A Confidentiality or Non-Disclosure Agreement (NDA) is a legal contract that prohibits a person or entity from disclosing confidential information to others. This type of agreement is often used in business, employment, and other situations where sensitive or confidential information needs to be shared. In ISO 27001 this is known as ISO27001:2022 Annex A 6.6 Confidentiality Or Non-Disclosure Agreements. It is one of the 93 ISO 27001 Annex A controls.
The requirement is that confidentiality or non-disclosure agreements reflecting the organisation’s needs for the protection of information should be identified, documented, regularly reviewed and signed by personnel and other relevant interested parties.
ISO 27001 Annex A 6.6 Confidentiality or Non-Disclosure Agreements is an ISO 27001 Annex A control that wants you to ensure that you have non disclosure agreements or confidentiality in contracts. It wants this to be documented, signed, communicated and enforced. Which usually means having a relevant clause in your contracts.
Key Takeaways
- You will need the support of a legal professional
- You may need the support of a HR professional
Table of contents
- Key Takeaways
- Watch the Tutorial
- Benefits of implementing Confidentiality Or Non-Disclosure Agreements
- How to implement ISO 27001 Confidentiality Or Non-Disclosure Agreements
- How to pass the audit
- What the auditor will check
- Top 3 Mistakes People Make
- ISO 27001 Confidentiality Or Non-Disclosure Agreements FAQ
- Related ISO 27001 Controls
- External Links
- ISO 27001 Annex A 6.6 Attributes Table
Watch the Tutorial
In the video ISO 27001 Confidentiality or Non Disclosure Agreements Explained – ISO27001:2022 Annex A 6.6 I show you how to implement it and how to pass the audit.
Benefits of implementing Confidentiality Or Non-Disclosure Agreements
The main benefit is that is allows you to protect confidential information, bound by a legally enforceable framework. The benefits of implementing confidentiality and non disclosure agreements include:
- Reducing the risk of data breaches by ensuring and effective legal framework is in place
- Reduced cost of incidents by catching and managing events early and assigned responsibility and accountability
- Mitigating legal liability by having an agreed and enforceable legal framework in place
- You cannot get ISO 27001 certification without it
- Protection of confidential information
- Building trust with employees and third parties
- Reputation Protection
- Intellectual Property Protection
- Mitigating legal liability
How to implement ISO 27001 Confidentiality Or Non-Disclosure Agreements
You are going to have to ensure that:
- you have engaged a legal professional
- your contracts include confidentiality of information using terms that are legally enforceable
- information that requires protecting has been identified
- information has been classified
- Non-disclosure agreements or contracts are signed and in place where required
How to determine what terms you need to include
First, the advice is to consult a legal professional. For general guidance when deciding terms consider:
- What information will be accessed
- What classification is the information
- What will the information be used for
How to identify the requirements you need to include
When deciding on the requirements to include in the non disclosure agreement or confidentiality clause:
- A definition of what confidential information is
- How long the agreement will last for
- What will happen when the agreement ends
- What are the responsibilities of all signing the agreement
- Who owns what information, intellectual property, trade secrets
- What is the permitted use of confidential information
- A right to audit
- How to inform each other of a breach
- What to do if people don’t stick to the agreements
- What laws apply
The key steps in drafting a confidentiality or non-disclosure agreement
The steps involved in drafting a confidentiality agreement include:
- Identifying the information that needs to be protected
- Determining the scope of the agreement
- Defining the terms of the agreement
- Reviewing and negotiating the agreement
- Obtaining signatures on the agreement
Key terms that should be included in a confidentiality or non-disclosure agreement
The key terms that should be included in a confidentiality agreement include:
- The definition of confidential information
- The scope of the agreement
- The obligations of the parties
- The duration of the agreement
- The remedies for breach of the agreement
Challenges of using confidentiality or non-disclosure agreements
The challenges of using confidentiality agreements include:
- Ensuring that the agreements are properly drafted and implemented
- Obtaining signatures on the agreements
- Enforcing the agreements
Legal implications of confidentiality or non-disclosure agreements
Confidentiality agreements are legal documents, and they should be drafted and implemented in accordance with applicable law. It is best to engage with a legal professional. In some jurisdictions, confidentiality agreements may be unenforceable if they are not drafted in a certain way or if they do not include certain terms.
Who is responsible for drafting and implementing confidentiality or non-disclosure agreements?
The organisation is responsible for drafting and implementing confidentiality agreements. The organisations legal department is typically responsible for drafting the agreements, and the organisation’s human resources department is typically responsible for implementing them. Seek legal advice whether that is internal or external resource.
How to pass the audit
To comply with ISO 27001 Annex A 6.6 and pass the audit you are going to implement the ‘how’ to the ‘what’ the control is expecting. You are going to:
- Get legal help to draft your confidentiality and non disclosure agreements
- Ensure that you can evidence they have been reviewed
- Produced documents and agreements for relevant third parties
- Demonstrate that they are signed, dated, in date and legally enforceable
What the auditor will check
The audit is going to check a number of areas for compliance with ISO 27001 Annex A 6.6. Lets go through them
1. That your confidentiality and non disclosure agreements are based on legal advice
It is easy to download templates or to reuse documents that you already have to cut corners but the auditor will look for evidence that your legal documents are based on legal advice. This may include evidence of engagement, purchase or meetings with legal professionals.
2. That your legal documents are legally binding
The documents that you have will be checked to ensure that they are signed, dated, in date and relevant to the particular engagement with the third party.
3. That people are aware of their responsibilities
The audit is going to check for documented processes and that these have been communicated and people have been trained on what is required of them.
Top 3 Mistakes People Make
In my experience, the top 3 mistakes people make for ISO27001:2022 Annex A 6.6 Confidentiality Or Non-Disclosure Agreements
1. Your legal documents have expired
This is the number one mistake that we see is that legal documents are not checked, they are assumed to be in place but in reality they have expired. Ensure that there is a regular review and that agreements are refreshed as and when needed.
2. Your documents are unenforceable
It is a mistake to cut corners and use non-reputable documents from the internet and assuming that they can be enforced. Ensure all documents and templates are sourced from reputable legal professionals and that they review the contracts and documents that you put in place before and after signing.
3. Your document and version control is wrong
Keeping your document version control up to date, making sure that version numbers match where used, having a review evidenced in the last 12 months, having documents that have no comments in are all good practices.
ISO 27001 Confidentiality Or Non-Disclosure Agreements FAQ
Yes. Laws and regulations require that contracts in place to manage the relationship between entities and include information security requirements in those contracts and non-disclosure agreements is required.
HR is responsible for Confidentiality Or Non-Disclosure Agreements. Under the guidance of legal counsel they are best placed to follow best practice and meet the requirements of the law.
No. It is not advised that you write these yourself. You seek the help of a professional. Legal advice should be sought.
ISO 27001 templates that support ISO 27001 Annex A 6.6 are part of the ISO 27001 Toolkit but legal advice from a professional should be sought.
ISO 27001 Annex A 6.6 is hard. It is a profession in its own right and you should seek the help of legal counsel.
ISO 27001 Annex A 6.6 is dependant on you seeking legal advice and the time it takes for the legal counsel to provide the required documents and clauses.
The cost of Annex A 6.6 is dependant on the cost of the legal advice you seek.
Confidentiality or non-disclosure agreements (CDAs) are important because they help to protect confidential information. This information can include trade secrets, financial data, customer lists, and other proprietary information. By requiring employees and third parties to sign CDAs, organisations can help to ensure that this information is not disclosed to unauthorised individuals.
CDAs are also important because they can help to mitigate legal liability. If confidential information is disclosed in violation of a CDA, the organization may be able to sue the individual who disclosed the information for damages.
Finally, CDAs can help to build trust with employees and third parties. By requiring these individuals to sign CDAs, organisations can demonstrate that they are committed to protecting confidential information. This can help to build trust and loyalty, which can be beneficial to the organisation in the long run.
While standard templates can be a starting point, it’s generally best to customise them to reflect the specific nature of your organisation’s confidential information, business operations, and the legal jurisdiction you operate within. This ensures they are effective and enforceable for your unique circumstances.
Auditors will look for documented procedures for obtaining NDAs, signed copies of agreements (or evidence of their existence and application), evidence of regular review, and proof that new employees/contractors sign them before accessing confidential information.
They should be reviewed at least annually and whenever there are significant changes to the organisation’s business operations, information types, legal requirements, or the nature of relationships with parties holding confidential information.
It refers to the requirement for an organization to establish formal agreements (like NDAs) with individuals and entities who will have access to its confidential information, binding them to protect that information.
This presents a significant information security risk. Your organisation must assess the risk of proceeding without an adequate legal framework in place including the potential impact and consequences. Options include negotiating specific terms, seeking alternative vendors, or implementing compensating controls to manage the risk.
Related ISO 27001 Controls
ISO 27001 Annex A 5.31 Identification of legal, statutory, regulatory and contractual requirements
ISO 27001 Annex A 5.32 Intellectual property rights
ISO 27001 Annex A 5.33 Protection of records
ISO 27001 Annex A 5.34 Privacy and protection of PII
ISO 27001 Annex A 5.36 Compliance with policies and standards for information security
ISO 27001 Monitor, Review And Change Management Of Supplier Services: Annex A 5.22
ISO 27001 Terms and Conditions of Employment: Annex A 6.2
ISO 27001 Addressing Information Security Within Supplier Agreements: Annex A 5.20
External Links
Non-disclosure agreements (UK GOV Guidance)
An Example of a One-way Non-Disclosure Agreement (UK GOV)
ISO 27001 Annex A 6.6 Attributes Table
| Control type | Information security properties | Cybersecurity concepts | Operational capabilities | Security domains |
| Preventive | Availability Confidentiality Integrity | Protect | Human resource security Information protection Supplier relationships | Governance and ecosystem |
