Confidentiality or non-disclosure agreements

What the control asks

Confidentiality or non-disclosure agreements that match the organization's information protection needs are to be identified, written, reviewed regularly and signed by staff and by the outside parties concerned. Purpose: keep information that staff or outside parties can reach confidential. Guidance: agreements protect confidential information through legally enforceable terms and apply both to personnel and to interested parties. Their terms follow from the organization's security requirements, considering the kind of information handled, its classification, how it will be used and what access the other party is allowed. Elements to consider are: what information is protected; how long the agreement lasts, including cases where confidentiality must hold with no end date or until the information is made public; what must happen when it ends; signatories' duties and actions to prevent unauthorized disclosure; who owns the information, any trade secrets and any intellectual property, and what that means for keeping it confidential; permitted uses and the signatory's rights of use; a right to audit and monitor activity involving confidential information in highly sensitive cases; how unauthorized disclosure or leakage is notified and reported; return or destruction of information at the end; and the consequences of breaching the agreement. Enforceability in the applicable jurisdiction is considered (5.31 to 5.34), and requirements are reviewed periodically and whenever circumstances affecting them change. Other information: such agreements both protect the organization's information and remind signatories of their duty to handle it responsibly and only as authorized.

Purpose in the standard’s terms, in our words: Maintains the confidentiality of information that personnel or external parties can access.

Attribute values in one line: Preventive; Confidentiality; Protect; Human resource security, Information protection, Supplier relationships security; Governance and ecosystem.

The five attribute values

These are the published values for this control, from ISO/IEC 27002:2022 clause 4.2 and Annex A Table A.1. Where your own value differs, record the difference and the reason in the same row rather than replacing the published value.

Evidence an auditor asks for

The attribute is a claim about how the control behaves. The evidence is what proves it operates. Keep both, and keep them together.

• Approved NDA and confidentiality agreement templates covering definition of protected information, duration, termination actions, ownership, permitted use, audit rights, breach notification, return or destruction and non-compliance consequences
• Signed agreements for personnel and for relevant external parties, dated before access was granted
• A register of agreements in force with their parties and expiry or survival terms
• Legal review confirming enforceability in the relevant jurisdictions
• Records of periodic review of agreement requirements and updates after relevant changes

Where audits commonly find gaps

• NDAs are signed after access has already been given
• Templates are outdated and omit return or destruction of information at termination
• No register exists, so the organization cannot tell who is bound by what
• Agreements with suppliers or consultants are missing because procurement uses its own contract templates

What ISO/IEC 27028 changes for this control

It carries a single control type, preventive, which sets what the evidence has to prove. It contributes no detect function, so a control set built from this row alone would not show detection. It crosses 3 operational capabilities, so two teams share the work and the owner column matters. Its earlier numbering (13.2.4) is kept in the register so an older audit file can still be traced.

The guidance expands how the five values are used; it does not change the control or add a requirement. A register that carries the values and the evidence can answer the attribute question for this control without a new document. A register that does not can add the columns at the next SoA version, with an owner and a review date.

Controls that share its values

• 6.1 Screening
• 6.2 Terms and conditions of employment
• 6.3 Information security awareness, education and training

Read the five attributes All 93 controls