.svg)
Annex A 6.6 is not simply about signing NDAs. It is about establishing a governed confidentiality framework that protects information throughout its lifecycle, aligns with legal and regulatory expectations, and stands up to audit scrutiny. This control ensures that people understand what must remain confidential, why it matters, how it must be protected, and what happens if those obligations are breached.
This article provides a complete, end-to-end explanation of ISO 27001 Annex A 6.6 under the 2022 standard. It covers intent, scope, implementation, evidence, audit expectations, common pitfalls, and best practices—positioned as a definitive reference for compliance, certification, and ongoing ISMS maturity.
Understanding ISO 27001 Annex A 6.6
What Annex A 6.6 Requires
ISO 27001 Annex A 6.6 requires organisations to ensure that confidentiality or non-disclosure agreements are identified, implemented, maintained, and enforced for all relevant parties who have access to information that must be protected. This includes employees, temporary staff, contractors, consultants, suppliers, partners, and in some cases customers.
The control expects confidentiality obligations to be:
- Clearly defined and documented
- Appropriate to the organisation’s risks and legal context
- Communicated and understood by relevant parties
- Enforceable through contractual, policy, and disciplinary mechanisms
Annex A 6.6 applies to information, not just documents. This includes data in digital systems, verbal discussions, intellectual property, business processes, customer records, source code, credentials, and any information classified as confidential or restricted under the organisation’s information classification scheme.
Why Confidentiality Is Explicitly Addressed in ISO 27001
While confidentiality is already a core principle of the CIA triad, ISO 27001 treats confidentiality obligations as a distinct control because human and contractual failures remain one of the most common causes of information security incidents.
Examples include:
- Employees sharing information without understanding sensitivity
- Contractors retaining access or knowledge after contracts end
- Suppliers mishandling shared data
- Verbal disclosures during meetings or calls
- Inadequate contractual protection during partnerships or M&A activity
Annex A 6.6 exists to ensure that confidentiality is not assumed or implied, but explicitly governed.
Relationship to the ISMS and Risk Management
Confidentiality and NDA management must be aligned with the organisation’s ISMS scope, risk assessment, and information classification framework. NDAs are not generic legal documents; they are risk treatments.
Auditors will expect to see:
- A clear link between information risks and confidentiality obligations
- Evidence that confidentiality requirements are proportionate to risk
- Integration with onboarding, offboarding, supplier management, and incident response processes
What Is a Confidentiality or Non-Disclosure Agreement Under ISO 27001?
Definition in an ISO 27001 Context
Within ISO 27001, a confidentiality or non-disclosure agreement is any formal mechanism that legally and operationally binds an individual or organisation to protect specified information from unauthorised disclosure, use, or misuse.
This includes:
- Employment contract confidentiality clauses
- Standalone NDAs
- Supplier or partner confidentiality agreements
- Project-specific NDAs
- Confidentiality provisions within broader service agreements
The standard does not mandate a specific format, but it does require that confidentiality obligations are appropriate, enforceable, and effective.
Who Must Be Covered
Confidentiality obligations must apply to all parties who may access sensitive information, including:
- Permanent and temporary employees
- Contractors and consultants
- Outsourced service providers
- Cloud and SaaS vendors
- Business partners
- Third-party developers or integrators
In high-risk environments, this may also include visitors, auditors, interns, or volunteers.
When Confidentiality Obligations Must Apply
Confidentiality obligations should apply:
- Before access is granted
- During the period of access
- After the relationship ends
Post-termination confidentiality is a critical audit focus. Organisations must demonstrate that confidentiality obligations survive contract termination where appropriate.
Confidentiality vs NDA: Understanding the Difference
What Is Confidentiality?
Confidentiality refers to the obligation to protect information from unauthorised disclosure. It is a principle, a policy requirement, and a behavioural expectation.
Confidentiality can be enforced through:
- Policies
- Procedures
- Training
- Technical controls
- Legal agreements
What Is an NDA?
A Non-Disclosure Agreement is a legal instrument used to formalise confidentiality obligations between parties. An NDA is one way—though not the only way—to enforce confidentiality.
Key Differences
Confidentiality is broader and continuous.
An NDA is specific and contractual.
ISO 27001 Annex A 6.6 requires confidentiality to be managed holistically, not just through NDAs. An organisation that relies solely on NDAs without policies, awareness, or enforcement mechanisms will typically fail audit expectations.
Why Annex A 6.6 Matters for ISO 27001 Certification
Human Risk Is the Primary Threat Vector
Most information security incidents are not caused by advanced attacks, but by:
- Human error
- Misunderstanding of sensitivity
- Poor judgement
- Lack of accountability
Annex A 6.6 directly addresses this by ensuring people understand their obligations and the consequences of breaches.
Legal and Regulatory Alignment
Confidentiality agreements support compliance with:
- Data protection laws
- Intellectual property protections
- Client contractual requirements
- Industry regulations
Auditors frequently view Annex A 6.6 as a proxy indicator for overall governance maturity.
Audit Readiness and Evidence
Confidentiality management is one of the easiest areas for auditors to test. Gaps are often immediately visible through missing agreements, outdated templates, or inconsistent application.
Confidentiality Levels Under ISO 27001
Why Classification Matters
Confidentiality obligations must align with how information is classified. Without defined confidentiality levels, NDAs and policies lack precision and enforceability.
Common Confidentiality Levels
Most ISO 27001-aligned organisations use four levels:
Public
Information intended for public disclosure with no confidentiality requirement.
Internal
Information intended for internal use only, with limited risk if disclosed.
Confidential
Information that could cause harm if disclosed, including customer data, internal reports, or commercial information.
Restricted
Highly sensitive information requiring strict access controls, such as credentials, encryption keys, source code, or regulated data.
Annex A 6.6 requires confidentiality obligations to reflect these distinctions, not treat all information equally.
Implementing Annex A 6.6 in Practice
Step 1: Define Confidentiality Requirements
Organisations must clearly define:
- What information is confidential
- Who is responsible for protecting it
- How confidentiality is enforced
- What happens if confidentiality is breached
These definitions should exist within policies, contracts, and procedures.
Step 2: Establish Standard Confidentiality Clauses and NDAs
Standardised templates help ensure consistency and auditability. These should:
- Align with information classification
- Define permitted and prohibited disclosures
- Include post-termination obligations
- Reference disciplinary or legal consequences
Step 3: Integrate Confidentiality Into Onboarding
Confidentiality obligations should be communicated and acknowledged before access is granted. This typically includes:
- Contract signing
- Policy acknowledgment
- Awareness training
Step 4: Manage Confidentiality for Third Parties
Supplier and partner confidentiality management should be risk-based and documented, with evidence of acceptance and review.
Step 5: Enforce and Monitor
Confidentiality is meaningless without enforcement. This includes:
- Monitoring for misuse
- Investigating breaches
- Applying disciplinary actions
- Updating agreements when roles or risks change
Evidence Required for Annex A 6.6 Compliance
Auditors will expect objective evidence, not verbal assurances.
Common Evidence Types
- Signed confidentiality agreements
- Employment contracts with confidentiality clauses
- Supplier agreements
- Policy acknowledgment records
- Training and awareness records
- Offboarding checklists
- Incident records related to confidentiality breaches
Evidence must be current, relevant, and traceable.
Common Audit Findings for Annex A 6.6
Typical nonconformities include:
- Missing NDAs for contractors
- Outdated confidentiality clauses
- No post-termination obligations
- Inconsistent application across roles
- Lack of awareness evidence
- No defined confidentiality levels
These findings are often classified as major because of their direct impact on risk.
Best Practices for Strong Confidentiality Governance
Make Confidentiality Role-Specific
Not all roles carry the same risk. Tailor confidentiality obligations accordingly.
Keep Agreements Simple and Understandable
Overly complex legal language reduces effectiveness and awareness.
Review Regularly
Confidentiality obligations should be reviewed when:
- Roles change
- Systems change
- Regulations change
- Incidents occur
Integrate With Other Controls
Annex A 6.6 should align with access control, acceptable use, awareness, and incident management controls.
Confidentiality and NDAs in the Context of ISO 27001:2022
The 2022 update reinforces the need for people-centric controls. Annex A 6.6 reflects ISO’s recognition that information security failures often originate outside technical systems.
Organisations that treat confidentiality as a living control—not a static document—consistently demonstrate higher ISMS maturity and audit resilience.
Turning Confidentiality Into a Controlled System
ISO 27001 Annex A 6.6 is not about paperwork—it is about trust, accountability, and governance. Organisations that implement confidentiality and NDA management effectively reduce risk, strengthen compliance, and demonstrate security maturity.
When confidentiality obligations are clearly defined, consistently applied, and auditable, they become a powerful control rather than a legal afterthought.
Book a Demo: Manage Confidentiality and NDAs With Confidence
Managing confidentiality agreements, acknowledgments, reviews, and evidence manually is complex, error-prone, and difficult to scale—especially across employees, contractors, and suppliers.
Hicomply helps organisations centralise confidentiality and NDA management as part of a structured, auditable ISMS. From policy acknowledgment tracking to supplier agreement visibility and audit-ready evidence, Hicomply enables teams to maintain continuous compliance without administrative overload.
If you want to simplify ISO 27001 Annex A 6.6 compliance and strengthen your confidentiality governance, book a demo with Hicomply and see how a modern ISMS platform supports real-world security management.
