ISO 27001 Control 6.2: Terms and Conditions of Employment

Alan Parker, ISO 27001 Consultant & Internal Auditor,
Helping UK SMEs hit ISO 27001 in 90 days.
B.Sc (Hons) Information Systems · Certified ISO 27001 Lead Auditor · CISMP · ITIL Expert · 30+ years in IT governance and security.
Read full bio →

Introduction

In short: ISO 27001 control 6.2, terms and conditions of employment, requires employment contracts to state the employee’s and the organisation’s information security responsibilities. In practice that means confidentiality, data protection and compliance with your policies written into the contract or handbook, and agreed by each employee.

Almost every employment contract I see has something about confidentiality in it. Very few say anything specific about information security. The rest, if it exists at all, sits in the employee handbook.

That arrangement can work perfectly well. But it only works if the contract connects the two: if it says, in terms, that staff must follow the company’s policies, including its information security policies, and that those policies can be updated. Without that link, your carefully written ISMS policies may not bind anyone.

Control 6.2 asks that employment agreements state the responsibilities of both the employee and the organisation for information security. This page covers how to do that without rewriting every contract, and the screening and onboarding checklist further down includes the contract and policy acknowledgement steps.

What control 6.2 actually asks for

The control requires employment contractual agreements to state the personnel’s and the organisation’s responsibilities for information security. In practice that means the contract, or documents it incorporates, should cover:

• Confidentiality. Usually already there, and often the only thing that is.
• Compliance with information security policies. A clear obligation to follow them, as updated from time to time.
• Responsibilities for information and equipment. Handling the organisation’s information properly, and returning equipment and information when employment ends.
• Duties that continue after employment. Confidentiality in particular, which links to control 6.5.
• Consequences. That breaches may lead to the disciplinary process under control 6.4.
• The organisation’s side. How it will handle the employee’s own personal data, usually by reference to the staff privacy notice.

In the 2013 edition this was control A.7.1.2. It also applies to contractors and other people working for you, through their own agreements.

Contract or handbook?

The answer is both, with different jobs.

The contract should hold the obligations that do not change: confidentiality, the duty to follow policies, return of property and duties after leaving. The detail, such as which devices can be used or how to report an incident, belongs in the handbook and the ISMS policies, where it can be updated without reissuing contracts.

What makes this work is one sentence in the contract that says the employee must comply with the company’s policies and procedures, including information security policies, as amended from time to time. If your contracts already contain a general “comply with our policies” clause, you may need nothing more than to make sure the information security policies are clearly part of that set. Check with whoever drafts your contracts; the written statement of employment particulars rules set out what must be in writing, and an employment lawyer can confirm how your policies are incorporated.

The NDA that is already in the contract

Most contracts I see contain a confidentiality or non-disclosure clause. That is a good start, and it often satisfies part of control 6.6 as well. But a confidentiality clause is not the same as information security responsibilities. It tells people not to disclose information. It does not tell them to lock their screen, use MFA, report a suspicious email or keep client data off their personal phone.

That gap is why so much of this control ends up resting on the handbook and on training. The contract establishes the obligation; the policies and awareness training make it something people can actually follow.

Getting the policies acknowledged

An auditor will want evidence that each person has received and accepted the policies that apply to them. An acknowledgement record does that, whether it is a signed form, a tick in an HR system or a learning platform record.

But be careful how you collect it. The surest way to guarantee nobody reads your policies is to send them all at once, on a Monday morning, with a request to read and accept. People will tick the box. They will not engage with the content. Acknowledgement is evidence of receipt, not of understanding, and what you really want is compliance with the policies, not a full set of ticks.

Better: acknowledge the core policy at onboarding, introduce the rest over the first few weeks alongside training, and re-acknowledge only the policies that have materially changed.

What auditors will look for

This is usually one of the quickest controls to audit; these are the things I check.

1. The contract template. Does it mention information security, or at least require compliance with company policies that include information security?
2. A sample of signed contracts. Two or three recent starters, and one long-serving member of staff whose contract may predate the ISMS.
3. Contractors. Does the agreement for a contractor or freelancer contain equivalent terms?
4. Policy acknowledgement. Evidence that each person received the current information security policies.
5. Continuing duties. Does the contract say what continues after employment ends?

Common issues

• Contracts with a confidentiality clause and nothing else on information security.
• No contractual link to the information security policies, so they may not bind anyone.
• Older contracts that predate the ISMS and have never been updated or supplemented.
• Contractors on agreements with no security terms at all.
• All policies sent at once for acknowledgement, with no understanding behind the ticks.
• No record of which version of the policies each person accepted.

The self-check

Get a copy of your current contract template before you start.

• Does your contract template require staff to follow your information security policies?
• What do the contracts of your longest-serving staff say?
• Do your freelance and contractor agreements contain security terms?
• Can you show which version of the policies each member of staff has acknowledged?
• What does the contract say continues after someone leaves?

What I see in audits

This is one of the few controls I almost never raise a finding against. The employment contracts I see are consistently sound: they reference confidentiality, data protection and the company’s policies, and there is nearly always a documented disciplinary process alongside them. My job as an auditor is not to judge the legal drafting, only to confirm that the obligations exist and that people have agreed to them.

If I make one recommendation, it is about personal devices. More and more people use their own phones and laptops for work, and expect to. Make it explicit in the contract that company data must be removed from personal devices when someone leaves, and that the company may ask for confirmation. It can live in a separate policy, but putting it in the contract makes it unambiguous.

The numbers bear that out. Of the roughly 30 organisations I have audited or implemented ISO 27001 for since 2024, only around a quarter had anything in their contracts about removing company data from personal devices when someone leaves. Most had not considered data removal at all (see my findings).

A client asked me only recently whether to allow personal devices, and how they could make sure company data was removed when someone left. For Microsoft 365 businesses the tools already exist: Intune app protection policies keep company data inside managed apps and allow a selective wipe that removes only company data, leaving the person’s own files untouched. The contract clause gives you the right; the tooling gives you the means.

How control 6.2 links to other clauses and controls

• Control 6.1, Screening. Comes before the contract is signed.
• Control 6.3, Information security awareness, education and training. Makes the responsibilities in the contract understandable.
• Control 6.4, Disciplinary process. The consequence the contract refers to.
• Control 6.5, Responsibilities after termination or change of employment. The duties that continue.
• Control 6.6, Confidentiality or non-disclosure agreements. Often partly met by the contract’s confidentiality clause.
• Control 5.1, Policies for information security. The policies the contract should make binding.

Frequently asked questions

Sources and further reading

Official legislation, standards and guidance referred to on this page.

• ISO/IEC 27002:2022. The implementation guidance that accompanies the controls.
• How to wipe only corporate data from Intune-managed apps. Microsoft documentation on selective wipe for personal devices.
• Written statement of employment particulars. GOV.UK guidance on what must be in writing for employees.
• Employment Rights Act 1996. The law behind the written statement of particulars.
• Employment information. ICO guidance on handling workers’ personal data, relevant to the organisation’s side of the agreement.
• ISO/IEC 27001:2022, Information security management systems. The standard itself, published by ISO.

Internal Audit Service

Get an independent view of your ISO 27001 ISMS before you go into an audit.

“Alan from Iseo Blue truly came to our rescue. His support ahead of our internal audit was outstanding, and he helped us get our ISMS 100% ready for the Phase 2 audit.“

– Quartile.

✓ Gain confidence
✓ Audit plan
✓ Independent view
✓ An ISO 27001 requirement

✓ Audit findings report
✓ Recommendations
✓ Review meeting
✓ Fixed price

£2,500

+ VAT where applicable

View DetailsBook a discovery call