Confidentiality or non-disclosure agreements that match the organization's information protection needs are to be identified, written, reviewed regularly and signed by staff and by the outside parties concerned. Purpose: keep information that staff or outside parties can reach confidential. Guidance: agreements protect confidential information through legally enforceable terms and apply both to personnel and to interested parties. Their terms follow from the organization's security requirements, considering the kind of information handled, its classification, how it will be used and what access the other party is allowed. Elements to consider are: what information is protected; how long the agreement lasts, including cases where confidentiality must hold with no end date or until the information is made public; what must happen when it ends; signatories' duties and actions to prevent unauthorized disclosure; who owns the information, any trade secrets and any intellectual property, and what that means for keeping it confidential; permitted uses and the signatory's rights of use; a right to audit and monitor activity involving confidential information in highly sensitive cases; how unauthorized disclosure or leakage is notified and reported; return or destruction of information at the end; and the consequences of breaching the agreement. Enforceability in the applicable jurisdiction is considered (5.31 to 5.34), and requirements are reviewed periodically and whenever circumstances affecting them change. Other information: such agreements both protect the organization's information and remind signatories of their duty to handle it responsibly and only as authorized.
This control maps to 33 controls across 24 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
ISO 27002:2022 6.6 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of ISO 27002:2022 your existing evidence covers. Hold NIST SP 800-53 Rev 5 and 79 of 93 ISO 27002:2022 controls already carry evidence.
Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 180 were rejected on the NIST SP 800-53 Rev 5 pair alone.
The graph holds this control, the 33 it maps to, and the evidence behind each claim, over MCP and REST.