ISO 27001 Annex A 6.6 Confidentiality or Non-Disclosure Agreements is an ISO 27001 Annex A control that wants you to ensure that you have non disclosure agreements or confidentiality in contracts.
In this guide you will learn how to implement ISO 27001 Annex A 6.6 and pass your audit from ISO 27001 Lead Auditor Stuart Barker – author of the ultimate ISO 27001 Toolkit.
Table of contents
- What are Confidentiality Or Non-Disclosure Agreements?
- ISO 27001 Annex A 6.6 Training Video
- Implementation Guide
- How to implement ISO 27001 Annex A 6.6
- How to pass the audit
- What the auditor will check
- Top 3 mistakes and how to avoid them
- ISO 27001 Annex A 6.6 FAQ
- Related ISO 27001 Controls
- External Links
- ISO 27001 Annex A 6.6 Attributes Table
What are Confidentiality Or Non-Disclosure Agreements?
A Confidentiality or Non-Disclosure Agreement (NDA) is a legal contract that prohibits a person or entity from disclosing confidential information to others. This type of agreement is often used in business, employment, and other situations where sensitive or confidential information needs to be shared. In ISO 27001 this is known as ISO27001:2022 Annex A 6.6 Confidentiality Or Non-Disclosure Agreements. It is one of the 93 ISO 27001 Annex A controls.
The requirement is that confidentiality or non-disclosure agreements reflecting the organisation’s needs for the protection of information should be identified, documented, regularly reviewed and signed by personnel and other relevant interested parties.
Benefits
The main benefit is that is allows you to protect confidential information, bound by a legally enforceable framework. The benefits of implementing confidentiality and non disclosure agreements include:
- Reducing the risk of data breaches by ensuring and effective legal framework is in place
- Reduced cost of incidents by catching and managing events early and assigned responsibility and accountability
- Mitigating legal liability by having an agreed and enforceable legal framework in place
- You cannot get ISO 27001 certification without it
- Protection of confidential information
- Building trust with employees and third parties
- Reputation Protection
- Intellectual Property Protection
- Mitigating legal liability
DO IT YOURSELF ISO27001
Stop Spanking £10,000’s on Consultants and Platforms
ISO 27001 Annex A 6.6 Training Video
In this free training video you will learn How to implement ISO 27001 Annex A 6.6 Confidentiality or Non Disclosure Agreements and Pass Your Audit.
Implementation Guide
General Guidance
You are going to have to ensure that:
- you have engaged a legal professional
- your contracts include confidentiality of information using terms that are legally enforceable
- information that requires protecting has been identified
- information has been classified
- Non-disclosure agreements or contracts are signed and in place where required
How to determine what terms you need to include
First, the advice is to consult a legal professional. For general guidance when deciding terms consider:
- What information will be accessed
- What classification is the information
- What will the information be used for
How to identify the requirements you need to include
When deciding on the requirements to include in the non disclosure agreement or confidentiality clause:
- A definition of what confidential information is
- How long the agreement will last for
- What will happen when the agreement ends
- What are the responsibilities of all signing the agreement
- Who owns what information, intellectual property, trade secrets
- What is the permitted use of confidential information
- A right to audit
- How to inform each other of a breach
- What to do if people don’t stick to the agreements
- What laws apply
Key steps in drafting a confidentiality or non-disclosure agreement
The steps involved in drafting a confidentiality agreement include:
- Identifying the information that needs to be protected
- Determining the scope of the agreement
- Defining the terms of the agreement
- Reviewing and negotiating the agreement
- Obtaining signatures on the agreement
Key terms that should be included in a confidentiality or non-disclosure agreement
The key terms that should be included in a confidentiality agreement include:
- The definition of confidential information
- The scope of the agreement
- The obligations of the parties
- The duration of the agreement
- The remedies for breach of the agreement
Challenges of using confidentiality or non-disclosure agreements
The challenges of using confidentiality agreements include:
- Ensuring that the agreements are properly drafted and implemented
- Obtaining signatures on the agreements
- Enforcing the agreements
Legal implications of confidentiality or non-disclosure agreements
Confidentiality agreements are legal documents, and they should be drafted and implemented in accordance with applicable law. It is best to engage with a legal professional. In some jurisdictions, confidentiality agreements may be unenforceable if they are not drafted in a certain way or if they do not include certain terms.
Who is responsible for drafting and implementing confidentiality or non-disclosure agreements?
The organisation is responsible for drafting and implementing confidentiality agreements. The organisations legal department is typically responsible for drafting the agreements, and the organisation’s human resources department is typically responsible for implementing them. Seek legal advice whether that is internal or external resource.
How to implement ISO 27001 Annex A 6.6
Implementing ISO 27001 Annex A 6.6 requires a systematic approach to identifying and legally protecting sensitive information assets.
1. Categorise Sensitive Information Assets
Identify the specific data sets and intellectual property that require legal protection to determine the appropriate depth of confidentiality agreements.
- Review the Information Asset Register to classify data according to sensitivity levels.
- Identify high-risk areas such as trade secrets, personally identifiable information (PII), and proprietary software source code.
- Map data access requirements to specific IAM roles to ensure confidentiality agreements cover the correct personnel.
2. Formalise Standard Confidentiality and NDA Templates
Develop legally reviewed templates that cover the essential security requirements mandated by the ISO 27001 standard.
- Define the specific scope of “Confidential Information” to avoid legal ambiguity during enforcement.
- Include mandatory clauses regarding the permitted use of data and the return or destruction of information upon contract termination.
- Specify the duration of confidentiality obligations, ensuring they survive the termination of the business relationship.
- Incorporate requirements for reporting suspected or actual breaches of confidentiality.
3. Provision Agreements for Internal and External Parties
Execute the signing of agreements across all relevant stakeholders before granting access to the organisation’s information systems.
- Embed confidentiality clauses within formal employment contracts for all internal staff.
- Provision standalone Non-Disclosure Agreements (NDAs) for third-party contractors, freelance consultants, and vendors.
- Utilise digital signature platforms to maintain a timestamped and tamper-proof record of all signed agreements.
- Cross-reference signed NDAs with the Physical Access Control System (PACS) to ensure no visitor enters secure zones without a valid agreement.
4. Execute Regular Compliance Reviews
Establish a periodic review cycle to ensure that existing confidentiality requirements remain aligned with changing business needs and legal landscapes.
- Review existing agreements at least annually or when significant changes occur in the business relationship.
- Update templates to reflect new regulatory requirements such as GDPR or sector-specific data protection laws.
- Verify that agreements are still legally enforceable in the jurisdictions where the organisation or its partners operate.
- Maintain a centralised tracking log of agreement versions and review dates for auditor inspection.
5. Formalise Exit and Termination Procedures
Ensure that departing personnel and entities are reminded of their ongoing legal obligations regarding the organisation’s protected data.
- Incorporate a formal confidentiality reminder into the standard staff exit interview process.
- Obtain a signed declaration confirming the return of all organisational assets and the destruction of any local copies of sensitive data.
- Revoke logical access to all systems and physical access to secure areas immediately upon the end of the contract.
- Record the completion of these exit requirements in the Register of Entrants (ROE) or HR records.
How to pass the audit
To comply with ISO 27001 Annex A 6.6 and pass the audit you are going to implement the ‘how’ to the ‘what’ the control is expecting. You are going to:
- Get legal help to draft your confidentiality and non disclosure agreements
- Ensure that you can evidence they have been reviewed
- Produced documents and agreements for relevant third parties
- Demonstrate that they are signed, dated, in date and legally enforceable
What the auditor will check
The audit is going to check a number of areas for compliance with ISO 27001 Annex A 6.6. Lets go through them
1. That your confidentiality and non disclosure agreements are based on legal advice
It is easy to download templates or to reuse documents that you already have to cut corners but the auditor will look for evidence that your legal documents are based on legal advice. This may include evidence of engagement, purchase or meetings with legal professionals.
2. That your legal documents are legally binding
The documents that you have will be checked to ensure that they are signed, dated, in date and relevant to the particular engagement with the third party.
3. That people are aware of their responsibilities
The audit is going to check for documented processes and that these have been communicated and people have been trained on what is required of them.
Top 3 mistakes and how to avoid them
In my experience, the top 3 mistakes people make for ISO 27001 Annex A 6.6 Confidentiality Or Non-Disclosure Agreements
1. Your legal documents have expired
This is the number one mistake that we see is that legal documents are not checked, they are assumed to be in place but in reality they have expired. Ensure that there is a regular review and that agreements are refreshed as and when needed.
2. Your documents are unenforceable
It is a mistake to cut corners and use non-reputable documents from the internet and assuming that they can be enforced. Ensure all documents and templates are sourced from reputable legal professionals and that they review the contracts and documents that you put in place before and after signing.
3. Your document and version control is wrong
Keeping your document version control up to date, making sure that version numbers match where used, having a review evidenced in the last 12 months, having documents that have no comments in are all good practices.
ISO 27001 Annex A 6.6 FAQ
Yes, implementing confidentiality or non-disclosure agreements is a mandatory control under the ISO 27001:2022 standard.
Auditors expect to see signed agreements for everyone with access to sensitive data.
Lack of formal confidentiality requirements is often flagged as a non-conformity.
NDAs must be in place before any access to protected information is granted.
Any internal or external party that processes or has access to your organisation’s non-public information must be bound by confidentiality requirements.
Permanent and temporary employees.
Sub-contractors and freelance consultants.
Third-party service providers and vendors (e.g., Cloud hosts, IT support).
Potential investors or partners during due diligence.
ISO 27001 mandates that confidentiality requirements should be reviewed at regular intervals or whenever significant changes occur in the business relationship.
Annual reviews are considered industry best practice.
Agreements should be revisited if a staff member changes roles to a more sensitive position.
Reviews must occur if a third-party contract is renewed or modified.
Legal updates (such as GDPR or sector-specific laws) may trigger a mandatory review.
An ISO 27001 compliant confidentiality agreement must clearly define the scope of protected information and the legal consequences of a breach.
Definition of what constitutes “Confidential Information.”
Duration of the agreement, including post-termination obligations.
Responsibilities for the return or destruction of information upon exit.
Authorised use cases and restrictions on copying or sharing data.
Yes, confidentiality clauses embedded within a formal employment contract are generally sufficient to satisfy ISO 27001 requirements for internal staff.
The clause must be legally binding in the relevant jurisdiction.
It must explicitly state that obligations continue after the employee leaves the organisation.
Staff must be made aware of these specific clauses during their security induction.
Confidentiality obligations must remain in force after an individual or entity leaves the organisation to ensure ongoing data protection.
Exit interviews should be used to remind departing staff of their ongoing legal duties.
Agreements should specify a “survival period” (e.g., 2 to 5 years, or indefinitely for trade secrets).
Evidence of the return of all organisational assets must be documented alongside the NDA exit review.
Related ISO 27001 Controls
- ISO 27001 Annex A 5.31 Identification of legal, statutory, regulatory and contractual requirements
- ISO 27001 Annex A 5.32 Intellectual property rights
- ISO 27001 Annex A 5.33 Protection of records
- ISO 27001 Annex A 5.34 Privacy and protection of PII
- ISO 27001 Annex A 5.36 Compliance with policies and standards for information security
- ISO 27001 Annex A 5.22 Monitor, Review And Change Management Of Supplier Services
- ISO 27001 Annex A 6.2 Terms and Conditions of Employment
- ISO 27001 Annex A 5.20 Addressing Information Security Within Supplier Agreements
External Links
- Non-disclosure agreements (UK GOV Guidance)
- An Example of a One-way Non-Disclosure Agreement (UK GOV)
ISO 27001 Annex A 6.6 Attributes Table
| Control type | Information security properties | Cybersecurity concepts | Operational capabilities | Security domains |
| Preventive | Availability Confidentiality Integrity | Protect | Human resource security Information protection Supplier relationships | Governance and ecosystem |
Stuart Barker
ISO 27001 Ninja
Stuart Barker is a veteran practitioner with over 30 years of experience in systems security and risk management. Holding an MSc in Software and Systems Security, he combines academic rigour with extensive operational experience, including a decade leading Data Governance for General Electric (GE).
As a qualified ISO 27001 Lead Auditor, Stuart possesses distinct insight into the specific evidence standards required by certification bodies. His toolkits represent an auditor-verified methodology designed to minimise operational friction while guaranteeing compliance.
- MSc Security
- ISO 27001 Lead Auditor
- 30+ Years Exp
- Ex-GE Leader