ISO 27001 A.6.6: Make Confidentiality Agreements Relevant

What A.6.6 requires in practice

Annex A control 6.6 concerns confidentiality and non-disclosure agreements. The organisation is expected to work out which agreements it needs so that they reflect how it actually wants information protected, to document them, to review them regularly, and to have them signed by personnel and other relevant parties. The key phrase is reflecting the organisation's needs: a single stock form that ignores the kind of information shared, the purpose and the relationship is unlikely to meet it. The control covers staff, contractors, suppliers, customers and partners, wherever information passes to someone outside the immediate ISMS. The outputs are a considered set of agreement types, evidence that they are signed before the information is shared, and a review routine so wording stays current. The standard does not prescribe wording, duration or legal form; those are matters for legal advice and applicable law.

Define what needs protection and why it is shared

Identify the information and the purpose for which the recipient needs it. Consider its classification, intended use and the extent of access. An agreement should help the parties understand the protected information without relying on vague assumptions that everything exchanged has the same status.

Clarify who may use or receive the information and under what conditions. A recipient may need to involve authorised colleagues or specialist advisers, but that should be considered within the arrangement. Avoid assuming that signing an agreement gives unlimited permission to redistribute information across the recipient’s organisation.

Address how confidentiality relates to ownership and permitted use. The right to view material for one project does not necessarily include a right to reuse it in another deliverable. These questions often connect with intellectual property and need competent interpretation.

Consider the relationship’s lifecycle

Determine when the obligation begins, how it relates to the engagement and what continues afterwards. The appropriate duration depends on the information and applicable requirements. ISO 27001 does not prescribe one fixed term for every agreement.

Plan what happens to information at the end of the relationship. Return, deletion, retained records and continuing access may require different arrangements. An instruction to destroy everything can conflict with legitimate retention needs if those have not been considered. Resolve the intended handling rather than leaving the recipient to guess.

Why meaningful confidentiality agreements matter to the business

Agreements are frequently the main formal protection once sensitive information leaves your control, whether in a tender, a joint project or a supplier relationship. A weak or missing agreement leaves the organisation arguing about what was understood. A well-aimed one clarifies what is protected, who may see it and what happens at the end of the relationship, which protects intellectual property and customer trust. Customers frequently require flow-down of confidentiality terms to anyone who handles their data, so a consistent approach avoids lost deals and contract disputes. Auditors test whether agreements exist, are signed on time and match real information flows.

How to implement A.6.6

Begin by understanding where information actually goes, then match agreements to those flows.

1. List the situations in which information is shared with people outside the organisation or in new roles inside it.
2. Group them into a small number of agreement types, based on the sensitivity of the information and the nature of the relationship.
3. Ask legal advisers to review wording, covering permitted use, onward sharing, duration and handling at the end of the relationship.
4. Make signature a precondition for sharing, and tell the relevant teams so that information is not released first.
5. Keep a controlled record of who has signed which agreement and when.
6. Review agreement types on a regular schedule and when the business, law or customer requirements change.
7. Check that what happens to information at the end of a relationship, such as return or deletion, is actually carried out. Ask the project owner to confirm it, not just the contract administrator.

Illustrative software example: an evaluation becomes a different use

Illustrative construction example: a consultant’s wider team

A hypothetical contractor shares sensitive tender information with a specialist consultant. The consultant intends to involve another office, but the parties have not clarified which personnel may receive the information. A company-level signature exists, yet the operational audience remains uncertain.

The parties resolve the permitted access and relevant obligations before extending the distribution. The contractor adjusts its sharing permissions accordingly. The example shows that contractual protection and technical access need to support the same decision; neither should silently define a different audience.

Evidence and common gaps

Connect confidentiality promises with real handling

Discuss confidentiality-control governance with Sterling. Consulting and scoped Effivity ISO & GRC automation software can support ownership, review and evidence. Reinforce practical handling through Information Security Essentials training. Legal drafting and independent certification decisions remain separate. Explore the people controls guide.