Employment contracts and agreements are to set out the information security responsibilities of both the individual and the organization. Purpose: make people understand, before they take a role, what it demands of them for security. Guidance: contractual obligations should be consistent with the top-level security policy and the topic policies that apply, and can also make clear: that people who will reach confidential information sign confidentiality or non-disclosure agreements before access (6.6); their legal rights and responsibilities, for example under copyright or data protection law (5.32, 5.34); their responsibilities for classifying information and managing the assets, facilities and services they handle (5.9 to 5.13); their responsibilities for information received from interested parties; and the consequences of ignoring security requirements (6.4). Security roles and responsibilities are communicated to candidates before employment, and personnel agree to security terms suited to the nature and extent of their access. The terms are reviewed when laws, regulations or policies change, and where appropriate some responsibilities continue for a set period after employment ends (6.5). A code of conduct is one way to express responsibilities for confidentiality, PII protection, ethics and proper use of assets; a supplier may sign on behalf of its individual staff; organizations without a legal entity or employees can use equivalent arrangements.
This control maps to 39 controls across 23 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
ISO 27002:2022 6.2 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of ISO 27002:2022 your existing evidence covers. Hold NIST SP 800-53 Rev 5 and 79 of 93 ISO 27002:2022 controls already carry evidence.
Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 180 were rejected on the NIST SP 800-53 Rev 5 pair alone.
The graph holds this control, the 39 it maps to, and the evidence behind each claim, over MCP and REST.