Auditing ISO 27001 Annex A 6.6 Confidentiality or Non-Disclosure Agreements is the systematic verification of legal and operational controls protecting proprietary information. The Primary Implementation Requirement involves executing enforceable agreements with all parties, providing the Business Benefit of robust intellectual property protection and legal recourse against unauthorized disclosures.
ISO 27001 Annex A 6.6 Confidentiality or Non-Disclosure Agreements Audit Checklist
This technical verification tool is designed for lead auditors to establish the legal and operational enforceability of confidentiality obligations. Use this checklist to validate compliance with ISO 27001 Annex A 6.6.
1. NDA Requirement Formalisation Verified
Verification Criteria: A documented policy or procedure exists that mandates the use of Confidentiality or Non-Disclosure Agreements (NDAs) for all parties accessing sensitive information.
Required Evidence: Approved Information Security Policy or a specific Legal/HR Onboarding Procedure citing mandatory NDA execution.
Pass/Fail Test: If the organisation cannot produce a formal requirement mandating NDAs for both internal personnel and external third parties, mark as Non-Compliant.
2. Signed Employee Confidentiality Agreements Confirmed
Verification Criteria: Every current employee has a signed confidentiality agreement or equivalent clause within their employment contract on file.
Required Evidence: Sample of 10 personnel files (including diverse roles) containing executed contracts or standalone NDAs.
Pass/Fail Test: If any sampled employee has active system access but lacks a signed record of confidentiality obligations, mark as Non-Compliant.
3. External Third-Party NDA Coverage Validated
Verification Criteria: All external parties (contractors, consultants, vendors) with access to the organisation’s information assets have signed NDAs prior to access being granted.
Required Evidence: Vendor management folder or procurement portal showing executed NDAs for all active high-risk suppliers.
Pass/Fail Test: If a third-party consultant has a corporate login but no record of an NDA or confidentiality clause in their Master Service Agreement (MSA), mark as Non-Compliant.
4. NDA Clause Specificity and Scope Verified
Verification Criteria: The NDAs clearly define what constitutes “Confidential Information” and state the permitted uses and duration of the obligation.
Required Evidence: Review of the standard NDA template used by the legal/procurement department.
Pass/Fail Test: If the NDA uses vague terms like “all information” without defining exclusions or specific handling requirements, mark as Non-Compliant.
5. Post-Termination Survival Clauses Confirmed
Verification Criteria: Confidentiality obligations are explicitly stated to survive the termination of employment or the end of the contractual engagement.
Required Evidence: Executed agreements containing “Survival” or “Post-Termination” clauses (e.g., obligations lasting 2-5 years or indefinitely).
Pass/Fail Test: If the NDA implies that confidentiality ends on the day the contract is terminated, mark as Non-Compliant.
6. Periodic Review of NDA Terms Evidenced
Verification Criteria: Standard NDA templates are reviewed periodically to ensure they meet current legal requirements and organisational risk profiles.
Required Evidence: Legal review logs or version history of the NDA template showing updates within the last 24 months.
Pass/Fail Test: If the organisation is using an NDA template that has not been reviewed for legal sufficiency in over three years, mark as Non-Compliant.
7. Secure Storage of Executed Agreements Verified
Verification Criteria: Signed NDAs are stored in a secure, restricted-access environment to ensure their availability for legal enforcement if required.
Required Evidence: Permissions report for the HR/Legal digital vault or physical verification of locked filing cabinets.
Pass/Fail Test: If executed NDAs are stored on a public company drive or in an unmonitored physical area, mark as Non-Compliant.
8. Flow-down Requirements for Sub-Contractors Validated
Verification Criteria: Where third parties use sub-contractors, the NDA mandates that confidentiality obligations are flowed down to those sub-contractors.
Required Evidence: Sub-contracting clauses within the standard vendor NDA or MSA.
Pass/Fail Test: If a primary vendor can share organisational data with sub-contractors without an equivalent confidentiality mandate, mark as Non-Compliant.
9. Process for Breaches of Confidentiality Confirmed
Verification Criteria: A defined process or disciplinary framework exists to address identified breaches of the confidentiality agreement.
Required Evidence: Employee Handbook or Supplier Code of Conduct detailing the consequences of unauthorised disclosure.
Pass/Fail Test: If there is no documented link between the NDA and the disciplinary/termination process, mark as Non-Compliant.
10. Return or Destruction of Data Clauses Verified
Verification Criteria: NDAs include mandatory requirements for the return or secure destruction of confidential information upon termination of the agreement.
Required Evidence: “Disposal of Information” or “Return of Assets” sections within the sampled NDAs.
Pass/Fail Test: If the agreement is silent on the fate of the data after the contract ends, mark as Non-Compliant.
| Control Requirement | The ‘Checkbox Compliance’ Trap | The Reality Check |
|---|---|---|
| Execution Records | The tool marks “NDA” as compliant because a file exists in the user’s profile. | Verify the signature. GRC tools often accept blank or unexecuted templates as “evidence” of a signed agreement. |
| Survival Obligations | SaaS tool verifies that an NDA was “Signed” during onboarding. | Check the clause. If the agreement doesn’t survive the exit date, it’s useless for post-employment data protection. |
| Third-Party Scope | Tool assumes all “Vendors” in the DB have an NDA. | Verify “Non-Standard” vendors. Delivery drivers or temporary facilities staff often bypass GRC portals but hold keys/access. |
| Legal Validity | Platform identifies a “Confidentiality Policy” document. | A policy is not a contract. Auditors must see legally binding agreements, not just a set of “Management Intent” slides. |
| Version Control | Tool tracks that “User A” read the latest policy update. | Check the original contract. Policy updates often do not legally modify the original terms of employment without a formal amendment. |
| Sub-Contractor Flow-down | Tool checks for the presence of a “Sub-processor” list. | Verify the Legal Mandate. Does the vendor’s contract actually forbid sharing with sub-processors who haven’t signed an NDA? |
| Accessibility | SaaS tool records that the “CISO” has access to NDAs. | Test the Searchability. If Legal takes 48 hours to find an NDA during an active breach investigation, the control is failing. |
About the author
