Annex A Controls Explained
ISO 27001 Control 6.6: Confidentiality or Non-Disclosure Agreements
ISO 27001 Control 6.6 asks for confidentiality agreements with everyone who needs one. NDAs are a good control, but only if they are signed before the information is shared.
Last Updated: 3 November 2026
Alan Parker, ISO 27001 Consultant & Internal Auditor,
Helping UK SMEs hit ISO 27001 in 90 days.
B.Sc (Hons) Information Systems · Certified ISO 27001 Lead Auditor · CISMP · ITIL Expert · 30+ years in IT governance and security.
Read full bio →
ISO 27001 Control 6.6: Confidentiality or Non-Disclosure Agreements
https://www.iso.org/standard/27001
Confidentiality or non-disclosure agreements reflecting the organization’s needs for the protection of information shall be identified, documented, regularly reviewed and signed by personnel and other relevant interested parties.
Key Takeaways
- Control 6.6 asks you to identify who needs a confidentiality agreement, and to document, sign and review them.
- For employees, the contract’s confidentiality clause usually covers it.
- The gaps are contractors, consultants, auditors and other third parties.
- An NDA signed after the information has gone is paperwork, not protection.
- Attach the NDA step to the moments that trigger disclosure, such as onboarding a contractor.
- Keep a register, and remind people of their obligations when the relationship ends.
Table of Contents
Introduction
In short: ISO 27001 control 6.6, confidentiality or non-disclosure agreements, requires agreements that protect your information to be identified, signed and reviewed. For a small business that means confidentiality terms for every employee, contractor and relevant third party, and a record showing who has signed what.
Non-disclosure agreements are a good control, if they are actually used. Too often they do not get thought about at all until after the information has already gone.
On a recent audit, the company I was auditing sent me a large amount of sensitive information as pre-reading before the audit. Nobody had sent me an NDA. In the end it was me, the auditor, who had to ask them for one. That is not a criticism of the people involved; they were busy and focused on the audit. It is a perfect example of how easily this control is missed, even by organisations that are about to be audited on it.
Control 6.6 asks you to identify where confidentiality agreements are needed, put them in place, and keep them under review. This page covers how to do that without generating paperwork nobody revisits. The free screening and onboarding checklist further down includes an NDA register.
What control 6.6 actually asks for
The control requires confidentiality or non-disclosure agreements, reflecting the organisation’s needs for protecting information, to be identified, documented, regularly reviewed and signed by personnel and other relevant interested parties. In practice:
- Identify who needs one. Staff, and anyone else who will see confidential information.
- Use the right terms. What counts as confidential, how it must be handled, how long the obligation lasts, what happens at the end, and what happens if it is breached.
- Get them signed before disclosure. The timing is everything.
- Keep a record. Who has signed what, and when.
- Review them. The templates, when your needs change, and the register, so nothing lapses.
In the 2013 edition this was control A.13.2.4. In 2022 it moved into the people controls, which reflects how it is actually used.
Who needs one
For employees, the confidentiality clause in the employment contract usually does the job, as covered under control 6.2. The gaps are almost always elsewhere.
| Who | Usually covered by | Often missed? |
|---|---|---|
| Employees | Confidentiality clause in the employment contract | Rarely |
| Contractors and freelancers | Clause in their engagement agreement, or a separate NDA | Often |
| Suppliers with access | Confidentiality terms in the supplier contract (control 5.20) | Sometimes |
| Auditors and consultants | Their own terms, or a separate NDA | Often |
| Prospective partners, investors, acquirers | A mutual NDA before sharing anything sensitive | Sometimes |
| Work experience, interns, volunteers | A short confidentiality agreement | Very often |
The test is simple: will this person or organisation see information you would not want shared? If yes, check that something binding covers it before they see it.
Before, not after
The value of an NDA is almost entirely in its timing. Signed before disclosure, it sets expectations and gives you a remedy if they are not met. Signed afterwards, it is much weaker, and in practice it rarely gets signed at all once the information has already gone.
The fix is to attach NDAs to the moments that trigger disclosure: onboarding a contractor, engaging an auditor or consultant, starting due diligence with a partner, giving a supplier access. Put the NDA step into each of those processes, so it happens automatically rather than relying on someone remembering.
What a useful NDA contains
You do not need a long document. For most purposes a short agreement covers:
- What information is confidential, in terms the other party can understand.
- What they may and may not do with it, and who they may share it with.
- How long the obligation lasts, including after the relationship ends.
- Return or destruction of information at the end.
- What happens if it is breached.
- Any exceptions, such as information already public or legally required to be disclosed.
Keep one or two templates, a one-way version and a mutual version, reviewed by a lawyer once and then used consistently. Acas guidance on NDAs is a useful reminder that confidentiality agreements with staff cannot be used to stop people reporting wrongdoing or making disclosures protected by law, so make sure your templates do not try to.
Making it real, not paperwork
An NDA nobody remembers exists is a weak control. Three things make it a strong one:
- A register. Who has signed what, when, and when it expires or should be reviewed. The register tells you instantly whether a new contact is covered.
- A reminder at the end. When someone leaves or an engagement ends, remind them of their continuing obligations, under control 6.5.
- Handling that matches. If you share information under an NDA, share it securely, under control 5.14. An NDA does not make an unencrypted email attachment any safer.
Screening and Onboarding Checklist Download
For this control, the NDA register is the one to keep current: every employee, contractor and third party, and the date each signed.
What auditors will look for
I ask for signed agreements for a sample of staff and, especially, contractors.
- Your templates. Do they reflect what you need to protect, and when were they last reviewed?
- Who needs one. Have you identified the groups that need agreements, beyond employees?
- The register. Can you show who has signed what?
- Timing. For a sample of contractors or third parties, was the agreement signed before they received information?
- Me. Did you send me an NDA before sending me your documents? It is surprising how often the answer tells me what I need to know.
Common issues
- NDAs signed after information has been shared, or not at all.
- Contractors, freelancers and consultants with no confidentiality agreement.
- No register, so nobody knows who is covered.
- Templates that have never been reviewed, or that try to prevent protected disclosures.
- Information shared under NDA by insecure means.
- No reminder of continuing obligations when someone leaves.
The self-check
Start with your contractors; that is where the gaps usually are.
- Which of your current contractors and consultants have signed a confidentiality agreement?
- When you last sent sensitive information to a third party, was an NDA in place first?
- Where is your NDA template, and when was it last reviewed?
- Would you send your auditor an NDA before sending them your documents?
- Who reminds people of their confidentiality obligations when they leave?
The contractors nobody had asked to sign
In an audit within the last few months, a client could not produce signed confidentiality agreements for any of its contractors. The developers were engaged through an overseas part of the business and largely left to get on with it. Nobody in the UK had taken ownership of what they had signed, if anything. It was a textbook case of arm’s-length management: the work had been delegated, and so, by accident, had the responsibility.
The fix is simple. Keep a register of everyone with access to confidential information, employee or not, with the date each signed a confidentiality agreement, and check it as part of onboarding.
It is not an isolated case. Of the roughly 30 organisations I have audited or implemented ISO 27001 for since 2024, only around three in ten could produce signed confidentiality agreements for all their contractors when asked (see my findings). And I can usually tell before I ask: if I am not sent an NDA before I start work as their auditor, it is incredibly telling about how they handle everyone else.
How control 6.6 links to other clauses and controls
- Control 6.2, Terms and conditions of employment. The employee confidentiality clause usually lives here.
- Control 6.5, Responsibilities after termination or change of employment. Confidentiality continues after people leave.
- Control 5.20, Addressing information security within supplier agreements. Confidentiality terms for suppliers.
- Control 5.14, Information transfer. How information is shared once an NDA is in place.
- Control 5.12, Classification of information. Defines what counts as confidential.
Frequently asked questions
Do employees need a separate NDA for ISO 27001?
Usually not. A confidentiality clause in the employment contract is normally enough. Separate NDAs matter most for contractors, consultants and other third parties.
Should auditors sign an NDA?
If they will see confidential information and are not already bound by confidentiality terms, yes. Many audit firms include confidentiality in their own terms; check before sending documents.
How often should NDAs be reviewed?
Review the templates when your needs change or at least every few years, and keep the register current as people and suppliers come and go.
Can an NDA stop someone reporting wrongdoing?
No. Confidentiality agreements cannot prevent protected disclosures such as whistleblowing or reporting to the police or a regulator. Make sure your templates do not try to.
Sources and further reading
Official legislation, standards and guidance referred to on this page.
- ISO/IEC 27002:2022. The implementation guidance that accompanies the controls.
- Using non-disclosure agreements. Acas guidance on confidentiality agreements and their limits.
- ISO/IEC 27001:2022, Information security management systems. The standard itself, published by ISO.
Internal Audit Service
Get an independent view of your ISO 27001 ISMS before you go into an audit.
“Alan from Iseo Blue truly came to our rescue. His support ahead of our internal audit was outstanding, and he helped us get our ISMS 100% ready for the Phase 2 audit.“
– Quartile.
✓ Gain confidence
✓ Audit plan
✓ Independent view
✓ An ISO 27001 requirement
✓ Audit findings report
✓ Recommendations
✓ Review meeting
✓ Fixed price
