ISO 27001 Confidentiality Agreements: Complete 2026 Guide

ISO 27001 confidentiality agreements sit in Annex A control 6.6, and they are the control most organisations think they have already passed because a signed NDA is sitting in a drawer somewhere. The control asks for four things, and owning a template satisfies none of them on its own.

Control 6.6 is one of only eight people controls in ISO/IEC 27001:2022 — a short list next to the 37 organizational, 14 physical and 34 technological controls that make up the 93 in Annex A. Being short does not make it soft. ISO 27001 confidentiality agreements are among the easiest controls for an auditor to open a file on. The evidence either exists with a signature and a date on it, or it does not.

What ISO 27001 confidentiality agreements actually require

Control 6.6 is a preventive control, and its requirement reduces to four verbs. Agreements reflecting the organisation’s own needs for protecting information must be identified, documented, regularly reviewed and signed by personnel and other relevant interested parties.

Read that as four separate tests, because that is how ISO 27001 confidentiality agreements get audited:

Verb	What it means in practice	Typical evidence
Identified	You have worked out which relationships need an agreement and what information each one exposes	A list or register of agreement types mapped to populations
Documented	The terms exist in writing, not as an understanding	The agreement text itself, version-controlled
Regularly reviewed	Someone owns the wording and revisits it	Review dates, change history, approver
Signed	The specific individual or entity has accepted it	Signed copies and a record of who signed what, when

The gap in most management systems is the first and the third. Organisations have a document and they have signatures, but nobody has ever asked which relationships ought to be covered, and the wording has not been looked at since it was drafted.

One point of history worth knowing: this control is not new in 2022. It maps from control A.13.2.4 in the 2013 edition, where it sat under Communications Security. The 2022 restructure moved it into the people theme. The obligation did not change — its filing cabinet did. If your Statement of Applicability still cites 13.2.4, you are on a withdrawn edition; the transition window for 2013 certificates closed on 31 October 2025.

Who has to sign: personnel and other relevant interested parties

The phrase “other relevant interested parties” is the part people underestimate, and it is what makes ISO 27001 confidentiality agreements broader than an HR formality. It reaches well past the payroll, and an auditor who wants to find a gap in ten minutes will start here.

Population	Usual vehicle	Trigger point
Employees	Confidentiality clause in the employment contract	Before the first day
Contractors and temporary staff	Standalone agreement, or a clause in the engagement contract	Before system access is granted
Suppliers and service providers	Confidentiality terms inside the master services agreement	At contract signature, before data is shared
Outsourced and offshore teams	Agreement with the supplying entity, plus individual acknowledgements where named staff are identifiable	At onboarding of each named individual
Job candidates	Mutual NDA where the interview exposes internal detail	Before a technical or on-site stage
Prospective buyers, investors, auditors	Mutual NDA covering the diligence or audit scope	Before the data room opens
Visitors to sensitive sites	Short visitor undertaking at reception	On arrival

You do not need every row. You need to have decided, deliberately, which rows apply to you and to be able to say why the others do not. That decision is the “identified” test, and it is the one that produces a finding when it has never happened.

What goes inside ISO 27001 confidentiality agreements

ISO 27002 — the guidance companion to the requirements standard — sets out the topics worth covering when drafting. Paraphrased, the drafting checklist looks like this:

#	Element	Why it bites
1	A definition of the information being protected	A vague definition is unenforceable and tells staff nothing
2	How long the obligation lasts	Trade secrets usually need an indefinite term; fixed terms quietly expire
3	What happens when the relationship ends	The duty must survive termination or it is close to worthless
4	Each signatory’s responsibilities	Handling rules, not just a promise not to tell
5	Ownership of information, IP and trade secrets	Decides who owns work product and derived material
6	Permitted use	Limits the purpose; stops “I was allowed to have it” becoming “I was allowed to use it”
7	A right to audit or monitor	Without it you cannot verify a supplier’s handling
8	Breach notification	Sets a route and a clock for telling you
9	Return or destruction at the end	The clause that actually gets your data back
10	Consequences of breach, and governing law	Enforceability is jurisdictional; this is where it is won or lost

Two drafting cautions. First, an obligation period so long that a court would not enforce it is worse than a shorter one that holds. Second, leaving out the standard carve-outs — information already public, independently developed, or compelled by law — invites a dispute you will lose. Enforceability varies by jurisdiction, so have a lawyer review the wording; ISO 27001 confidentiality agreements are security artefacts and legal instruments at the same time, and the standard does not pretend to settle the legal half.

Employment contract clause or standalone NDA?

Both forms of ISO 27001 confidentiality agreements satisfy control 6.6. The choice is operational, not a compliance question, and the honest answer is that most organisations need both.

	Clause in the employment contract	Standalone NDA
Best for	Permanent employees	Contractors, suppliers, candidates, diligence
Signature capture	Automatic at hire	Needs its own process and chasing
Changing the wording	Hard — a contract variation	Easy — issue the new version to new signatories
Evidence for an auditor	HR file; be ready to show the clause, not just the contract	Signed PDF plus register entry
Risk	Wording ages and is expensive to refresh	Gaps where nobody chased the signature

If confidentiality lives inside your employment contract, note that this also touches control 6.2, terms and conditions of employment. Two controls, one piece of paper, and that is fine — provided your Statement of Applicability explains it rather than leaving an auditor to guess.

How auditors test ISO 27001 confidentiality agreements

Certification auditors sample. They will not read your template cover to cover; they will pick names and ask for paper. Five requests cover ISO 27001 confidentiality agreements almost every time:

• A recent joiner. Show the signed clause or agreement, dated before their access was provisioned.
• A current contractor. This is where it usually breaks — the contractor signed with their agency, and you cannot produce anything naming the individual.
• A supplier handling personal or classified data. They will want the confidentiality terms in the contract, not an assurance that “it is in the MSA somewhere”.
• Your review record. When was the wording last looked at, by whom, and what changed?
• A leaver. Was the ongoing duty pointed out at exit, and is there a record of it? Our guide to ISO 27001 offboarding covers how that evidence is usually assembled.

Worth being precise about one thing: a confidentiality agreement is not on the list of documented information ISO 27001 demands in clause 7.5. The mandatory artefact is the Statement of Applicability under clause 6.1.3. But the moment your SoA marks 6.6 applicable, you have committed to the control, and the signed agreements become the evidence that commitment is real. If you want the actual clause-7.5 list, see our ISO 27001 mandatory documents checklist.

Reviewing ISO 27001 confidentiality agreements: how often is “regularly”?

ISO/IEC 27001:2022 specifies no review interval. Not in control 6.6, not anywhere. “Regularly” is the whole instruction. Annual review is a widely used convention and a defensible one — it is not a requirement, and you should never present it to an auditor as though the standard said so.

What works better than a calendar is a short list of triggers that force a review regardless of the date:

• A change in the law that touches confidentiality, trade secrets or data protection in a market you operate in
• A new category of information — a first acquisition of health data, payment data or source code from a client
• Entry into a new jurisdiction, where enforceability assumptions may not hold
• A breach or near miss where the agreement was tested and found thin
• A material change to your ISMS scope or to the supplier base

Write the trigger list down. A review policy of “annually, or on any of these five events” is far stronger evidence of a managed control than a date in a spreadsheet.

Five mistakes that turn control 6.6 into a finding

1. One generic NDA for everyone. A document written for employees rarely contains the audit rights, return-of-data and breach-notification terms a supplier relationship needs. Differentiate by role and risk. Supplier-side terms belong in your wider third-party process — see ISO 27001 supplier assessment.
2. Template without signatures. The most common finding. You own a policy; you cannot produce the signed copies.
3. Contractors covered only through the agency. Where named individuals have system access, auditors expect something that reaches the individual.
4. No record of who signed what version. If the wording changed in 2024, which of your staff are on the old terms? A register answers that in seconds.
5. Obligations that die with the contract. If the duty does not survive termination, the control fails exactly when it matters.

None of these are difficult to fix, and none require legal spend beyond a review. All of them are things ISO 27001 confidentiality agreements fail on in real audits, and all five are cheaper to fix before an audit than during one.

Frequently asked questions

Are ISO 27001 confidentiality agreements a mandatory document?

No. Clause 7.5 lists the documented information ISO 27001 requires, and confidentiality agreements are not on it. They become required evidence the moment you mark control 6.6 applicable in your Statement of Applicability, which under clause 6.1.3 is itself mandatory.

How often must ISO 27001 confidentiality agreements be reviewed?

No interval is stated anywhere in the standard. The control says agreements must be regularly reviewed and leaves “regularly” to you. Annual is common practice, not a requirement — define your own cycle and add event-based triggers.

Can a confidentiality clause in the employment contract satisfy control 6.6?

Yes, for employees. It has to be identifiable as a confidentiality undertaking, signed, and subject to the same review discipline as a standalone agreement. Keep in mind you will still need separate coverage for contractors, suppliers and anyone else outside the payroll.

Do job candidates and visitors really need to sign something?

Only where the relationship exposes information you have decided needs protecting. The control’s test is whether you identified the requirement deliberately. A candidate shown production systems in a technical interview is a reasonable case; a candidate in a 30-minute screening call usually is not.

What changed between A.13.2.4 and control 6.6?

The substance did not change. The 2022 edition moved the control from Communications Security into the people theme and renumbered it. If your documentation still references A.13.2.4, update it — the 2013 edition is withdrawn and its certificates expired on 31 October 2025.

Getting the paperwork right

ISO 27001 confidentiality agreements reward tidiness more than sophistication. Decide which relationships need an agreement, write terms that fit each one, capture the signature before access is granted, and keep a register that tells you who is on which version. Done that way, ISO 27001 confidentiality agreements take an afternoon to design and a few minutes a month to maintain.

If you would rather start from drafted wording than a blank page, our ISO 27001 Toolkit includes a standard NDA template alongside the Statement of Applicability and the rest of the Annex A document set — 165 templates in Microsoft Office format, written to the 2022 edition. For the full picture of how control 6.6 fits beside the other 92, start with our guide to the ISO 27001 Annex A controls, and check the current edition details on the official ISO/IEC 27001 catalogue page.