HRS-10: Non-Disclosure Agreements

Implementation Guidance

The non-disclosure agreement should address requirements to protect confidential information using legally binding terms. Agreement terms should be based on the organization’s information security requirements. The type of information covered should define permissible access and information handling protocols. The agreement should include, but is not limited to:

1. What information is protected.
2. The length of the agreement.
3. Interested parties to the agreement.
4. The responsibilities of each party in the agreement.
5. Terms for the destruction of data once the agreement has ended.
6. Expected actions if a breach of agreement terms occurs.

Auditing Guidance

1. Examine if the organization has identified its requirements for non-disclosure and confidentiality.
2. Determine the planned interval for review.
3. Verify that the requirements are reviewed at such planned intervals.