ISO 27001 A.6.2: Clarify Employment Security Responsibilities

What A.6.2 requires in practice

Annex A control 6.2 asks that the agreements which set out the terms of employment record what the organisation and the individual are each responsible for when it comes to information security. Two parts matter. First, both sides are named: the person has duties, and so does the employer. Second, the statement sits in the contractual arrangement itself, so it exists before the person starts handling information rather than being worked out later. In practice the outcome is that every new joiner can see, in the paperwork they agreed to, what is expected of them and what support they can expect back. The control applies to personnel as the standard defines them, which can include people engaged on contract terms other than permanent employment. The agreement does not need to reproduce every policy; it needs to state responsibilities clearly enough to point people to the rules that apply. The usual outputs are employment or engagement terms that carry the security responsibilities, and a way to show they were agreed.

Explain the responsibilities on both sides

Identify what the person must understand about protecting information, using assets, following applicable policies and reporting concerns. Relate the expectations to the role’s access and responsibilities. A person handling customer records needs to understand the relevant boundaries, not merely receive an abstract statement that security is important.

The organisation also has responsibilities. It must provide the direction, resources and support needed for people to fulfil their assigned duties. Avoid wording that appears to transfer every security risk to the employee while leaving unclear which approved methods, training or assistance the organisation will provide.

Keep contractual expectations aligned with actual policy. If a policy permits an authorised exception, the employment arrangement should not create an unexplained contradiction. Refer to controlled documents appropriately so that people can identify the requirements that apply to them.

Communicate before responsibility becomes active

Explain relevant security responsibilities during the engagement and onboarding process, before people receive consequential access or assignments. Give them a route to ask questions. A signature gathered after months of work cannot demonstrate that expectations were understood when the work began.

Use language and formats suitable for the audience. Legal terms may be necessary in the agreement, while practical induction explains what they mean in common situations. The two should reinforce each other. A person should know where to find the current rule and who can authorise a departure.

Why clear employment terms matter to the business

When security expectations are written into the terms people sign, a later dispute is far easier to resolve. A manager can point to what was agreed instead of arguing about what someone should have assumed. Customers also ask how staff are bound to protect their data, and a clear contractual answer supports tenders and due-diligence questionnaires. The employer side matters too: stating what the organisation will provide, such as training and approved tools, reduces the risk that a fair-minded reviewer treats the arrangement as one-sided. At audit, this is one of the quickest controls to sample, and a gap between what the contract says and what the policy says is an easy finding to avoid.

How to implement A.6.2

Treat the exercise as a joint piece of work between HR, legal and the security lead, so that wording is lawful and also usable on the shop floor. Keep the finished text short enough that a new joiner can actually read and remember it.

1. List the groups of personnel you engage, including contractors and temporary staff, and note which agreement type each one signs.
2. Read each agreement template against your information security policy and mark where responsibilities are missing, vague or contradictory.
3. Agree with HR and legal how the template will refer to the policies people must follow, so that the contract stays stable while policies are updated.
4. Add the organisation's own responsibilities, such as providing training, approved tools and a route to ask questions.
5. Check that the signing step falls before access to sensitive information is granted, and adjust onboarding if it comes later.
6. Brief line managers on how to explain the responsibilities in plain language during induction.
7. Review the templates when roles, policies or applicable law change, and keep a note of what was changed and why, so a reviewer can see the agreement is maintained rather than frozen.

Illustrative BPO example: a confidentiality promise lacks a reporting route

Illustrative software example: a developer changes role

A hypothetical software developer moves into customer support and gains access to live customer information. The original induction focused on code repositories and development environments. The new responsibilities introduce different information-handling and communication expectations.

The manager and HR function review the relevant terms and supporting instructions, communicate the changed responsibilities and arrange appropriate learning before the new work begins. The process does not assume that an old acknowledgement covers every future role without further consideration.

Address different engagement arrangements

Contractors and supplier personnel may be engaged through different legal relationships. Determine how security responsibilities are agreed and communicated through the relevant arrangement. Do not assume that a supplier contract automatically proves each assigned person understands the organisation’s practical requirements.

Clarify how obligations continue after an assignment or employment ends where appropriate. The duration and wording depend on applicable requirements and the relationship. Connect this with responsibilities after termination or change rather than inserting an unsupported universal period.

Review terms when the underlying expectations change

Changes to law, policy, services or roles can affect security responsibilities. Establish an authorised route for reviewing and communicating relevant changes. HR, legal, security and operational owners may all have a part in the decision.

Differentiate agreement from demonstrated competence. A person may understand and accept a responsibility yet still need training, supervision or technical support to perform it. Use the appropriate competence and awareness processes rather than treating a signed agreement as evidence of every capability.

Evidence and common failures