ISO 27001:2022 · People controls
ISO 27001:2022 6.6: Confidentiality or non-disclosure agreements
ISO 27001:2022 6.6 covers Confidentiality or non-disclosure agreements. The held text names 5 evidence records for it, the first being Statement of Applicability entry for control A.6.6, showing inclusion or justified exclusion, implementation status and the risks it.... The common gap an assessor flags is NDAs are signed after access has already been given.
Confidentiality or non-disclosure agreements that match the organization's information protection needs are to be identified, written, reviewed regularly and signed by staff and by the outside parties concerned. Purpose (stated in ISO/IEC 27002:2022): maintains the confidentiality of information that personnel or external parties can access. As an Annex A reference control, it is compared with the controls determined in risk treatment (6.1.3 c) and recorded in the Statement of Applicability as included or excluded, with the justification and implementation status (6.1.3 d); implementation guidance is ISO/IEC 27002:2022 6.6.
What evidence supports 6.6?
- Annex A people controlStatement of Applicability entry for control A.6.6, showing inclusion or justified exclusion, implementation status and the risks it treats
- Annex A people controlApproved NDA and confidentiality agreement templates covering definition of protected information, duration, termination actions, ownership, permitted use, audit rights, breach notification, return or destruction and non-compliance consequences
- Annex A people controlSigned agreements for personnel and for relevant external parties, dated before access was granted
- Annex A people controlA register of agreements in force with their parties and expiry or survival terms
- Annex A people controlLegal review confirming enforceability in the relevant jurisdictions
Where this requirement comes from
This is our own statement of ISO 27001:2022 6.6, read from the copy we hold (licensed complete copy) and stated in our words, not the standard verbatim. The framework as we hold it.
Common gaps an assessor flags
- NDAs are signed after access has already been given
- Templates are outdated and omit return or destruction of information at termination
- No register exists, so the organization cannot tell who is bound by what
- Agreements with suppliers or consultants are missing because procurement uses its own contract templates
How it maps to SOC 2
- C1.1 high Confidentiality agreements bind those who handle confidential information.
A link is a topical overlap with a confidence and a reason. It does not establish that meeting one requirement satisfies the other, and it is not certification.