ISO 27001 A.6.2: employment terms, explained for startups

A.6.2 Terms and conditions of employment

Employment agreements spell out each person's security duties. What proves it: employment and contractor agreements that include security responsibilities, signed by staff.

A certification auditor samples signed contracts with security clauses. A file that usually does the job: your offer letter or contractor template with the confidentiality and security clauses marked.

How to put it in place

Each step leaves a record, and the record is what the auditor samples rather than the step itself. Inside Polara, the control card for A.6.2 walks you through it in this order.

1. Add confidentiality and security clauses to employment and contractor templates.
2. Have current staff sign an addendum if their agreements lack them.
3. Keep the signed copies.

The free ISO 27001 readiness assessment asks one question that evidences it:

• Do employees and contractors sign confidentiality and security terms?

Policies, connectors and the SOC 2 overlap

In the ISO 27001 policy pack, the People and Human Resources Security Policy covers A.6.2. An auditor reads the policy for the rule, then samples the records to see the rule was followed.

The same evidence counts toward SOC 2. The Trust Services criteria that cover this ground: CC1.1, integrity and ethics and CC1.4, hiring and competence.

People controls

A.6.2 is one of the 8 people controls in Annex A. What happens before, during and after someone works for you: screening, terms, training, discipline, remote work and reporting. Small teams meet these with a handful of signed records.

Nearby controls in the same theme:

• A.6.1, background screening
• A.6.3, security training
• A.6.4, disciplinary process
• A.6.5, duties after leaving

Before it: A.6.1, background screening. After it: A.6.3, security training. Every control, by theme, is on the Annex A controls page.