How To Implement ISO 27001 Annex A 6.6 Confidentiality Or Non-Disclosure Agreements

Introduction

I am going to show you what ISO 27001 Annex A 6.6 Confidentiality or Non-Disclosure Agreements is, what’s new, give you ISO 27001 templates, show you examples, do a walkthrough and show you how to implement it.

I am Stuart Barker the ISO 27001 Ninja and using over two decades of experience on hundreds of ISO 27001 audits and ISO 27001 certifications I show you exactly what changed in the ISO 27001:2022 update and exactly what you need to do for ISO 27001 certification.

What is ISO 27001 Annex A 6.6 Confidentiality Or Non-Disclosure Agreements?

ISO 27001 Annex A 6.6 Confidentiality or Non-Disclosure Agreements is an ISO 27001 control that wants you to ensure that you have non disclosure agreements or confidentiality in contracts. It wants this to be documented, signed, communicated and enforced. Which usually means having a relevant clause in your contracts.

ISO 27001 Annex A 6.6 Purpose

Annex A 6.6 is a preventive control that ensures you maintain confidentiality for information that is accessed by people, external parties and suppliers.

ISO 27001 Annex A 6.6 Definition

The ISO 27001 standard defines ISO 27001:Annex A 6.6 as:

Confidentiality or non-disclosure agreements reflecting the organisation’s needs for the protection of information should be identified, documented, regularly reviewed and signed by personnel and other relevant interested parties.

ISO 27001:2022 Annex A 6.6 Confidentiality or Non-Disclosure Agreements

ISO 27001 Annex A 6.6 Implementation Guide

You are going to have to ensure that:

• you have engaged a legal professional
• your contracts include confidentiality of information using terms that are legally enforceable
• information that requires protecting has been identified
• information has been classified
• Non-disclosure agreements or contracts are signed and in place where required

How to determine what terms you need to include

First, the advice is to consult a legal professional. For general guidance when deciding terms consider:

• What information will be accessed
• What classification is the information
• What will the information be used for

How to identify requirements

When deciding on the requirements to include in the non disclosure agreement or confidentiality clause:

• A definition of what confidential information is
• How long the agreement will last for
• What will happen when the agreement ends
• What are the responsibilities of all signing the agreement
• Who owns what information, intellectual property, trade secrets
• What is the permitted use of confidential information
• A right to audit
• How to inform each other of a breach
• What to do if people don’t stick to the agreements
• What laws apply

What are the steps involved in drafting a confidentiality or non-disclosure agreement?

The steps involved in drafting a confidentiality agreement include:

1. Identifying the information that needs to be protected
2. Determining the scope of the agreement
3. Defining the terms of the agreement
4. Reviewing and negotiating the agreement
5. Obtaining signatures on the agreement

What are the key terms that should be included in a confidentiality or non-disclosure agreement?

The key terms that should be included in a confidentiality agreement include:

• The definition of confidential information
• The scope of the agreement
• The obligations of the parties
• The duration of the agreement
• The remedies for breach of the agreement

What are the challenges of using confidentiality or non-disclosure agreements?

The challenges of using confidentiality agreements include:

• Ensuring that the agreements are properly drafted and implemented
• Obtaining signatures on the agreements
• Enforcing the agreements

What are the legal implications of confidentiality or non-disclosure agreements?

Confidentiality agreements are legal documents, and they should be drafted and implemented in accordance with applicable law. It is best to engage with a legal professional. In some jurisdictions, confidentiality agreements may be unenforceable if they are not drafted in a certain way or if they do not include certain terms.

Who is responsible for drafting and implementing confidentiality or non-disclosure agreements?

The organisation is responsible for drafting and implementing confidentiality agreements. The organisations legal department is typically responsible for drafting the agreements, and the organisation’s human resources department is typically responsible for implementing them. Seek legal advice whether that is internal or external resource.

ISO 27001 Annex A 6.6 Templates

Having an ISO 27001 template for control 6.6 can help fast track your implementation. The ISO 27001 Toolkit is the ultimate resource for your ISO 27001 implementation.

What are the Benefits of Confidentiality or Non-Disclosure Agreements?

Other than your ISO 27001 certification requiring it, the following are the top 6 benefits of ISO 27001 Annex A 6.6 Confidentiality or Non-Disclosure Agreements: 

• You cannot get ISO 27001 certification without it.
• Protecting confidential information
• Reducing the risk of data breaches
• Mitigating legal liability
• Building trust with employees and third parties
• Reputation Protection: In the event of a breach having a agreements in place will reduce the potential for fines and reduce the PR impact of an event

Why are confidentiality or non disclosure agreements important?

Confidentiality or non-disclosure agreements (CDAs) are important because they help to protect confidential information. This information can include trade secrets, financial data, customer lists, and other proprietary information. By requiring employees and third parties to sign CDAs, organisations can help to ensure that this information is not disclosed to unauthorised individuals.

CDAs are also important because they can help to mitigate legal liability. If confidential information is disclosed in violation of a CDA, the organization may be able to sue the individual who disclosed the information for damages.

Finally, CDAs can help to build trust with employees and third parties. By requiring these individuals to sign CDAs, organisations can demonstrate that they are committed to protecting confidential information. This can help to build trust and loyalty, which can be beneficial to the organisation in the long run.

ISO 27001 Annex A 6.6 FAQ

Get the Help of the ISO 27001 Ninja

Book your FREE 30 Minute ISO 27001 Strategy Call and let me show you how you can do it 30x cheaper and 10x faster that you ever thought possible.

Matrix of ISO 27001 Controls and Attribute values

Control type	Information security properties	Cybersecurity concepts	Operational capabilities	Security domains
Preventive	Availability Confidentiality Integrity	Protect	Human resource security Information protection Supplier relationships	Governance and ecosystem

Reference

ISO/IEC 27001 Information Security Management