ISO 27001 A.6.2: Terms and conditions of employment

Work with HR and legal to review and update your employment contracts and engagement agreements with proper information security clauses. Make sure the clauses are enforceable in your jurisdiction. Key clauses to include: obligation to comply with information security policies and procedures, acknowledgment of responsibility for protecting organisational information and assets, specific confidentiality obligations covering company data, client data, and trade secrets, a prohibition on disclosing or misusing information obtained during employment, intellectual property assignment for work-related creations, obligation to report security incidents and policy violations, agreement to return all organisational assets on termination, and consequences for security policy violations. Put a separate confidentiality or non-disclosure agreement (NDA) in place that extends beyond the employment period. Define how long post-employment confidentiality lasts - typically 2-5 years, or indefinitely for trade secrets. Make sure it covers all types of confidential information the person may encounter. For contractors and third-party personnel, include equivalent security clauses in service agreements or require separate confidentiality agreements. Ensure staffing agencies include appropriate security terms in their own agreements with the people they provide. Get signed agreements before granting access to information and systems. Maintain a register tracking all signed agreements and chase up any gaps. When agreements are updated, get personnel to review and re-sign. Include security responsibilities in job descriptions to reinforce the contractual obligations. Review agreements periodically to keep them aligned with current policies and legal requirements.