ISO 27001 Annex A 6.2: terms and conditions of employment

The due-diligence questionnaire asks whether every employee and contractor is bound by security and confidentiality terms. You believe they are. Nobody can produce the signatures, and the deal is waiting.

This guide covers ISO 27001 Annex A 6.2, the control on terms and conditions of employment. It is written for security and compliance leads at UK regulated firms and B2B tech companies. It sets out what the terms must say, how to bind contractors, when to sign, and how to gate access on the signature.

What do ISO 27001 Annex A terms and conditions of employment require?

Annex A 6.2 needs the contract a person signs to set out their information security duties, and the organisation's in return. The terms must scale with the access the role carries and reach everyone in scope, contractors included. They must be shared during recruitment and keep confidentiality alive after the person leaves.

The 2022 control is titled Terms and conditions of employment, but its reach is wider than the title suggests. Permanent staff, part-timers, temps, freelancers and agency workers are all in scope when they do work that touches your information.

The control has four moving parts:

• Written duties on both sides. The contract states what the organisation expects on security and what it owes the person in return.
• Scaled to access. An engineer with production access carries tighter, more explicit terms than a role that never touches sensitive data.
• Communicated early. Candidates hear the security expectations during recruitment, so the contract confirms rather than surprises.
• Refreshed and durable. Terms are rechecked when law or policy moves, and confidentiality survives departure for a stated period.

The organisation's side of the bargain is the part people forget. We recommend clear policies, an incident route that works, and tooling that makes compliance possible, so nobody can credibly say they were never told.

The scope is deliberately broad. The NCSC guidance on reducing data exfiltration by malicious insiders defines malicious insider activity as misuse by anyone with legitimate access: contractors, partners and suppliers as well as employees. A regime that stops at permanent staff leaves part of that population unbound.

When an insider takes data to a competitor or hushes up an incident, the contract is the first document your lawyer asks for. A contract that never mentioned security leaves you little to enforce.

Where does Annex A 6.2 sit in the joiner security lifecycle?

Annex A 6.2 sits in the middle of the joiner chain. A.6.1 screening clears the candidate and A.6.2 binds them by contract. A.6.6 holds the standalone confidentiality agreement, A.6.4 supplies the disciplinary consequences, and A.6.5 governs what still applies after they leave. Together they form the joiner story an auditor follows.

ISO 27001 Annex A.6 is the people controls theme. Here is what A.6.2 owes each neighbour:

• A.6.1 screening comes first. Make the offer, and the contract with it, conditional on screening clearing.
• A.6.6 confidentiality agreements carry the detail for roles that need standalone ISO 27001 confidentiality agreements. The contract names the agreement rather than copying it.
• A.6.4 disciplinary process is where breaches go. The contract points to it, so the consequence is known before any breach.
• A.6.5 after leaving relies on the survival clause in the contract. Without one, there is little to remind a leaver of at exit.

A.6.2 should point to its neighbours rather than repeat them. A gap here rarely stays here, because an auditor follows one joiner through every link.

Plan the work in that order. It is days of legal and HR work, not weeks, and it lands naturally beside screening as part of building the joiner pipeline. Build the template before the automation, because signed-before-access only works if there is something to sign.

Which security clauses must employment contracts include?

Contracts should carry a confidentiality duty and the person's data protection and copyright position. Add handling and classification rules, ownership of work product, acceptable use, credential care, prompt incident reporting and a pointer to the disciplinary process. Put them in a short security schedule per role tier, not a bespoke contract per person.

Anchor the data protection clause in UK GDPR. The ICO guidance on contracts and liabilities between controllers and processors covers Article 28(3)(b). A processor's contract must require a commitment of confidentiality from anyone it allows to process personal data. That covers temporary and agency workers as well as employees. For a regulated firm, a missing commitment reads as a data-protection failure, not just an audit finding.

The clauses auditors look for fall into five groups:

• Confidentiality. A duty of confidentiality, with a standalone agreement where the role warrants one, surviving departure for a defined period.
• Legal position. The person's data protection and copyright position, plus ownership of work product and IP.
• Handling rules. Duties to handle and classify company information under your rules and to protect what clients and partners entrust to you.
• Conduct. Acceptable use, credential care and prompt incident reporting.
• Consequences. An explicit pointer to the disciplinary route.

Scale the schedule to the seat. A standard tier for most staff and a tighter tier for engineers with production access, or anyone handling client personal data, is usually enough. Chasing one-off contracts after the fact is the expensive version of this control.

Many firms put the detail in the employee handbook or code of conduct and have the contract incorporate it by reference. That works when the contract names the document, and the signed acknowledgement records which version the person accepted.

Get HR, your employment lawyer and the security owner around one table once, and bake the schedule into the standard contract. The recurring failure is misalignment: contracts issued from an old template that predates the clauses everyone assumed were in there.

The opposite mistake is a ten-page schedule for every role regardless of risk. Nobody reads it.

A security schedule that HR quietly stops issuing protects no one.

How do you bind contractors, agency staff and freelancers to equivalent terms?

Contractors, temps and agency staff need terms that match employees'. They can sign directly, or the terms can flow down through the agency's contract with you. The standard lets the supplying firm sign on its people's behalf. Aim for no exceptions: auditors sample exactly the people you assumed were covered.

Two routes bind non-permanent people:

• Direct signature. The contractor signs your engagement letter before access, which suits freelancers.
• Flow-down through the agency. Your contract with the agency requires equivalent terms for every person it supplies.

Matching doesn't mean identical. A freelancer with no production access can sit on the lower tier, while an agency engineer with admin rights takes the higher one. Record which agency contract covers which named worker, because an undocumented flow-down is exactly what an auditor will raise.

Intellectual property needs its own clause. Under Section 11 of the Copyright, Designs and Patents Act 1988, the employer is the first owner of copyright in work an employee makes in the course of their job. That holds unless an agreement says otherwise, and the rule covers employees only. Code or content from a freelancer needs a written assignment in the engagement letter. Without one, ownership can surface as a nasty surprise in funding or acquisition diligence.

The engagement letter should otherwise mirror the employee schedule for the contractor's tier: confidentiality, handling rules, incident reporting and the IP assignment. Tie the end date in the letter to the removal of the contractor's access.

When must ISO 27001 Annex A 6.2 terms be signed, and what about legacy staff?

Terms must be signed before access is granted: executed paperwork first, accounts second, and auditors check the dates. Staff on old contracts do not need wholesale re-papering. A signed policy acknowledgement or short addendum closes the gap, with full updates folded into natural renewal points.

Auditors test timing by comparing two timestamps for each sampled joiner: when the contract was signed and when the account was created. The execution date has to come first. A standalone confidentiality agreement follows the same rule, so it is signed before the first login, not after the first week.

The common failure is access on day one with the contract to follow. The hiring manager wants the starter productive, the paperwork lags, and the timestamps record it.

A signature collected after access is granted is a record, not a control.

Legacy staff are a lighter problem with three possible fixes:

• Policy acknowledgement. Each person signs the current security policy and acceptable-use rules, which is quick and creates a dated record.
• Short addendum. Where the old contract carries no security or confidentiality terms at all, a one-page addendum adds them.
• Renewal points. Fold full template updates into promotions, role changes and contract renewals.

Store each acknowledgement in the same repository your reconciliation reads, so legacy staff appear as covered rather than as exceptions.

Re-check the template when the law, a major customer contract or your security policy changes. An annual legal once-over alongside the policy review cycle is a sensible cadence, and the dated review is itself evidence.

How do you enforce signature-gated provisioning in your IdP and HRIS?

Make the joiner workflow refuse to create accounts until the e-signature platform reports the contract and acknowledgements executed. Then reconcile the HR roster against the signed-document repository on a schedule. Issue contracts only from the current template, and let law or policy changes raise legal-review tasks automatically.

The gate works because the e-signature platform becomes the source of truth for your HRIS and identity provider. When HR marks a hire as starting, the workflow requests the contract and acknowledgements. The account is created only when the platform reports completion, and the two timestamps become your evidence. At 50 people the build is modest: a signature platform, a contract-status field in the HRIS and one check in the joiner workflow.

Reconciliation closes the gaps the gate can't see. Compare the HR roster, plus the contractor and supplier register, against the signed-document repository weekly. Anyone in scope without an executed agreement surfaces as an exception before an auditor finds them.

Coverage you have never queried is coverage you have assumed.

Version drift ends when contracts issue only from the current template in the document platform. The desktop copy a hiring manager saved two years ago can no longer be sent, and the version history doubles as review evidence.

Review triggers come from outside the business. A regulatory-change watchlist or a policy-update event raises the legal-review task automatically, and the trigger is captured as evidence.

The paperwork stops being a scramble before the audit and becomes a property of the pipeline.

What audit evidence proves Annex A 6.2 is working?

Auditors expect to see the current contract and engagement-letter templates, with their legal review trail. They sample signed agreements for employees and contractors, dated before first access, and signed policy acknowledgements. The e-signature or document-management log then shows that coverage is complete, not anecdotal.

Sampling starts from the HR list. Joiners are cross-checked against signed agreements and account-creation dates. Contractors, temps and long-tenured staff on decade-old contracts are the favourite picks, because that is where coverage quietly lapses.

Expect these questions in the room:

• "Show me your standard contract. Where do security responsibilities appear?"
• "Pick these two recent joiners and this contractor: show me their signed agreements and when access was granted."
• "How do temps and agency staff end up bound by equivalent terms?"
• "When did a lawyer last look at these clauses, and what prompted it?"
• "If I ask this employee what they signed up to on security, will their answer match the paper?"

The last question is an interview cross-check, and incident-reporting duties are the usual target. A short onboarding briefing that walks each tier through its schedule gives staff an answer that matches the paper.

Evidence the pipeline produces itself beats evidence assembled in a panic. When the gate timestamps and reconciliation reports from the previous section sit in one folder, a sample request becomes a retrieval task.

How do auditors grade Annex A 6.2 gaps: minor or major nonconformity?

Templates with no security content, or people routinely working with access and no executed agreement, show the control has broken down, and grade major. A single missing signature, an out-of-date template awaiting review, or an undocumented contractor flow-down grades minor, but repeated lapses add up to major.

Certification bodies grade on pattern and systemic breakdown rather than on single lapses. One joiner in a sample of 20 whose contract arrived a week after their account is a minor finding. The same gap across most of the contractors sampled is a breakdown, and grades major.

The grade decides what happens next. A minor finding needs a corrective action plan the auditor accepts. A major one usually has to be closed before the certificate is issued or renewed.

An engineered gate keeps you on the minor side of that line, because reconciliation catches the isolated slip before it becomes a pattern.

It also answers the commercial question. Enterprise due-diligence packs routinely ask whether staff and contractor agreements carry security and confidentiality terms. A reconciliation report showing full coverage turns that questionnaire line from a risk into a proof point.

Frequently asked questions