ISO 27001 Annex A 6.6 Audit Checklist

The ultimate audit guide to ISO 27001 Annex A 6.6 Confidentiality or non-disclosure agreements

1. NDA Requirement Formalisation Verified

Verification Criteria: A documented policy or procedure exists that mandates the use of Confidentiality or Non-Disclosure Agreements (NDAs) for all parties accessing sensitive information.

Required Evidence: Approved Information Security Policy or a specific Legal/HR Onboarding Procedure citing mandatory NDA execution.

Pass/Fail Test: If the organisation cannot produce a formal requirement mandating NDAs for both internal personnel and external third parties, mark as Non-Compliant.

2. Signed Employee Confidentiality Agreements Confirmed

Verification Criteria: Every current employee has a signed confidentiality agreement or equivalent clause within their employment contract on file.

Required Evidence: Sample of 10 personnel files (including diverse roles) containing executed contracts or standalone NDAs.

Pass/Fail Test: If any sampled employee has active system access but lacks a signed record of confidentiality obligations, mark as Non-Compliant.

3. External Third-Party NDA Coverage Validated

Verification Criteria: All external parties (contractors, consultants, vendors) with access to the organisation’s information assets have signed NDAs prior to access being granted.

Required Evidence: Vendor management folder or procurement portal showing executed NDAs for all active high-risk suppliers.

Pass/Fail Test: If a third-party consultant has a corporate login but no record of an NDA or confidentiality clause in their Master Service Agreement (MSA), mark as Non-Compliant.

4. NDA Clause Specificity and Scope Verified

Verification Criteria: The NDAs clearly define what constitutes “Confidential Information” and state the permitted uses and duration of the obligation.

Required Evidence: Review of the standard NDA template used by the legal/procurement department.

Pass/Fail Test: If the NDA uses vague terms like “all information” without defining exclusions or specific handling requirements, mark as Non-Compliant.

5. Post-Termination Survival Clauses Confirmed

Verification Criteria: Confidentiality obligations are explicitly stated to survive the termination of employment or the end of the contractual engagement.

Required Evidence: Executed agreements containing “Survival” or “Post-Termination” clauses (e.g., obligations lasting 2-5 years or indefinitely).

Pass/Fail Test: If the NDA implies that confidentiality ends on the day the contract is terminated, mark as Non-Compliant.

6. Periodic Review of NDA Terms Evidenced

Verification Criteria: Standard NDA templates are reviewed periodically to ensure they meet current legal requirements and organisational risk profiles.

Required Evidence: Legal review logs or version history of the NDA template showing updates within the last 24 months.

Pass/Fail Test: If the organisation is using an NDA template that has not been reviewed for legal sufficiency in over three years, mark as Non-Compliant.

7. Secure Storage of Executed Agreements Verified

Verification Criteria: Signed NDAs are stored in a secure, restricted-access environment to ensure their availability for legal enforcement if required.

Required Evidence: Permissions report for the HR/Legal digital vault or physical verification of locked filing cabinets.

Pass/Fail Test: If executed NDAs are stored on a public company drive or in an unmonitored physical area, mark as Non-Compliant.

8. Flow-down Requirements for Sub-Contractors Validated

Verification Criteria: Where third parties use sub-contractors, the NDA mandates that confidentiality obligations are flowed down to those sub-contractors.

Required Evidence: Sub-contracting clauses within the standard vendor NDA or MSA.

Pass/Fail Test: If a primary vendor can share organisational data with sub-contractors without an equivalent confidentiality mandate, mark as Non-Compliant.

9. Process for Breaches of Confidentiality Confirmed

Verification Criteria: A defined process or disciplinary framework exists to address identified breaches of the confidentiality agreement.

Required Evidence: Employee Handbook or Supplier Code of Conduct detailing the consequences of unauthorised disclosure.

Pass/Fail Test: If there is no documented link between the NDA and the disciplinary/termination process, mark as Non-Compliant.

10. Return or Destruction of Data Clauses Verified

Verification Criteria: NDAs include mandatory requirements for the return or secure destruction of confidential information upon termination of the agreement.

Required Evidence: “Disposal of Information” or “Return of Assets” sections within the sampled NDAs.

Pass/Fail Test: If the agreement is silent on the fate of the data after the contract ends, mark as Non-Compliant.

About the author