challenges
- Keeping track of changes in legislation and industry best practices.
- Ensuring all employees have the latest version of the employment contract.
Solutions
- Conduct regular reviews of employment contracts to ensure compliance with legal and regulatory requirements.
- Communicate any changes to employees in a timely manner.
9. Obtain Employee Acknowledgement
Challenges
- Ensuring employees understand and agree to the terms and conditions of their employment.
- Tracking employee acknowledgments of contract terms.
Solutions
- Require employees to sign an acknowledgment form confirming their understanding of the employment contract.
- Maintain records of all employee acknowledgments.
10. Conduct Internal Audits and Reviews
Challenges:
- Ensuring compliance with employment contract terms and information security policies.
- Identifying and addressing any gaps in the implementation of controls.
Solutions:
- Conduct regular internal audits to assess compliance with employment contract terms.
- Review and analyse audit findings to identify areas for improvement.
- Implement corrective and preventive actions to address any identified issues.
Audit Checklist
How to audit ISO 27001 Annex A 6.2 Terms and Conditions Of Employment
1. Review Employment Contracts
- Focus on Confidentiality Clauses: Ensure they explicitly state employee obligations to protect confidential information (customer data, intellectual property, trade secrets).
- Check for Data Protection Clauses: Verify the contract addresses employee responsibilities for handling personal data, including compliance with relevant data protection regulations (e.g., GDPR).
- Examine Non-Disclosure Agreements (NDAs): Determine if appropriate NDAs are in place for employees accessing highly sensitive information.
2. Assess Employee Handbooks
- Look for Information Security Policies: Verify the handbook includes policies on data security, acceptable use of IT resources, and social media usage.
- Check for Data Breach Reporting Procedures: Ensure employees are aware of the procedures for reporting suspected or actual data breaches.
- Review Disciplinary Procedures: Confirm the handbook outlines consequences for violating information security policies.
3. Verify Background Checks and Screening
- Evaluate the thoroughness of background checks: Determine if appropriate checks (e.g., criminal records, credit checks, reference checks) are conducted for relevant roles.
- Assess the screening process: Ensure the process is fair, consistent, and aligned with relevant laws and regulations.
4. Examine Employee Training
- Review training records: Ensure employees receive mandatory training on information security awareness, data protection, and their specific roles and responsibilities.
- Assess training effectiveness: Determine if training is engaging, relevant, and effectively communicated to employees.
- Check for ongoing training: Verify that employees receive regular refresher training to maintain awareness and knowledge.
5. Investigate Data Access Control
- Review access controls: Ensure employees only have access to the data they need to perform their job duties.
- Assess the “need-to-know” principle: Determine if the principle is applied consistently when granting access to sensitive data.
- Review access reviews: Confirm that access rights are regularly reviewed and updated to reflect current job roles and responsibilities.
6. Evaluate Remote Work Practices
- Assess security measures for remote work: Determine if appropriate security measures are in place for employees working from home, such as secure remote access, VPNs, and encrypted devices.
- Review policies for home office security: Verify that employees are aware of and comply with security requirements for working from home.
7. Investigate BYOD Policies
- Review Bring Your Own Device (BYOD) policies: Determine if clear policies are in place for employees using personal devices for work purposes.
- Assess security measures for BYOD devices: Ensure appropriate security measures are in place for BYOD devices, such as mobile device management (MDM) software and encryption.
8. Interview Key Personnel
- Interview HR personnel: Gather information on recruitment, onboarding, training, and disciplinary procedures.
- Interview IT personnel: Understand how access controls are managed, how remote work is supported, and how BYOD devices are secured.
- Interview employees: Obtain employee feedback on information security awareness, training, and their overall understanding of their responsibilities.
9. Review Incident Response Procedures
- Assess employee involvement in incident response: Determine if employees are aware of their roles and responsibilities in the event of a data breach or other security incident.
- Review employee training on incident response: Ensure employees receive training on how to identify, report, and respond to security incidents.
10. Document Audit Findings
- Record all audit findings: Document any non-conformances, observations, and recommendations for improvement.
- Prepare an audit report: Summarise the audit findings and provide recommendations for corrective and preventive actions.
How to pass the audit
To comply with ISO 27001 Annex A 6.2 you are going to implement the ‘how’ to the ‘what’ the control is expecting. In short measure you are going to:
- Write, sign off, implement and communicate your topic specific information security policies
- Write, sign off, implement and communicate your contract of employment template under the guidance and advice of a HR professional and a legal professional
- Implement your contract of employment with personnel
- Implement your communication plan to communicate to relevant and interested parties
- Ensure that the contract of employment meets all laws as well as local laws and regulations
- Implement a process of internal audit that checks that the appropriate controls are in place and effective and where they are not follow the continual improvement process to address the risks
To pass an audit of ISO 27001 Annex A 6.2 you are going to make sure that you have followed the steps above in how to comply.
What the auditor will check
The audit is going to check a number of areas for compliance with Annex A 6.2. Lets go through them
1. That you have a documented contract of employment
The auditor will meet with the HR team and look for a documented contract of employment template. They will then seek evidence that the contract of employment is in place by reviewing a sample of employees. They will be checking that the terms of this clause have been met.
2. That you have communicated the terms of employment
The process needs to be communicated to relevant and interested parties. The audit will check that the training and awareness plan and the communication plan and look for past evidence that this has happened.
3. That people are aware of their responsibilities
The audit is going to check for documented processes, documented topic specific policy and these have been communicated and people have been trained on what is required of them. It will check if people have a contract with terms and they understand and accept them.
Common Mistakes
In my experience, the top 3 mistakes people make for ISO 27001 Terms and Conditions of Employment are
1. You have no evidence that anything actually happened
You need to keep records and minutes of everything. You need a paper trail to show it was done. Make sure you have updated contracts for all employees and personnel and that they meet the requirements of this control. In smaller organisations and start ups it is often the case that this is not in place.
2. One or more members of your team haven’t done what they should have done
Prior to the audit check that all members of the team have done what they should have. Do they know where the process documents are in relation to the employment process? Has everyone got a contract and received and accepted terms of employment? Do a pre audit as close to the audit as you can that checks the contract and terms of employment process and the HR team that will be involved. Assuming they are doing the right thing is a recipe for disaster. Check!
3. Your document and version control is wrong
Keeping your document version control up to date, making sure that version numbers match where used, having a review evidenced in the last 12 months, having documents that have no comments in are all good practices.
FAQ
Other than your ISO 27001 certification requiring it, the following are the top 5 benefits of ISO 27001 Annex A 6.2 Terms of Employment:
You cannot get ISO 27001 certification without it.
Improved security: You will have an effective information security implementation that is based on people who contracts in place and those contracts cover information security requirements
Reduced risk: You will reduce the information security risks by having legally binding contracts in place with employees that set out the consequences of not meeting information security requirements and being able to enforce them
Improved compliance: Standards and regulations require you to have terms of employment in place
Reputation Protection: In the event of a breach having a terms of employment procedure in place will reduce the potential for fines and reduce the PR impact of an event
Terms of employment are important because they protect both the employer and the employee. They set out the expectations of both parties and help to avoid misunderstandings and conflict.
For employers, terms of employment can help to ensure that they are getting the best possible value from their employees. They can also help to protect the employer from legal liability if an employee breaches the terms of their contract.
For employees, terms of employment can help to protect their rights and ensure that they are treated fairly. They can also help to ensure that the employee is aware of their responsibilities and obligations to their employer.
HR is responsible for screening employees. Under the guidance of legal counsel they are best placed to follow best practice and meet the requirements of the law.
Yes. You will need the help of a HR professional and a legal professional.
To implement this should take no more than an hour of your time. HR professionals utilise HR templates and follow standard practices. This should be outsourced to a HR professional.
Yes, if your organisation employees more than 1 person then you need to meet the requirements of this control and legally binding terms and conditions of employment in place.
Related ISO 27001 Controls
ISO 27001 Communication: Clause 7.4
ISO 27001 Responsibilities After Termination Or Change Of Employment: Annex A 6.5
ISO 27001 Policies for Information Security: Annex A 5.1
Further Reading
The complete guide to ISO/IEC 27002:2022
ISO 27001 Controls and Attribute values
| Control type | Information security properties | Cybersecurity concepts | Operational capabilities | Security domains |
| Preventive | Availability Confidentiality Integrity | Protect | Human resource security | Governance and ecosystem |
