Terms and conditions of employment

What the control asks

Employment contracts and agreements are to set out the information security responsibilities of both the individual and the organization. Purpose: make people understand, before they take a role, what it demands of them for security. Guidance: contractual obligations should be consistent with the top-level security policy and the topic policies that apply, and can also make clear: that people who will reach confidential information sign confidentiality or non-disclosure agreements before access (6.6); their legal rights and responsibilities, for example under copyright or data protection law (5.32, 5.34); their responsibilities for classifying information and managing the assets, facilities and services they handle (5.9 to 5.13); their responsibilities for information received from interested parties; and the consequences of ignoring security requirements (6.4). Security roles and responsibilities are communicated to candidates before employment, and personnel agree to security terms suited to the nature and extent of their access. The terms are reviewed when laws, regulations or policies change, and where appropriate some responsibilities continue for a set period after employment ends (6.5). A code of conduct is one way to express responsibilities for confidentiality, PII protection, ethics and proper use of assets; a supplier may sign on behalf of its individual staff; organizations without a legal entity or employees can use equivalent arrangements.

Purpose in the standard’s terms, in our words: Makes personnel understand what their roles demand of them for security.

Attribute values in one line: Preventive; Confidentiality, Integrity, Availability; Protect; Human resource security; Governance and ecosystem.

The five attribute values

These are the published values for this control, from ISO/IEC 27002:2022 clause 4.2 and Annex A Table A.1. Where your own value differs, record the difference and the reason in the same row rather than replacing the published value.

Evidence an auditor asks for

The attribute is a claim about how the control behaves. The evidence is what proves it operates. Keep both, and keep them together.

• Standard employment contract and contractor agreement templates with information security clauses reflecting the policies
• Signed agreements for a sample of personnel, including confidentiality undertakings signed before access
• Pre-employment communication of security roles and responsibilities to candidates
• Records showing terms were reviewed after changes in law, regulation or policy
• Clauses stating responsibilities that survive termination and for how long
• A code of conduct covering confidentiality, PII, ethics and acceptable use, with acknowledgement records

Where audits commonly find gaps

• Contracts contain a generic confidentiality clause but nothing about classification, handling or consequences
• Terms were never updated after policy or legal changes
• Contractor agreements lack the security terms employees sign
• Post-employment obligations are not defined, so they are unenforceable

What ISO/IEC 27028 changes for this control

It carries a single control type, preventive, which sets what the evidence has to prove. It contributes no detect function, so a control set built from this row alone would not show detection. Its earlier numbering (07.1.2) is kept in the register so an older audit file can still be traced.

The guidance expands how the five values are used; it does not change the control or add a requirement. A register that carries the values and the evidence can answer the attribute question for this control without a new document. A register that does not can add the columns at the next SoA version, with an owner and a review date.

Controls that share its values

• 6.1 Screening
• 6.3 Information security awareness, education and training
• 6.4 Disciplinary process

Read the five attributes All 93 controls