ISO 27001 Annex A 6.2 Terms and conditions of employment requires contractual agreements to state security duties clearly. Documented clauses ensure that employees and contractors commit to protecting company information before gaining system access.
Table of contents
Key Takeaways
- Define contractual security duties: Set clear, legally binding information security responsibilities in all employee and contractor agreements.
- Store contracts centrally: Keep signed employment terms and contractor agreements in a secure, central document repository.
- Sign before granting access: Require signed terms before giving workers access to business networks, cloud tools, or confidential files.
- State lasting obligations: Clarify that confidentiality duties and data protection rules remain in force after employment ends.
- Define data ownership: State clearly that all intellectual property, work files, and customer records belong to the organisation.
- Reference code of conduct rules: Link employment contracts directly to company security policies, acceptable use rules, and disciplinary processes.
- Review terms regularly: Update standard contract terms periodically to reflect new legal rules, privacy regulations, and business risks.
- Cover all worker types: Apply appropriate security clauses to permanent staff, temporary workers, remote employees, and third-party contractors.
How to Implement ISO 27001 Annex A 6.2
- Draft standard security clauses: Create approved contract templates that explicitly cover data safety, confidentiality, and acceptable use.
- Coordinate with legal and HR teams: Work with human resources and legal advisors to ensure terms meet regional employment laws.
- Integrate with the hiring process: Issue contracts and security terms as part of the standard pre-employment offer pack.
- Define intellectual property rights: Insert clear clauses stating that all code, documents, and inventions created at work belong to the company.
- Include post-employment terms: Specify that confidentiality duties, trade secret protections, and non-disclosure rules continue indefinitely after departure.
- Cover contractor obligations: Require third-party contractors and freelance workers to sign equivalent security agreements before starting projects.
- Mandate policy adherence: State in the contract that failure to follow security policies may result in disciplinary action or termination.
- Maintain a central contract log: Store all countersigned employment agreements securely in your central document repository.
- Update terms on role changes: Issue updated contract amendments when employees transition into high-privilege or executive roles.
When you’re ready to bring compliance into one place
How to Audit ISO 27001 Annex A 6.2
- Review standard contract templates: Inspect employment and contractor templates to verify they contain clear security and confidentiality clauses.
- Sample employee personnel files: Audit a random selection of staff records to verify that fully signed contracts are on file.
- Audit contractor agreements: Check third-party personnel files to confirm external workers signed security terms before receiving system access.
- Verify pre-access signing dates: Compare contract signature dates against account creation timestamps to ensure agreements preceded access.
- Check post-employment clauses: Inspect sample contracts to confirm lasting non-disclosure and asset return obligations are clearly stated.
- Verify intellectual property terms: Confirm agreements explicitly assign ownership of created software, designs, and data to the company.
- Review policy acknowledgement forms: Check that employees signed acknowledgements confirming they read and agreed to follow company security rules.
- Assess role change documentation: Verify that workers promoted to sensitive positions signed updated confidentiality agreements.
Audit Evidence Checklist
- Standard employment templates: Maintain approved contract templates containing complete security terms in your central repository.
- Signed staff employment contracts: Supply signed contracts for sampled employees showing agreed security duties.
- Signed contractor agreements: Provide executed third-party agreements containing mandatory information security terms.
- Policy acknowledgement sheets: Supply signed records proving workers agreed to abide by the company security handbook.
- Access provisioning timestamps: Provide identity logs showing system accounts were created only after contract execution.
- Legal review sign-offs: Produce evidence of annual reviews showing contract terms remain aligned with current security regulations.
- Role change addendums: Supply signed contract updates for workers transferring into sensitive or privileged positions.
What to Teach Employees
- Understand contractual duties: Teach workers that security terms in their employment contract are legally binding obligations.
- Protect company property: Instruct staff that all data, files, and equipment remain company property at all times.
- Follow acceptable use rules: Remind employees to use business systems solely for approved tasks and avoid unapproved software.
- Remember lasting obligations: Educate workers that confidentiality duties remain in force even after leaving the company.
- Know the penalties for breaches: Make sure staff know that breaking contractual security rules leads to formal disciplinary action.
- Report contract concerns: Encourage workers to ask human resources if they need clarity on their security responsibilities.
Common Implementation Challenges
- Granting access before signing: Managers give systems access before contracts are signed. Block account creation until signed terms are filed.
- Overlooking contractor terms: Companies use generic supplier invoices without security terms. Require standard security agreements for all freelancers.
- Outdated contract clauses: Old templates fail to cover modern remote working and cloud tools. Review standard contracts annually.
- Missing signed records: Teams misplace countersigned paperwork. Store all executed employment files in a single, secure central hub.
- Vague security expectations: Contracts mention security broadly without referencing policies. Explicitly cite the employee security handbook in all contracts.
- Ignoring role changes: Staff take on elevated rights without updated confidentiality terms. Trigger contract reviews alongside internal job promotions.
How to Measure Effectiveness (KPIs)
- Contract signature completion rate: Track the percentage of active employees and contractors with signed security terms on file.
- Pre-access compliance rate: Measure the proportion of workers who fully signed contracts before receiving network or system access.
- Contractor terms compliance rate: Track the percentage of third-party staff covered by active, signed security agreements.
- Contract repository accuracy: Measure the proportion of personnel files matching central digital records during quarterly audits.
- Role change agreement rate: Track the percentage of promoted workers who sign updated security addendums within target timeframes.
- Contract audit finding count: Monitor the number of non-conformities flagged during internal reviews of employment terms.
Related ISO 27001 Controls
ISO 27001 Control A 6.2 connects to several other ISO 27001 requirements:
- ISO 27001 Clause 7.2: Competence requirements for employees.
- ISO 27001 Annex A 6.1: Screening requirements before employment.
- ISO 27001 Annex A 6.4: Disciplinary process for security breaches.
- ISO 27001 Annex A 6.5: Responsibilities after termination or change of employment.
