ISO 27001 Employment Security Terms: Control A.6.2 in Practice

Security responsibilities should be established before a person receives access, not discovered during an incident. ISO/IEC 27001:2022 Annex A control 6.2 addresses terms and conditions of employment that state the organisation’s and personnel’s information-security responsibilities.

The control applies to more than permanent employees. Contractors, agency workers, interns and other people may need equivalent obligations through the agreement that governs their engagement. The exact legal mechanism varies by jurisdiction and worker status, so HR and legal counsel should approve the wording and process.

This guide focuses on control design and audit evidence. It is not employment-law advice.

Start with the role and access, not a generic clause

A generic promise to follow company policy is useful but rarely sufficient on its own. Obligations should reflect the information, systems, privileges and decisions associated with the role.

Build a responsibility profile from:

• the role description and business process;
• expected access to personal, confidential or regulated information;
• administrative or development privileges;
• use of corporate and personal devices;
• remote, field or customer-site working;
• authority to approve transactions or security changes;
• intellectual-property exposure; and
• incident reporting and escalation duties.

This does not mean every employee needs a unique contract. Organisations can use a common foundation with role or population-specific provisions. For example, all personnel may have confidentiality and acceptable-use duties, while administrators have enhanced credential, logging and emergency-access responsibilities.

Cover responsibilities through the whole relationship

Security terms should define what is expected before access, during the engagement, when duties change and after departure.

Before access

The individual should receive applicable terms in a form they can understand, have an opportunity to raise questions and provide acknowledgement where required. Access should not be activated until mandatory steps are complete or a documented exception has been approved.

The onboarding workflow can connect agreement acceptance, identity verification, screening where appropriate, awareness, device issue and access approval. The personnel screening evidence guide explains the separate risk-based purpose of screening.

During employment or engagement

Terms need operational support. Policies, awareness, manager instruction and technical controls translate obligations into daily behaviour. If a contract refers to acceptable use or incident reporting, personnel must be able to find the current rules and know how to act.

Managers should reassess responsibilities when a person changes role, gains privilege, moves location or joins a sensitive project. A signed agreement from the start date may not address later access.

At termination and afterwards

Some responsibilities, such as protecting confidential information or intellectual property, may continue after the relationship ends if law and the agreement support them. Offboarding should also recover assets, remove access, transfer records and remind the person of continuing duties.

The organisation should not assume a continuing clause compensates for weak access removal. Contractual and technical measures serve different purposes.

Subjects commonly addressed

The content should match legal advice, risk and the organisation’s policies. Common subjects include:

Subject	Operational question
Confidentiality	What information must not be disclosed, and when does the duty continue?
Acceptable use	How may systems, accounts, devices and communication services be used?
Personal data	What duties apply when accessing or handling personal information?
Credentials	What must the person do to protect authentication information?
Incidents	What must be reported, by which channel and without what delay?
Assets and records	How are equipment, media, documents and work products handled and returned?
Monitoring	What monitoring notice or acknowledgement is legally required?
Intellectual property	Who owns work products and how may protected material be used?
Policy compliance	Which controlled policies form part of the person’s responsibilities?
Consequences	How can breaches be investigated and addressed under applicable rules?

Do not overload the agreement with rapidly changing procedural detail. State durable obligations and connect them to controlled policies or standards. A versioned information security policy structure gives personnel a stable hierarchy without requiring frequent contract changes.

Separate design evidence from operating evidence

An approved agreement demonstrates design. It does not prove that the process operates across the workforce.

Design evidence

Useful design evidence includes:

• approved standard clauses and population-specific provisions;
• a mapping from risks and policies to obligations;
• HR and legal review records;
• defined triggers for new or revised acceptance;
• onboarding, transfer and offboarding workflow rules;
• exception authority and escalation; and
• retention and access rules for personnel records.

Operating evidence

Operating evidence can include:

• signed or electronically acknowledged agreements;
• timestamps showing completion before account activation;
• role-change records and updated acknowledgements;
• contractor agreements covering relevant duties;
• approved and time-bound exceptions;
• evidence that personnel received referenced policies; and
• offboarding records showing reminders and asset return.

Protect the evidence itself. Employment records contain sensitive information and should be accessed only by authorised roles, retained according to applicable requirements and securely disposed of when no longer needed.

Connect the control to related people controls

Control 6.2 is one part of a people-security system. Screening informs whether a person is suitable for a role. Terms establish responsibilities. Awareness builds understanding. The disciplinary process provides a consistent response to breaches. Responsibilities after termination and confidentiality agreements support later lifecycle stages.

These controls should share role definitions and triggers. If HR identifies a transfer into a privileged role, that event can trigger new access approval, enhanced learning and revised obligations. Fragmented workflows create gaps in which the contract, identity system and manager all describe a different role.

The RACI guide for ISO 27001 can help separate HR, hiring-manager, legal, IT and information-security responsibilities.

Treat policy references carefully

A contract may require compliance with company policies, but the organisation still has to control and communicate those policies. Referenced documents should have owners, approval, effective dates and accessible locations. Material changes may require notice or renewed acknowledgement depending on law and the agreement.

Avoid broken references such as old intranet paths or retired policy names. During a review, follow several agreement references to the live document and confirm that personnel can access the version relevant to them.

The free Annex A control lookup can help teams place control 6.2 beside related people controls when designing the workflow.

Sample the process intelligently

An internal audit sample should cover variation, not just easy records. Include:

• recent permanent hires;
• contractors or agency workers;
• privileged or sensitive roles;
• people who changed roles;
• remote or cross-border personnel where relevant;
• approved exceptions; and
• recent departures.

For each sample, compare the start or change date, agreement status, applicable provisions, policy availability and access activation. A wider population query can test missing acknowledgements or agreements signed after access was granted.

Useful audit questions include:

• How are security duties derived for each population?
• What prevents access before required acceptance?
• Which changes trigger reassessment?
• How are contractor duties made equivalent where needed?
• Who approves deviations, and when do they expire?
• Can HR produce evidence without exposing unrelated personnel data?

Interpret audit results

A pass would show approved role-appropriate terms, completion before access, controlled references, lifecycle triggers and retrievable samples. A partial result might show suitable standard terms but inconsistent contractor coverage or role-change updates. A fail could involve people receiving sensitive access without applicable obligations, systematic late acceptance or no defined owner.

One isolated late record may be a correction or minor issue depending on cause and impact. A process that routinely activates access first indicates a design or operating weakness. Findings should describe objective evidence, requirement, impact and scope rather than relying on the document’s title.

Maintain the control as work changes

Review provisions when laws, working methods, technology, business services or threat exposure change. Remote work, use of generative AI, personal devices and customer-site access can introduce duties that older agreements did not anticipate. Coordinate changes with policy, awareness and technical enforcement.

ISO’s official ISO/IEC 27002 page describes the standard as guidance on information-security controls, including human-resource security. Use the licensed standard for the complete control wording and implementation guidance; do not rely on summaries as a substitute.

Effective employment terms do not shift all security accountability to individuals. They make responsibilities explicit while the organisation supplies clear rules, suitable controls, competence, reporting routes and fair governance. The audit objective is to prove that this arrangement works for the people who actually have access.