A.6.6 Confidentiality or non-disclosure agreements: requirements

What A.6.6 asks for and why ISO 27001 auditors sample it

If you are a compliance lead asked to show signed confidentiality or non-disclosure agreements for every employee and contractor, the core job is to prove that A.6.6 confidentiality or non-disclosure agreements is operating, not just that a template exists. The control asks the organization to identify the confidentiality and non-disclosure agreements it needs to protect the information it holds, document them, review them at planned intervals, and make sure personnel and other relevant interested parties sign them. In practice that means you must be able to say which agreements apply to which roles, show that each one reflects what the business actually needs to protect, and produce the signed copy for each person in scope. Without that, sensitive customer data, source code or financial plans can leave the organization through a careless conversation or a departing contractor with no legal obligation to keep quiet.

The difficulty is that these agreements rarely live in one place. Employee confidentiality clauses sit in HR onboarding packs, contractor terms are held by procurement, supplier and partner NDAs are filed with legal, and some staff sign a click-through in a vendor portal. Each record may be correct on its own, yet no single list shows who has signed what, or whether the wording still matches the information the organization now handles. Start by building one register that lists each agreement type, its owner, the roles it covers, and the date of its last review. Then ask HR, procurement and legal to confirm which population each source covers, including temporary staff, interns and outsourced workers, because gaps usually sit at those boundaries.

Auditors test this control by sampling. They typically choose a set of people or parties, ask for the signed agreement, and check that the signature date falls on or before access to information was granted, and that the agreement names the information it protects. They also ask for evidence of the periodic review, such as meeting notes or a revision history showing the wording was checked against current needs. Confirm with your certification body how many records it expects to sample and which population it will draw from, since that determines whether your register must be complete before the audit starts. Keep the signed originals retrievable by name and role, so a sample request can be answered in hours rather than weeks.

Which people, agreements and third parties fall in scope for A.6.6

A.6.6 applies wherever information leaves the organization's direct control and reaches a person or party who is not bound by the employment contract. The ISMS scope sets which information and systems matter, and the classification of that information decides which agreement types each group needs.

Employees and internal staff

Permanent employees are the baseline population, but a confidentiality clause in the employment contract alone may not satisfy A.6.6 if the organization expects a separate agreement for sensitive data. Check whether every employee in the ISMS scope has a signed agreement on file, including staff in shared service functions such as HR, finance and facilities who handle restricted records. Confirm the agreement wording covers information that is classified, not only generic company information.

Contractors and temporary staff

Contractors, agency workers and fixed-term temporary staff often hold system access without being employees, so they are the most common gap in signature records. Decide whether the agreement is signed directly with the individual, with the agency, or both, and confirm that the agency contract passes equivalent obligations down. Sample a recent contractor onboarding to see whether the signed agreement exists before access was granted.

Board members, interns and advisers

Board members, interns, volunteers and external advisers can see strategic or personal information without appearing in HR systems. List these roles explicitly in the scope analysis, because they are easy to omit from access reviews. Illustrative example: a board paper containing unreleased financial results is shared with a non-executive director who has never signed an agreement, which an auditor would treat as a gap.

Auditors, consultants and implementation partners

External auditors, consultants and implementation partners often receive evidence, configuration files and architecture documents that describe security weaknesses. Agreements with these parties should set out permitted use, retention, return or destruction, and onward disclosure rules. Only the organization can decide what it shares; an implementation partner prepares systems and evidence, while an independent auditor or certification body issues any report.

Key suppliers and cloud providers

Suppliers with access to production data, logs or source code need agreements that match what they can see, and A.5.20 governs the security terms in supplier agreements alongside A.6.6. Map each supplier that handles protected information to a specific confidentiality clause, then check that the clause survives contract termination. Confirm with each supplier which of its staff sign individual agreements and which are covered only by the corporate contract.

Agreements tied to classification

The information classification scheme determines how strict each agreement must be and which parties need one. Information marked restricted or confidential usually requires named individuals to sign, while public or internal material may need only a standard acknowledgment. Set this mapping in writing, link it to the ISMS scope statement, and review it when classification levels or the scope change.

How an assessor tests A.6.6 and what they ask to see

This table walks through the test steps an assessor typically follows for A.6.6, the evidence each step expects, and where organizations most often fall short. Use it to prepare the agreement list, signature records and review history before an audit. Assessor sampling practice varies, so confirm the approach with your certification body.

Assessor step	What they ask to see	Where it usually fails
Review the documented agreement list	A current register of the confidentiality or non-disclosure agreements the organization requires, with the roles or parties each one covers	The list is missing,或 covers employees only and omits contractors, temporary staff and key suppliers
Check the list against protection needs	Links from the agreement list to the risk assessment, asset classification or information handling rules that justify each agreement	Agreements exist but no record shows why they were chosen or how they match what the organization must protect
Sample signed agreements for personnel	A selection of signed agreements across roles, starting dates and departments, with signature dates and version numbers	Employees signed an older template, or some staff have no signed record at all
Sample signed agreements for third parties	Signed agreements or contract clauses for contractors, consultants, vendors and other parties with access to information	Unsigned contractors who started work before paperwork was completed, or vendors covered only by a general terms page
Check template currency	The current agreement template, its approval record and evidence that legal or the information security function reviewed it	Outdated templates still in use, or no record that wording was updated after law, contract or scope changes
Check the review records	Dated review minutes or sign-offs showing the agreement list and templates were reviewed at planned intervals and after significant change	No evidence of review, or reviews that repeat the same date without any recorded outcome
Confirm the sampling approach	Agree with the certification body how many records they will sample and which populations they will draw from	Assessors choose different samples, so organizations are surprised by a population they did not prepare

Implementing A.6.6 step by step

This sequence turns A.6.6 from a policy statement into a working set of agreements, each tied to a defined information need, signed by the right people and reviewed on a schedule an auditor can sample against.

Inventory information needs and classification
Start by listing the categories of information the organization must protect, such as source code, customer data, financial records, trade secrets and security configurations, and attach the classification level each already carries under the information classification scheme. Assign an owner to each category, usually the business or system owner who decides who may see it. The output is a short register that links each information category to its owner and classification, which becomes the basis for deciding where agreements are needed.
Map who needs access to protected information
For each category in the register, list the groups that receive it: employees, contractors, temporary staff, suppliers, auditors, customers and partner organizations. Note whether each group already signs an employment or contract clause that covers confidentiality, and mark the gaps. The output is a matrix of information categories against party types, with the existing agreement for each cell or a clear marker that none exists.
Define agreement types and their triggers
Decide how many agreement types the organization needs, for example an employee confidentiality agreement, a contractor or consultant agreement, a visitor or guest agreement, and a mutual non-disclosure agreement for partners and prospects. For each type, write the trigger that requires it, such as first access to a protected category, the start of a project or the beginning of pre-sales discussions. The output is a short standard that names each agreement type, its trigger and its owner, so that no one has to guess when an agreement applies.
Draft or update templates with legal review
Write or revise one template for each agreement type, covering the protected information, permitted use, duration of the obligation, return or destruction of material, and the consequences of breach. Ask qualified legal counsel to review the templates against the governing law of each jurisdiction where the organization operates, and record the review date and the version approved. The output is a versioned template set with an approval record, and the review should check that obligations continue after the relationship ends, which links to A.6.5.
Set the signing workflow for joiners and external parties
Build a repeatable signing step into onboarding for staff and into contract setup for external parties, so that no one receives access to a protected category before the relevant agreement is signed. Decide who collects signatures, where signed copies are stored and how exceptions are approved and tracked. The output is a documented workflow with named owners, a storage location for signed agreements and a rule that access requests are checked against signature status.
Confirm signatures for existing staff and parties
Check whether agreements already signed under earlier templates still cover the current information register, and ask people and external parties who lack a current agreement to sign the updated version. Record any party that refuses or cannot sign, and escalate those cases to the information owner for a decision on access. The output is a reconciled list showing each person or party, the agreement version they signed and the date, with open items assigned to someone.
Schedule regular review of agreements
Set a review cycle for the agreement templates and the information register, and name the owner who triggers each review and the owner who approves changes. Review also when the information register changes, when a new legal requirement applies or when a significant incident involves confidential information. The output is a review schedule, a dated review record for each template and a change log that shows what was amended and why.
Record the output of each step
Keep the register, agreement standard, templates, approval records, signing logs, reconciliation list and review records together in a location the internal audit or the certification body can access. Check that the records match one another, for example that every access grant traces to a signed agreement version. The output is a complete evidence set that an assessor can sample for personnel and external parties, which is the proof that A.6.6 operates rather than exists only on paper.

How auditors pick the samples that prove signatures happened

An auditor testing A.6.6 starts from a population, not from a handful of agreements the organization chooses to show. The population is every person and third party who received access to protected information in the period under review, pulled from HR records, contractor and vendor registers and the access lists of the systems that hold sensitive data. The auditor then selects a sample from that population and asks for the signed agreement that matches each selected person or party, along with the date it was signed. Sample size is a judgment the auditor makes and documents, so the organization should ask its certification body to explain the approach before fieldwork rather than assume a figure.

The comparison that matters most is between the population and the access list. Auditors check whether everyone who can reach confidential data appears in the HR or contract records at all, because a missing name usually means an agreement was never requested. They then compare the signing date with the date the account was provisioned. An agreement signed after system access was granted is typically recorded as a nonconformity, since the protection the agreement is meant to provide did not exist when the access began. Confirm with your certification body how it treats a short gap, and fix the underlying sequencing so that the agreement is a precondition of provisioning.

Before the audit, reconcile three sources yourself: the HR roster, the identity provider's account list for each in-scope system, and the register of supplier and contractor agreements. Any account without a matching signed record, and any signed record dated later than its account creation, should be investigated and either corrected with evidence or documented as a known gap with a remediation date. Keeping the signature workflow inside the same self-hosted identity and HR tooling you already run makes these dates traceable, which is the kind of evidence an assessor can test directly.

Evidence that satisfies A.6.6 and how to keep it current

An auditor testing A.6.6 looks for a chain of records: which agreements the organization decided it needs, the current template behind each one, and a signature from every person or party it covers. The cards below cover each artifact and the routine that keeps it accurate between audits, so the evidence reflects today's workforce rather than the last sample.

Agreement register

The register lists every confidentiality or non-disclosure agreement the organization uses, with its purpose, the audience it applies to (employees, contractors, temporary staff, visitors, suppliers), the template version, the owner and the date of the last review. It is the first document an auditor asks for because it shows the organization decided which agreements it needs. Check that the register matches what is actually in use, not only what policy says should be in use.

Versioned NDA templates

Each template should carry a version number, an effective date and a change history that explains why wording changed, such as new information types, a change in local law or a new class of third party. Keep superseded versions for as long as they were in use, so an auditor can match an old signature to the wording the signer actually accepted. Ask counsel to confirm that templates reflect the organization's protection needs and local employment law.

Signed copies linked to identities

A signed copy only proves something when it is tied to a named person or party, a template version and a date. Store signatures in the HR or identity system of record with the employee or contractor ID, not in an unindexed shared folder. Record electronic signature tooling and its audit trail where used. An auditor will sample individuals and compare their signed agreement against the active template at the time of signature, so gaps here are the most common finding.

Third-party agreement records

Contractors, consultants, auditors, implementation partners and other external parties who can reach confidential information need agreements of their own, often inside a master contract or statement of work. Record which party signed, which scope and data classes it covers, and where the signed document is held. Link these records to the supplier list used for A.5.20, so that a party added to a project without a signed agreement shows up as a gap rather than going unnoticed.

Review minutes and change logs

Regular review of the agreement set needs a dated record: who reviewed it, what they checked, which changes were approved and why. Minutes from the security or compliance forum, combined with a change log against each template, show that review is an operating routine rather than a one-time exercise. Confirm the review cadence is written down and that the minutes show decisions, not only attendance.

Onboarding and offboarding triggers

The most reliable way to keep signatures current is to make them a gate in existing workflows. The joiner process should not grant system access until the agreement is signed, and the leaver process should check that the agreement and any surviving confidentiality obligations were acknowledged at exit. Run a periodic reconciliation between the HR roster and the signature records, and treat any active person without a signed agreement as an exception with a named owner and a due date.

What meeting A.6.6 costs in money and effort

This table breaks down the cost and effort of meeting A.6.6 into components, showing who is paid for each, whether it is one-time or recurring, and what moves it up or down. Use it to scope internal work against outside help and to frame questions for a quote. No price or duration is stated because none is supplied for this control.

Cost component	Who carries it	One-time or recurring	What drives it up or down
Legal drafting of the NDA templates	External counsel, or in-house legal if available	One-time, with revisions on change	Number of distinct agreement types, such as employee, contractor, candidate and partner templates
Legal review of changed or negotiated agreements	External counsel on a case-by-case basis	Recurring, as counterparties push back	Volume of third-party deals and how many standard terms are accepted without edits
Agreement register and document management	Internal team; tooling may be licensed or self-hosted	Setup one-time, upkeep recurring	Choice of a commercial GRC or document system versus a self-hosted open-source tool; number of signatories
HR and procurement time to collect signatures	Internal HR, onboarding and procurement staff	Recurring with every hire, contractor and supplier	Whether signing is built into onboarding and contract workflows or handled by hand
Periodic review of the agreement set	Internal control owner, with legal input when terms change	Recurring at the review interval the organization sets	Frequency of review, how often information types or regulations change, and the number of templates
Evidence upkeep	Internal compliance or security staff	Recurring	Whether signed records are stored centrally and linked to user identities, or scattered across mailboxes and folders
Auditor sampling and follow-up	Independent certification body fee, plus internal staff time to produce records	Recurring at each surveillance or recertification audit	Size of the population sampled, how quickly records can be produced, and gaps found in earlier audits
Self-hosted open-source platform	Internal platform team or an implementation partner for setup	Setup one-time, hosting and maintenance recurring	Removes most per-seat license spend for the register; cost shifts to hosting, patching and staff time

Who owns A.6.6, who can help, and where auditor independence stops

Your organization owns A.6.6 in full. The control asks you to decide which confidentiality or non-disclosure agreements reflect what you must protect, to keep them current, and to make sure personnel and relevant interested parties sign them. No outside party can make those decisions or sign on your behalf, and an auditor will look for named owners and dated approvals, not for a particular template.

Deciding which agreements are needed: Set the criteria for who signs what, such as employees, contractors, temporary staff, visitors and third-party engineers, based on the information each group can reach.
Approving the wording: Your legal counsel or in-house lawyers approve the agreement text. Record who approved each version and when.
Collecting signatures: Track signed copies for every person and party in scope, including the date and the version signed.
Running regular reviews: Schedule reviews, record the outcome and update agreements when roles, data types or contracts change.
Keeping the register: Maintain the list of agreements, owners and review dates that an auditor will sample.

Before you start, confirm which of these steps your legal and HR functions already perform so you do not duplicate or leave gaps.

Common gaps that fail A.6.6 and how to close them

Auditors who test A.6.6 usually find the same weaknesses: people who never signed, agreements that do not match what is protected, and no scheduled review. Each card below pairs one gap with a fix the organization can run and evidence it can show. The owner of each fix is the organization, with any implementation partner preparing the records and workflows.

Contractors who never signed

Contractors, temporary staff and visiting engineers often get system access before anyone collects an agreement. Check your access provisioning records against your signed agreement register and list every account holder without a matching signature. Make a signed agreement a precondition for issuing credentials, and make the register the source for the sample an auditor will draw. Include third-party staff working through supplier contracts, not only people on your payroll.

Agreements not tied to protected information

A generic confidentiality clause in an employment contract may not cover the source code, customer data or deal files a person actually handles. Map each information class in your classification scheme to the agreement that covers it, and confirm that roles with access to restricted information sign the stricter version. For example, an engineer with production database access should sign an agreement that names those systems and data types, not only a general staff clause.

No scheduled review cycle

An agreement written years ago may not reflect new products, new data flows or new regulatory duties. Assign an owner, usually legal with the information security function, and set a review trigger tied to events such as a change in the classification scheme, a new service line or an incident. Record each review with its date, the reviewer and any changes made, so the auditor can see that the agreements were regularly reviewed rather than only drafted once.

Signatures stored in email

Signed PDFs sitting in inboxes cannot be retrieved reliably, cannot be matched to a current role and are easy to lose when staff leave. Hold signed agreements in a central repository with restricted access, indexed by person, version and date. Store the version text that was signed, not only the signature page, so you can prove which wording applied. Keep the repository under the same retention and access rules you apply to other HR records.

Version drift without re-signing

When an agreement changes, staff who signed the old version may still be bound to it, and the organization may have no proof they accepted the new one. Decide in advance whether a material change requires re-signature, then track acceptance of each new version against the active roster. Flag anyone who has not accepted within the period you set, and escalate through line management and access restrictions if they do not respond.

Checklist with no link to offboarding

Confidentiality duties often continue after someone leaves, but offboarding checklists rarely mention the agreement. Add a step to the leaver and role-change procedure that confirms the agreement remains in force and that the person has returned or destroyed protected information. Keep the completed checklist with the agreement record so the two can be sampled together, linking this control to A.6.5.

Questions buyers ask about A.6.6 cost, effort and outside help

How much effort does A.6.6 take to implement?

A.6.6 is a documentation and records control, so the effort is mostly in deciding which agreements the organization needs, drafting or updating them, and collecting signatures. The main drivers are how many roles touch sensitive information, how many external parties need access, and whether agreements already exist in HR or procurement files. Expect the first pass to take longest, because it requires mapping information types to who needs to sign what. After that, the recurring work is a scheduled review and signature tracking for new joiners, contractors and third parties. Ask any partner to break its estimate into mapping, drafting, collection and ongoing review so you can see where your own team's time goes.

Can a small team handle A.6.6 in-house?

Yes, in most cases a small team can run A.6.6 in-house, provided someone owns the register of agreements and the review schedule. The work is administrative rather than technical, so it fits well with HR, legal or operations staff. A small team usually struggles with consistency: agreements drift when templates are copied without review, and contractors slip through when onboarding is informal. Those gaps are what an auditor samples. Keep one template per agreement type, a single list of who signed what, and a calendar entry for each review. Outside help is most useful for legal drafting, which the organization should confirm with qualified counsel.

What does an implementation partner need from our organization?

A partner needs access to the people and documents that define your obligations, because it cannot decide on your behalf which information must be protected. In practice that means the current NDA and confidentiality templates, employment and contractor onboarding records, supplier and customer contracts that include confidentiality terms, and a list of roles that handle sensitive data. The partner also needs a named owner in your organization who approves the agreement set and signs off on reviews. Ask the partner to state in writing which inputs it expects from you and which decisions stay with your management, so the scope and timeline are agreed before work starts.

How long does A.6.6 work take?

The timeline depends on how many agreement types exist, how many people and third parties must sign, and how quickly your legal and HR reviewers respond. No duration is supplied for this control, so treat any figure you hear as a estimate to be tested against your own environment. Ask a partner for a fixed-scope plan with milestones for mapping, drafting, approval and signature collection, and confirm which dependencies sit with your legal team. Remember that the control is ongoing: once the first set is signed, regular review and signature for new starters continue for as long as the management system operates.

Do NDAs alone satisfy A.6.6?

No. A.6.6 asks the organization to identify the agreements it needs for the information it must protect, review them regularly and have the relevant people and parties sign them. A single generic NDA signed at hiring does not show that the agreements reflect actual needs. An auditor will look for a documented decision on which agreements are required, evidence that each relevant person or party signed the right one, and proof that the set was reviewed as information, roles or suppliers changed. NDAs are one component. Confidentiality terms in employment contracts, supplier agreements and access agreements often carry the rest of the requirement.

How does A.6.6 relate to A.6.2 and A.6.5?

A.6.6 sits alongside two closely related controls. A.6.2 covers terms and conditions of employment, including the information security responsibilities written into staff contracts, so confidentiality clauses in those contracts can help meet A.6.6 for employees. A.6.5 covers responsibilities that continue after termination or change of employment, which is where confidentiality obligations must survive a leaver. A practical approach is to keep one register that links each person or party to the agreement they signed, the duties that continue after exit, and the review date. Auditors often sample across all three controls at once, so consistent records make each test easier to pass.

What should we ask for in a quote for A.6.6 help?

Ask for a written scope that lists the agreement types in scope, the parties who must sign, the deliverables and the review cycle. A useful quote separates one-time work, such as mapping and drafting, from recurring work, such as reviews and signature tracking for new joiners and suppliers. Confirm who drafts legal text and who approves it, because a partner preparing evidence is not a substitute for your counsel. Ask how changes in scope are priced, which records the partner will hand over, and what your team must provide and approve. Also confirm that the partner does not issue audit reports or certificates, since only an independent auditor or certification body does that.

How DeployOpen prepares A.6.6 evidence for your assessment

DeployOpen prepares the evidence for A.6.6 inside your own systems, under a scope agreed in writing before work starts. The organization keeps ownership of its controls: it decides which agreements are needed, approves the wording and accepts the risk. DeployOpen's role is to build the working parts around those decisions, such as a register of required agreements, a signing workflow that records who signed what and when, and a folder structure that lets an assessor sample agreements without rework. The written scope should name the systems involved, for example the HR platform, the identity provider, and any self-hosted document signing tool, along with the staff groups and external parties in scope. Ask for the deliverables list in writing, including whom each artifact is handed to and in what format.

The register is the core artifact. It should list each agreement type (employee, contractor, temporary staff, visitor, and third party with access to information), the information classes it protects, the owner who reviews it, the review interval the organization has set, and the date of the last review. DeployOpen can configure the register and the signing workflow in the client's environment, and can set up reminders for periodic review. Whether an agreement must be signed before access is granted, and how exceptions are recorded, are decisions only the organization can make. Confirm them with your legal counsel and HR lead before configuration begins, because an assessor will test the register against what the organization says it does.

Readiness support is where most preparation effort goes. DeployOpen can run a sampling exercise against the register, check that signed records exist for each sampled person and party, and identify gaps such as missing signatures, expired agreements or staff whose role changed without a new agreement being issued. Only an independent auditor or certification body can assess conformity and issue a report or certificate. DeployOpen does not issue audit reports, attestations or certifications. Ask any partner to explain how its readiness findings are kept separate from the independent assessment, and confirm with your certification body which evidence formats it accepts before the evidence is produced.

A.6.6 Confidentiality or non-disclosure agreements