Key takeaways
- Employment contracts should state security responsibilities.
- Contracts make security obligations clear and enforceable from day one.
- Start here: include security and confidentiality responsibilities in employment contracts.
Purpose
Employment contracts should state security responsibilities.
Requirement
Requirement summaryThe employment contractual agreements shall state the personnel’s and the organization’s responsibilities for information security.
Why it matters
Contracts make security obligations clear and enforceable from day one.
How to implement
- Include security and confidentiality responsibilities in employment contracts.
- Reference key policies and consequences of breaches.
- Cover duties that continue after employment ends.
- Have every hire sign before access is granted.
What evidence you need to provide
Here is what you will typically need to provide for Annex A 6.2. It does not matter which system it lives in: a document, screenshot or export is fine.
Documents to have ready
- Your employment contract and contractor agreement templates, including security and confidentiality terms.
- Your Statement of Applicability (SoA: the list of all 93 controls showing which you use and why) with A.6.2 marked as used or not used, a short reason, and its current status.
Records and examples to show
- Signed contracts for a few recent starters and contractors.
- Proof contract terms are updated when policies change.
Things you should be able to show or explain
- HR should be able to explain how contract terms are kept current.
How much to show: A handful of employees and contractors.
Common mistakes
- Contracts with no security terms.
- Unsigned contracts.
- Old contracts with no security clauses for long-serving staff.
- Contractors missed out.
- Tip: Add a security clause to your standard contract.
Policies & documents to have
- Human Resource Security Policy
- Information Security Policy
- Information Security Roles and Responsibilities Policy
- Code of Conduct
FAQ
Is A.6.2 mandatory?
Annex A controls are not automatically mandatory. You must consider every control and record in your Statement of Applicability whether it applies and why. In practice, most organisations include this one.
What will I need to show for A.6.2?
Be ready to explain how the control works in your organisation and to provide things like: Your employment contract and contractor agreement templates, including security and confidentiality terms…