Key takeaways
- Use NDAs that reflect what needs protecting, and review them.
- Confidentiality agreements protect sensitive information shared with staff, contractors and partners.
- Start here: identify who needs to sign confidentiality agreements.
Purpose
Use NDAs that reflect what needs protecting, and review them.
Requirement
Requirement summaryConfidentiality or non-disclosure agreements reflecting the organization’s needs for the protection of information shall be identified, documented, regularly reviewed and signed by personnel and other relevant interested parties.
Why it matters
Confidentiality agreements protect sensitive information shared with staff, contractors and partners.
How to implement
- Identify who needs to sign confidentiality agreements.
- Use agreements that reflect your actual protection needs.
- Review templates periodically and after legal changes.
- Keep signed copies on record.
What evidence you need to provide
Here is what you will typically need to provide for Annex A 6.6. It does not matter which system it lives in: a document, screenshot or export is fine.
Documents to have ready
- Your confidentiality agreement (NDA) templates.
- Your Statement of Applicability (SoA: the list of all 93 controls showing which you use and why) with A.6.6 marked as used or not used, a short reason, and its current status.
Records and examples to show
- Signed agreements for staff, contractors and third parties who see confidential information.
- Proof the templates are reviewed from time to time.
Things you should be able to show or explain
- Be able to explain when an NDA is required.
How much to show: A handful of people and a few third parties.
Common mistakes
- Missing signed agreements.
- Templates never reviewed.
- Partners given data before an NDA is signed.
- Template never reviewed since it was written.
- Tip: Keep signed NDAs where auditors can find them.
Policies & documents to have
- Human Resource Resource Security policy
FAQ
Is A.6.6 mandatory?
Annex A controls are not automatically mandatory. You must consider every control and record in your Statement of Applicability whether it applies and why. In practice, most organisations include this one.
What will I need to show for A.6.6?
Be ready to explain how the control works in your organisation and to provide things like: Your confidentiality agreement (NDA) templates…