Terms and conditions of employment

Plain-language summary

Writing information security into employment contracts and contractor terms, so that everyone knows — and has agreed in writing — what they must protect, which rules they follow, what continues after they leave and what happens if they break the rules.

What the clause is really asking

A policy nobody agreed to is hard to enforce, and this control closes that gap by making information security part of the deal people sign. The contract or terms should spell out what each side, the person and the organisation, is responsible for: following the information security policy and the topic-specific policies relevant to the role, confidentiality, handling of personal and classified information, intellectual property, use of company equipment, and the duties that carry on after employment ends. They should also say what happens when the rules are broken, linking to the disciplinary process. The usual misunderstanding is that a confidentiality clause written years ago is enough; auditors look for wording that reflects current policies, covers contractors and temporary workers, and is backed by an acknowledgement when policies change. In South Africa, the Basic Conditions of Employment Act already requires written particulars of employment, POPIA section 20 requires anyone processing personal information under authority to keep it confidential, and labour broker (TES) workers on the shop floor are often missed because their contract is with the agency, not with you.

What auditors look for

Auditors take a sample of personnel files across permanent staff, fixed-term contractors and agency workers, and read the security wording in each contract or set of terms. They check the contract points to the current policy set, not a document retired years ago, and look for a signed or electronic acknowledgement of the information security and acceptable use policies. They ask how staff learn about policy changes and whether they re-acknowledge. They ask HR and procurement who drafts contractor terms and how security gets into them. The hard question: show me what binds the agency worker in dispatch who uses the ERP every shift.

Typical evidence

Employment contract template with security, confidentiality, intellectual property and acceptable use clauses; contractor and labour broker agreement templates with equivalent clauses; signed contracts in personnel files; policy acknowledgement records, signed or electronic; re-acknowledgement records after material policy changes; induction checklist covering security responsibilities; date of last legal or HR review of templates.

How to comply — recommendations

Ask HR and your labour lawyer to review the contract template once, adding a short clause that requires compliance with the information security policy and its topic-specific policies as amended from time to time, confidentiality during and after employment, protection of personal information under POPIA, ownership of intellectual property, return of assets, and the link to the disciplinary code. Put the same clause into contractor and labour broker agreements, with the agency obliged to bind its workers. Collect an acceptable use acknowledgement at induction, electronically if possible so it is searchable. When policies change materially, push a re-acknowledgement and keep the record. Review the templates with legal every year.

Common nonconformities

Contracts with no information security or confidentiality wording; contract refers to policies that no longer exist; agency and contract workers with system access bound by nothing; no record that staff acknowledged the information security or acceptable use policy; policy changes never communicated or re-acknowledged; consequences of breach not stated or not linked to the disciplinary process.

Resources for this clause

• ArticleISO/IEC 27001:2022 Annex A explained: the 93 controls in plain English, theme by theme, with the 114-to-93 map and the attribute tags
• ArticleThe Statement of Applicability, explained — what ISO/IEC 27001 clause 6.1.3 requires, the four ways an SoA fails Stage 1, and how to build one from the risk register
• ArticleISO/IEC 27001:2022 explained for people who already run ISO 9001: what is the same, what is new, and how to get certified
• Toolkit · $39Risk & SoA ToolkitScore your information security risks on a documented method, pick the Annex A controls that treat them, and the Statement of Applicability writes its own first draft — every justification citing the risks behind it.
• Toolkit · $29ISMS Metrics & Evidence TrackerThe three things an ISMS has to show after certification, in one workbook: measures with a live Green / Amber / Red status, management review minutes that cover every required input, and an evidence register that gives every control an owner, a rhythm and a due date.
• Free downloadAnnex A 93 Controls Quick ReferenceOne A3 page: all 93 Annex A controls in their four themes, the eleven new in 2022 flagged, and the ISO/IEC 27002:2022 attribute legend — the poster for the wall beside the Statement of Applicability.
• Free downloadISO 27001 Gap Analysis ChecklistWhere you stand against ISO/IEC 27001:2022 in one afternoon — the 30 management-system requirements and all 93 Annex A controls, scored, with owners, dates and a readiness figure that calculates itself.
• Free masterclass · ~27 minISO 27001 MasterclassYou already know four fifths of ISO 27001. Here is the other fifth — the risk method, the SoA, the 93 controls, the evidence rhythm, POPIA, and a 44-week path.
• Free appAudit ManagerPlan the programme, anchor each finding to its clause and drive the NC to closure.