  

## 6.6 Confidentiality or non-disclosure agreements

  

| **Control type** | **Information security properties** | **Cybersecurity concepts** | **Operational capabilities** | **Security domains** |

|------------------|------------------------------------|---------------------------|-------------------------------------------------------------|-------------------------------|

| #Preventive | #Confidentiality | #Protect | #Human_resource_security #Information_protection #Supplier_relationships | #Governance_and_Ecosystem |

  

**Control**

Confidentiality or non-disclosure agreements reflecting the organization’s needs for the protection of information should be identified, documented, regularly reviewed and signed by personnel and other relevant interested parties.

  

**Purpose**

  

To maintain confidentiality of information accessible by personnel or external parties.

  

**Guidance**

  

Confidentiality or non-disclosure agreements should address the requirement to protect confidential information using legally enforceable terms. Confidentiality or non-disclosure agreements are applicable to interested parties and personnel of the organization. Based on an organization’s information security requirements, the terms in the agreements should be determined by taking into consideration the type of information that will be handled, its classification level, its use and the permissible access by the other party. To identify requirements for confidentiality or non-disclosure agreements, the following elements should be considered:

  

a\) a definition of the information to be protected (e.g. confidential information);

  

b\) the expected duration of an agreement, including cases where it can be necessary to maintain confidentiality indefinitely or until the information becomes publicly available;

  

c\) the required actions when an agreement is terminated;

  

d\) the responsibilities and actions of signatories to avoid unauthorized information disclosure;

  

e\) the ownership of information, trade secrets and intellectual property, and how this relates to the protection of confidential information;

  

f\) the permitted use of confidential information and rights of the signatory to use the information;

  

g\) the right to audit and monitor activities that involve confidential information for highly sensitive circumstances;

  

h\) the process for notification and reporting of unauthorized disclosure or confidential information leakage;

  

i\) the terms for information to be returned or destroyed at agreement termination;

  

j\) the expected actions to be taken in the case of non-compliance with the agreement.

  

The organization should take into consideration the compliance with confidentiality and non-disclosure agreements for the jurisdiction to which they apply (see [5.31](a-5.31-Legal-statutory-regulatory-and-contractual-requirements.md), [5.32](a-5.32-Intellectual-property-rights.md), [5.33](a-5.33-Protection-of-records.md), [5.34](a-5.34-Privacy-and-protection-of-PII.md)).

  

Requirements for confidentiality and non-disclosure agreements should be reviewed periodically and when changes occur that influence these requirements.

  

**Other information**

  

Confidentiality and non-disclosure agreements protect the organization's information and inform signatories of their responsibility to protect, use and disclose information in a responsible and authorized manner.