Introduction
I am going to show you what ISO 27001 Annex A 6.6 Confidentiality or Non-Disclosure Agreements is, what’s new, give you ISO 27001 templates, show you examples, do a walkthrough and show you how to implement it.
I am Stuart Barker the ISO 27001 Ninja and using over two decades of experience on hundreds of ISO 27001 audits and ISO 27001 certifications I show you exactly what changed in the ISO 27001:2022 update and exactly what you need to do for ISO 27001 certification.
Table of contents
- Introduction
- What is ISO 27001 Annex A 6.6 Confidentiality Or Non-Disclosure Agreements?
- ISO 27001 Annex A 6.6 Implementation Guide
- ISO 27001 Annex A 6.6 Templates
- What are the Benefits of Confidentiality or Non-Disclosure Agreements?
- Why are confidentiality or non disclosure agreements important?
- ISO 27001 Annex A 6.6 FAQ
- Get the Help of the ISO 27001 Ninja
- Matrix of ISO 27001 Controls and Attribute values
- Reference
What is ISO 27001 Annex A 6.6 Confidentiality Or Non-Disclosure Agreements?
ISO 27001 Annex A 6.6 Confidentiality or Non-Disclosure Agreements is an ISO 27001 control that wants you to ensure that you have non disclosure agreements or confidentiality in contracts. It wants this to be documented, signed, communicated and enforced. Which usually means having a relevant clause in your contracts.
ISO 27001 Annex A 6.6 Purpose
Annex A 6.6 is a preventive control that ensures you maintain confidentiality for information that is accessed by people, external parties and suppliers.
ISO 27001 Annex A 6.6 Definition
The ISO 27001 standard defines ISO 27001:Annex A 6.6 as:
Confidentiality or non-disclosure agreements reflecting the organisation’s needs for the protection of information should be identified, documented, regularly reviewed and signed by personnel and other relevant interested parties.
ISO 27001:2022 Annex A 6.6 Confidentiality or Non-Disclosure Agreements
ISO 27001 Annex A 6.6 Implementation Guide
You are going to have to ensure that:
- you have engaged a legal professional
- your contracts include confidentiality of information using terms that are legally enforceable
- information that requires protecting has been identified
- information has been classified
- Non-disclosure agreements or contracts are signed and in place where required
How to determine what terms you need to include
First, the advice is to consult a legal professional. For general guidance when deciding terms consider:
- What information will be accessed
- What classification is the information
- What will the information be used for
How to identify requirements
When deciding on the requirements to include in the non disclosure agreement or confidentiality clause:
- A definition of what confidential information is
- How long the agreement will last for
- What will happen when the agreement ends
- What are the responsibilities of all signing the agreement
- Who owns what information, intellectual property, trade secrets
- What is the permitted use of confidential information
- A right to audit
- How to inform each other of a breach
- What to do if people don’t stick to the agreements
- What laws apply
What are the steps involved in drafting a confidentiality or non-disclosure agreement?
The steps involved in drafting a confidentiality agreement include:
- Identifying the information that needs to be protected
- Determining the scope of the agreement
- Defining the terms of the agreement
- Reviewing and negotiating the agreement
- Obtaining signatures on the agreement
What are the key terms that should be included in a confidentiality or non-disclosure agreement?
The key terms that should be included in a confidentiality agreement include:
- The definition of confidential information
- The scope of the agreement
- The obligations of the parties
- The duration of the agreement
- The remedies for breach of the agreement
What are the challenges of using confidentiality or non-disclosure agreements?
The challenges of using confidentiality agreements include:
- Ensuring that the agreements are properly drafted and implemented
- Obtaining signatures on the agreements
- Enforcing the agreements
What are the legal implications of confidentiality or non-disclosure agreements?
Confidentiality agreements are legal documents, and they should be drafted and implemented in accordance with applicable law. It is best to engage with a legal professional. In some jurisdictions, confidentiality agreements may be unenforceable if they are not drafted in a certain way or if they do not include certain terms.
Who is responsible for drafting and implementing confidentiality or non-disclosure agreements?
The organisation is responsible for drafting and implementing confidentiality agreements. The organisations legal department is typically responsible for drafting the agreements, and the organisation’s human resources department is typically responsible for implementing them. Seek legal advice whether that is internal or external resource.
ISO 27001 Annex A 6.6 Templates
Having an ISO 27001 template for control 6.6 can help fast track your implementation. The ISO 27001 Toolkit is the ultimate resource for your ISO 27001 implementation.
The Most Ruthlessly Effective and Aggressively Priced ISO 27001 Toolkit in the World.
Join over 1,500+ Empowered Consultants & Business Owners

What are the Benefits of Confidentiality or Non-Disclosure Agreements?
Other than your ISO 27001 certification requiring it, the following are the top 6 benefits of ISO 27001 Annex A 6.6 Confidentiality or Non-Disclosure Agreements:
- You cannot get ISO 27001 certification without it.
- Protecting confidential information
- Reducing the risk of data breaches
- Mitigating legal liability
- Building trust with employees and third parties
- Reputation Protection: In the event of a breach having a agreements in place will reduce the potential for fines and reduce the PR impact of an event
Why are confidentiality or non disclosure agreements important?
Confidentiality or non-disclosure agreements (CDAs) are important because they help to protect confidential information. This information can include trade secrets, financial data, customer lists, and other proprietary information. By requiring employees and third parties to sign CDAs, organisations can help to ensure that this information is not disclosed to unauthorised individuals.
CDAs are also important because they can help to mitigate legal liability. If confidential information is disclosed in violation of a CDA, the organization may be able to sue the individual who disclosed the information for damages.
Finally, CDAs can help to build trust with employees and third parties. By requiring these individuals to sign CDAs, organisations can demonstrate that they are committed to protecting confidential information. This can help to build trust and loyalty, which can be beneficial to the organisation in the long run.
ISO 27001 Annex A 6.6 FAQ
ISO 27001 Annex A 6.6 Sample PDF is in the High Table ISO 27001 Toolkit
There are templates for ISO 27001 included in the High Table ISO 27001 Toolkit
Yes. Laws and regulations require that contracts in place to manage the relationship between entities and include information security requirements in those contracts and non-disclosure agreements is required.
No. It is not advised that you write these yourself. You seek the help of a professional. Legal advice should be sought.
ISO 27001 templates for ISO 27001 Annex A 6.6 are part of the High Table ISO 27001 Toolkit
ISO 27001 Annex A 6.6 is hard. It is a profession in its own right and you should seek the help of legal counsel.
ISO 27001 Annex A 6.6 is dependant on you seeking legal advice and the time it takes for the legal counsel to provide the required documents and clauses.
The cost of Annex A 6.6 is dependant on the cost of the legal advice you seek.
Get the Help of the ISO 27001 Ninja
Book your FREE 30 Minute ISO 27001 Strategy Call and let me show you how you can do it 30x cheaper and 10x faster that you ever thought possible.
Matrix of ISO 27001 Controls and Attribute values
Control type | Information security properties | Cybersecurity concepts | Operational capabilities | Security domains |
Preventive | Availability Confidentiality Integrity | Protect | Human resource security Information protection Supplier relationships | Governance and ecosystem |