ISO 27001 A.6.2: Terms and Conditions of Employment

Quick Reference (60 Seconds)

What the Control Asks For

Do you need this control?

A.6.2 is not mandatory in itself: under clause 6.1.3 you include it if your risk assessment calls for it, and record the decision in your Statement of Applicability. Include it if you employ people, because employment terms are where security responsibilities become binding. Most organisations meet it by adding security clauses to offer letters and contracts.

The Control in Brief

Annex A 6.2 asks that employment contractual agreements state both the personnel's and the organization's responsibilities for information security.

Implementation Guidance (ISO 27002:2022)

• Information security responsibilities should be addressed in the terms and conditions of employment
• Employees should be made aware of their security responsibilities at the time of hire
• The organization should require employees to commit to these responsibilities in writing
• Sanctions for non-compliance should be defined and communicated
• Responsibilities should be reviewed and updated as roles change, and when laws, regulations or policies change
• 27002 lists what the terms should cover (paraphrased): (a) a confidentiality or non-disclosure agreement for people given access to confidential information (A.6.6); (b) legal responsibilities and rights, for example under copyright and data protection law (A.5.32, A.5.34); (c) responsibilities for classifying information and managing assets (A.5.9–A.5.13); (d) responsibilities for handling information received from interested parties such as customers and partners; (e) what happens if security requirements are disregarded (A.6.4)
• Security roles and responsibilities should be communicated to candidates during the pre-employment process
• Some responsibilities, such as confidentiality, continue for a defined period after employment ends (A.6.5)
• The organization should ensure that employees understand the consequences of security violations
• This applies to permanent employees, contractors, and temporary staff

"Shall" vs "Should" Analysis

• Shall (once you have selected this control): employment contracts state the employee's and the organisation's information security responsibilities
• Should: Specific methods of communication and agreement are flexible

Common Misinterpretations

Why Terms and Conditions of Employment Matters

The Business Risk Narrative

Employment contracts are the legal foundation of information security accountability. For Indian organizations, weak security clauses create significant exposure:

• 68% of breaches worldwide involved a non-malicious human element such as an error or falling for social engineering (Verizon DBIR 2024)
• Clear, acknowledged responsibilities make it possible to train, hold people accountable and enforce sanctions fairly
• Without documented security responsibilities, organizations struggle to enforce disciplinary action or pursue legal remedies
• DPDP Act 2023 requires "reasonable security safeguards" which includes personnel accountability
• In negligence lawsuits, courts look at whether the organization clearly communicated responsibilities

Regulatory Landscape in India

Industry-Specific Consequences

Scope and Applicability

What the Control Covers

• Employment contracts: Permanent, temporary, fixed-term, probationary
• Contractor agreements: Independent contractors, consultants, freelancers
• Internship agreements: Students, trainees, apprentices
• Vendor personnel agreements: Staff augmentation, ODC workers, outsourced staff
• Director agreements: Board members, advisors, non-executive directors
• Remote work agreements: Work-from-home, hybrid work arrangements
• BYOD agreements: Bring Your Own Device policies and terms
• Side letters: Specific security terms for sensitive roles
• Non-disclosure agreements: Standalone or embedded in employment contracts
• Intellectual property assignment: IP ownership clauses
• Return of assets clauses: Equipment, data, access return upon exit
• Non-compete clauses: restrictions during employment (exclusivity) are enforceable; post-employment non-competes are void in India under s.27 of the Indian Contract Act, so rely on confidentiality, IP assignment and reasonable non-solicitation
• Sanctions clauses: Defined consequences for security violations
• Acknowledgment: Signed acceptance of security policies and responsibilities

Who It Applies To

What It Does NOT Cover

• General HR policies (leave, attendance, benefits), covered by HR policies
• Compensation and benefits, covered by compensation policies
• Performance management (general), covered by HR processes
• Physical safety (OSHA-equivalent), covered by safety policies
• Termination procedures, covered by A.6.5 and labor law

Size-Based Applicability

Key Definitions and Terminology

Relationship to Other Controls

Upstream Controls (Prerequisites)

Downstream Controls (Enabled By)

Parallel Controls (Work Alongside)

Implementation Roadmap (Week-by-Week)

Phase 1: Discovery & Assessment (Weeks 1-2)

Week 1: Current Contract Assessment

• Deliverable: Employment contract security terms audit report
• Owner: Legal + HR + CISO
• Activities:
  1. Review all current employment contract templates
  2. Identify security-related clauses (or absence thereof)
  3. Review contractor and vendor personnel agreements
  4. Assess current acknowledgment processes (signature, digital, HRIS)
  5. Interview hiring managers about security communication
  6. Review current sanctions for security violations (documented? enforced?)
  7. Assess compliance with labor law requirements for contract terms

Week 2: Gap Analysis and Role Mapping

• Deliverable: Security responsibility gap analysis by role
• Owner: CISO + HR + Legal
• Activities:
  1. Map all roles to information access levels (Public, Internal, Confidential, Restricted)
  2. Define security responsibilities for each access level
  3. Identify roles with special requirements (remote, BYOD, IP creation, PII access)
  4. Assess current employee understanding of security responsibilities (survey)
  5. Identify gaps between current contracts and ISO 27001 requirements
  6. Map legal requirements (DPDP, labor law, industry-specific)
  7. Create security responsibility matrix by role

Phase 2: Design & Planning (Weeks 3-4)

Week 3: Contract Template Development

• Deliverable: Updated employment contract templates with security terms
• Owner: Legal + HR + CISO
• Activities:
  1. Draft security responsibilities clause for main employment contract
  2. Create role-specific security addendums (4 tiers)
  3. Create standalone security acknowledgment form
  4. Create remote work security addendum
  5. Create BYOD security addendum
  6. Create IP assignment and confidentiality clauses
  7. Create sanctions clause (graduated sanctions)
  8. Create return of assets clause
  9. Review all clauses for labor law compliance and enforceability

Week 4: Policy and Procedure Development

• Deliverable: Security Terms Management Procedure + Acknowledgment Tracking Procedure
• Owner: HR + CISO + Legal
• Activities:
  1. Create procedure for communicating security responsibilities during onboarding
  2. Create procedure for annual re-acknowledgment
  3. Create procedure for role-change acknowledgment updates
  4. Create procedure for sanctions enforcement (violation → investigation → decision → action)
  5. Create procedure for contract updates when policies change
  6. Create employee communication templates (email, presentation, video)
  7. Create manager training on enforcing security responsibilities

Phase 3: Implementation (Weeks 5-8)

Week 5: New Hire Contract Rollout

• Deliverable: All new hires receive updated contracts with security terms
• Owner: HR + Legal
• Activities:
  1. Update HRIS with new contract templates
  2. Train recruiters on new security clauses and their importance
  3. Implement new contract for all new hires
  4. Create new hire security briefing presentation
  5. Ensure new hires sign security acknowledgment before system access
  6. Create new hire security checklist (contract → acknowledgment → training → access)
  7. Test workflow with 5 new hires

Week 6: Existing Employee Retrospective Acknowledgment

• Deliverable: All existing employees acknowledge updated security responsibilities
• Owner: HR + CISO + IT
• Activities:
  1. Create communication campaign for existing employees ("Your Security Responsibilities")
  2. Deploy updated security acknowledgment to all employees
  3. Track acknowledgment completion (target: 100%)
  4. Follow up with non-responders (email, manager, HR)
  5. For employees who refuse acknowledgment: escalate to Legal and CISO
  6. Create audit trail of all acknowledgments
  7. Link acknowledgment to system access (no acknowledgment = no access for renewals)

Week 7: Contractor and Vendor Agreement Updates

• Deliverable: All contractor and vendor personnel agreements include security terms
• Owner: Legal + Procurement + Vendor Management
• Activities:
  1. Update contractor agreement template with security terms
  2. Create vendor personnel security addendum
  3. Renegotiate existing contracts with security terms (where possible)
  4. Create vendor security acknowledgment process
  5. Train procurement on security contract requirements
  6. Implement security terms in all new vendor contracts
  7. Create vendor security terms checklist

Week 8: Sanctions and Enforcement Implementation

• Deliverable: Sanctions framework operational; first training delivered
• Owner: CISO + HR + Legal + Line Managers
• Activities:
  1. Create graduated sanctions matrix (verbal warning → written warning → suspension → termination → legal action)
  2. Define security violation categories and corresponding sanctions
  3. Train managers on identifying and reporting security violations
  4. Create violation investigation procedure
  5. Create sanctions decision committee (HR, Legal, CISO, manager)
  6. Document first sanctions training session
  7. Create violation tracking system (incident + sanction + outcome)

Phase 4: Testing & Validation (Weeks 9-10)

Week 9: Contract and Acknowledgment Testing

• Deliverable: Validation report with test results
• Owner: HR + Internal Audit + CISO
• Activities:
  1. Test contract workflow end-to-end (offer → signature → acknowledgment → access)
  2. Test acknowledgment tracking system (completion %, follow-up, access blocking)
  3. Test role-change update procedure (promotion → new acknowledgment)
  4. Test sanctions procedure with mock violation scenario
  5. Test contractor security acknowledgment process
  6. Test contract update procedure when policy changes
  7. Verify all contracts meet labor law requirements

Week 10: Compliance Validation

• Deliverable: Compliance validation report
• Owner: Legal + Compliance Manager + HR
• Activities:
  1. Validate contract terms against DPDP Act 2023
  2. Validate sanctions against labor law (fairness, proportionality, due process)
  3. Validate acknowledgment process for DPDP compliance (consent, records)
  4. Verify enforceability of key clauses (non-compete, IP assignment, confidentiality)
  5. Test employee understanding (survey: do employees know their security responsibilities?)
  6. Prepare compliance evidence package

Phase 5: Documentation & Certification Prep (Weeks 11-12)

Week 11: Documentation

• Deliverable: Complete security terms management documentation
• Owner: HR + Compliance Manager
• Activities:
  1. Document all security contract templates and procedures
  2. Create training materials for managers and employees
  3. Create FAQ on security responsibilities
  4. Create metrics dashboard
  5. Create evidence repository for audits
  6. Document vendor contract management procedures

Week 12: Certification Readiness

• Deliverable: Audit-ready evidence package
• Owner: CISO + Compliance Manager
• Activities:
  1. Conduct internal audit of security terms management
  2. Prepare evidence for external ISO 27001 auditor
  3. Remediate any gaps found
  4. Conduct management review
  5. Present program to certification body

Detailed Implementation Guidance

Figure · Tiers

Maturity levels for terms and conditions of employment

Step-by-Step Implementation

Step 1: Define Security Responsibility Tiers

Step 2: Draft Core Security Responsibilities Clause

Step 3: Create Role-Specific Security Addendums

For Tier 1 and Tier 2 roles, create addendums with specific technical responsibilities:

Step 4: Implement Acknowledgment Process

Create a multi-layered acknowledgment process:

1. Contract Signature: Employee signs employment contract with security clause
2. Security Acknowledgment Form: Separate form listing all security responsibilities; employee initials each item and signs
3. Policy Acknowledgment: Employee acknowledges all information security policies (AUP, Data Protection, Remote Work, BYOD, etc.)
4. Training Completion: Employee completes security training and passes assessment
5. Annual Re-Acknowledgment: Employee re-signs acknowledgment annually
6. Role-Change Acknowledgment: Employee signs updated acknowledgment when role changes
7. Policy Update Acknowledgment: Employee acknowledges updated policies when changes occur

Step 5: Create Graduated Sanctions Matrix

Simulated phishing: a click in a phishing simulation is a learning event, not a violation. It triggers coaching, never sanctions (see A.6.3). Discipline applies to wilful or concealed breaches and to failing to report. ISO 27002 also expects the disciplinary process to consider whether the person was properly trained.

Note: For critical violations (theft, sabotage, espionage), first offense may result in immediate termination depending on severity and evidence.

Step 6: Implement Sanctions Enforcement Procedure

1. Detection: Violation detected through monitoring, incident report, audit, or tip
2. Initial Assessment: Security team assesses violation category and severity
3. Investigation: Formal investigation (interviews, evidence collection, log review)
4. Decision Committee: HR, Legal, CISO, and manager review investigation findings
5. Decision: Sanction determined based on matrix, violation history, and circumstances
6. Communication: Employee notified of violation and sanction in writing (with appeal rights)
7. Appeal: Employee may appeal to higher authority (VP HR, CEO for critical cases)
8. Execution: Sanction executed (warning recorded, suspension, termination, legal action)
9. Documentation: All steps documented; records maintained per retention policy
10. Follow-up: For non-termination cases, monitor for improvement; retraining effectiveness

Step 7: Create Remote Work Security Addendum

Step 8: Create BYOD Security Addendum

Step 9: Implement Annual Re-Acknowledgment

• Send annual security responsibility reminder to all employees
• Require re-signature of acknowledgment form
• Update responsibilities based on role changes
• Include updated policies and procedures
• Track completion rate (target: 100%)
• For non-completion: escalate to manager, then HR, then access review

Step 10: Link Acknowledgment to System Access

• Configure IAM to require valid acknowledgment for access renewal
• For employees with expired acknowledgment: flag for review, restrict access after 30 days
• For new hires: no system access until acknowledgment is signed
• For role changes: access updated only after new acknowledgment
• Create automated workflow: expiration notice → manager alert → access restriction

Step 11: Create Employee Understanding Verification

• Annual security awareness quiz (mandatory, scored)
• Role-specific security scenario tests
• Phishing simulation (results not punitive but inform training)
• Manager one-on-one discussions about security responsibilities
• Anonymous survey: "Do you understand your security responsibilities?"

Step 12: Implement Contract Update Process

• When security policy changes, update contract templates
• For significant changes: require existing employees to re-acknowledge
• Maintain version control for all contract templates
• Legal review of all changes for enforceability
• Communicate changes to employees with explanation

Step 13: Create Performance Review Integration

• Include security responsibility compliance in annual performance reviews
• For Tier 1 and 2: security compliance is a formal performance metric
• Security incidents and violations affect performance ratings
• Security training completion affects performance ratings
• Create security champion recognition program

Step 14: Document and Maintain Records

• Maintain all signed contracts and acknowledgments
• Maintain sanctions records (investigation, decision, outcome)
• Maintain training completion records
• Maintain policy version history
• Secure disposal after retention period (7 years or employment + 7 years)
• DPDP compliance for all personnel records

Step 15: Implement Continuous Improvement

• Annual review of security terms and sanctions
• Quarterly metrics review
• Annual employee understanding survey
• Benchmark against industry practices
• Update for regulatory changes (DPDP, labor law, industry-specific)
• Learn from incidents and violations to improve terms

Tools, Technologies, and Solutions

Complete Tool Comparison

Recommendations by Organization Size

Policy and Procedure Templates

Employment Security Terms Policy (Key Sections)

Sanctions Enforcement Procedure

Risk Assessment and Treatment

Key Risks Addressed by This Control

Audit and Compliance Checklist

Audit Questions (25 Questions)

Metrics and KPIs

Key Metrics Dashboard

Common Pitfalls and How to Avoid Them

Illustrative Scenarios

Illustrative scenario, a composite example for guidance, not a specific Singahi engagement or a verified outcome.

Illustrative Scenario 1: Indian SaaS Company, CloudTech Solutions

Company Profile:

• Size: 280 employees
• Industry: B2B SaaS, Cloud Infrastructure Management
• Location: Pune, India
• Customers: 450 enterprise clients globally
• Regulatory Scope: DPDP Act 2023, SOC 2 Type II, ISO 27001, GDPR

Challenge: CloudTech had grown rapidly from 50 to 280 employees in 2 years but employment terms were outdated:

• Employment contracts had a generic "comply with company policies" clause with no security specifics
• No security acknowledgment form; employees signed contract but never specifically acknowledged security responsibilities
• A senior developer left and joined a competitor, taking proprietary orchestration code (no IP assignment clause enforced)
• No sanctions for security violations; an employee who shared credentials with a colleague received no formal action
• Remote work exploded during COVID but no remote work security addendum existed
• 45 contractors had no security terms in their contracts
• No annual re-acknowledgment; employees who joined 2 years ago had never revisited security terms
• A developer used personal laptop for work without BYOD agreement; laptop was infected with malware that spread to company network
• Performance reviews had no security component; security compliance was not rewarded or penalized

Solution:

1. Month 1: Contract and Policy Redesign

   • Engaged an external security consultant to redesign employment security terms
   • Created 4-tier security responsibility framework (Critical, High, Medium, Low)
   • Updated employment contract template with detailed security clause
   • Created role-specific security addendums (Developer, Admin, Support, Sales, etc.)
   • Created security acknowledgment form with 15 core responsibilities (employee initials each)
   • Created remote work security addendum
   • Created BYOD security addendum
   • Legal review for Indian labor law compliance and enforceability

2. Month 2: New Hire Implementation

   • Implemented new contract for all new hires
   • Integrated security acknowledgment into onboarding workflow (Day 1 mandatory)
   • No system access granted until acknowledgment signed (IAM integration)
   • Created onboarding security briefing (30 minutes, mandatory, scored quiz)
   • Trained recruiters on communicating security terms during hiring

3. Month 3: Existing Employee Retrospective Acknowledgment

   • Deployed annual security acknowledgment to all 280 employees
   • Used DocuSign for electronic signatures with tracking
   • Achieved 98% completion in 30 days
   • For 6 employees who didn't complete: manager follow-up, then HR, then restricted access
   • For 2 employees who refused: Legal review, disciplinary process, eventual termination

4. Month 4: Contractor and Vendor Updates

   • Updated contractor agreement template with security terms
   • Required 45 existing contractors to sign updated terms
   • Created vendor personnel security addendum for 12 vendors with system access
   • Added security terms to all new vendor contracts
   • Trained procurement on security contract requirements

5. Month 5: Sanctions and Performance Integration

   • Created graduated sanctions matrix (Minor → Moderate → Major → Critical)
   • Established Sanctions Committee (HR, Legal, CISO, manager)
   • Trained all managers on identifying and reporting violations
   • Integrated security compliance into performance reviews (10% weight for Tier 1-2)
   • Created security champion recognition program (quarterly awards)
   • First sanctions applied: 3 verbal warnings, 2 written warnings, 1 suspension

6. Month 6: Remote Work and BYOD

   • Required remote work addendum for all 180 remote workers
   • Required BYOD addendum for 85 employees using personal devices
   • Implemented MDM (Microsoft Intune) for BYOD enrollment
   • Created remote work security checklist and self-assessment
   • Conducted remote work security training (1 hour, mandatory)

Results:

• IP protection: IP assignment clause enforced; 2 patent applications filed by employees with proper assignment
• Security violations: fewer violations within 6 months
• Sanctions: Fair and consistent sanctions applied; zero legal challenges
• Employee understanding: 94% average score on security responsibility quiz (up from 62%)
• Contractor compliance: 100% of contractors with security terms; no contractor incidents
• Remote work: Zero remote work-related security incidents in 6 months
• BYOD: 100% BYOD enrollment in MDM; malware incident prevented through MDM
• Performance integration: Security compliance became part of culture; 3 employees promoted partly for security excellence

Illustrative Scenario 2: Large Manufacturing Enterprise, Steel India Ltd.

Company Profile:

• Size: 12,000 employees, 8,500 unionized workers
• Industry: Steel Manufacturing, Integrated Steel Plant
• Location: Rourkela, Odisha
• Operations: 3 steel plants, 15 mines, 8 processing units
• Regulatory Scope: DPDP Act 2023, OSH Code 2020, Mines Act, Industrial Relations Code, ISO 27001, OHSAS 18001
• Union: Strong trade union presence; collective bargaining agreement

Challenge: Steel India had complex labor relations and outdated security terms:

• Employment contracts for 8,500 union workers were governed by collective bargaining agreement (CBA) with no security terms
• Only 3,500 non-union staff had individual contracts; security terms were generic and unenforced
• Standing orders had no information security provisions
• Strong union resistance to any new contractual terms without negotiation
• OT/ICS (Operational Technology) security was critical but operators had no security obligations in contracts
• No sanctions for security violations due to union protection and lack of contractual basis
• A contract worker stole proprietary steel formulation data and sold it to Chinese competitor
• No IP assignment clause for R&D staff; 2 senior researchers left and filed patents in their own names
• No return of assets clause; departing employees routinely took laptops, documents, and data
• CBA renewal was upcoming (every 3 years); security terms had to be negotiated with union

Solution:

1. Months 1-3: Union Engagement and CBA Negotiation

   • Engaged an external security consultant for labor-law-compliant security terms program
   • Established Security-Labor Relations Committee (management + union representatives)
   • Conducted 12 workshops with union leaders explaining security risks and business impact
   • Presented data: 1 OT security incident could shut down plant for days, affecting 12,000 jobs
   • Negotiated security terms as part of CBA renewal (security as job protection, not surveillance)
   • Agreed on graduated sanctions with union appeal process (grievance mechanism)
   • Union agreed to security terms in exchange for: cybersecurity training as paid work time, security equipment, no surveillance of personal activity

2. Months 4-6: CBA and Standing Orders Update

   • Updated Standing Orders with information security provisions (work discipline, asset protection, data handling)
   • Created security addendum for CBA (appendix to main agreement)
   • Defined security responsibilities for different worker categories (operators, supervisors, managers, R&D)
   • Created union-approved sanctions matrix (with union representative on sanctions committee)
   • Updated CBA to include: security training as paid time, security equipment provision, whistleblower protection
   • Standing Orders approved by labor commissioner as required

3. Months 7-9: Non-Union Staff and R&D

   • Updated individual contracts for 3,500 non-union staff with detailed security terms
   • Created IP assignment and invention disclosure process for 450 R&D staff
   • Created patent reward program (union-approved): for filed patent, for granted patent
   • Implemented return of assets clause with exit verification
   • Created NDA for all staff with access to proprietary processes
   • Implemented security acknowledgment for all non-union staff (100% completion)

4. Months 10-12: Contractor and Vendor Security

   • 4,200 contract workers required to sign security terms (through contractor companies)
   • Contractor companies required to provide security training to their workers
   • Created vendor security terms for 85 critical vendors (equipment, technology, maintenance)
   • Implemented security orientation for all contract workers (15 minutes, paid)
   • Created contractor security violation reporting to contractor company (joint management)

5. Months 13-15: Training and Culture

   • Security training made mandatory and paid (union requirement)
   • Created plant-specific security scenarios (OT security, physical security, process safety)
   • Created security awareness campaign in Odia and Hindi (local languages)
   • Integrated security into daily toolbox talks (5-minute security tip)
   • Created security suggestion scheme (employee suggestions rewarded)
   • Union representatives became security champions (peer-to-peer messaging)

Results:

• CBA acceptance: First CBA in Indian manufacturing with complete security terms; became industry reference
• Security incidents: fewer security incidents within 12 months
• OT security: Zero OT security incidents; passed critical infrastructure audit
• IP protection: 3 patents filed with proper assignment; no IP theft incidents
• Contractor compliance: 100% contract worker security acknowledgment; 1 contractor violation detected and addressed
• Union relations: Security terms strengthened union-management relationship (shared security goals)
• efficiency gains: program cost vs. potential plant shutdown cost (+ crore/day) + IP loss
• Industry recognition: Won FICCI Industrial Security Excellence Award; featured in national labor journal

Multi-Framework Mapping

The references below genuinely overlap with A.6.2. Use them when one set of evidence must satisfy several frameworks.

Regulatory and Industry Context

India Regulatory Framework

International Regulations

Sector-Specific Requirements

Roles and Responsibilities (RACI)

Documentation and Evidence Requirements

Required Documents

Continuous Improvement

Maturity Model (Level 1-5)

Improvement Cycle

• Plan: Annual review of terms; quarterly metrics; regulatory change monitoring; industry benchmarking
• Do: Update contracts; deploy new tools; train managers; enhance sanctions; improve communication
• Check: Measure understanding; audit enforcement; benchmark; gather feedback; review disputes
• Act: Standardize; communicate; update procedures; report to management; share best practices

Technology Trends

• Dynamic Contracts: AI-generated role-specific contract terms based on access and risk
• Blockchain Acknowledgment: Immutable acknowledgment records for audit and legal evidence
• Behavioral Analytics: Predicting compliance risk based on behavior patterns
• Continuous Acknowledgment: Real-time policy acknowledgment as policies change
• Natural Language Contracts: Simplified contract language for better employee understanding
• Gamified Compliance: Engagement-driven acknowledgment and training
• Union-Tech Platforms: Digital platforms for union-management security collaboration

FAQ

Frequently Asked Questions (20 Questions)

Q1: Are security terms enforceable in Indian employment contracts? A: Yes, if they are reasonable, clearly communicated, and comply with labor law. They cannot violate fundamental labor rights. Sanctions must be proportionate and follow due process.

Q2: Can we terminate an employee for a security violation? A: Yes, for serious violations, but you must follow due process: show cause notice, inquiry, opportunity to defend, reasoned order. For critical violations (theft, sabotage), immediate suspension is possible pending inquiry. Consult Legal.

Q3: Do security terms apply to unionized workers? A: Yes, but they may need to be negotiated through collective bargaining or included in standing orders. Unilateral changes may be challenged. Engage union early and frame security as job protection.

Q4: What if an employee refuses to sign the security acknowledgment? A: You can withhold system access and escalate to HR and Legal. If they continue to refuse, disciplinary action up to termination may be warranted (subject to due process). Document all steps.

Q5: Can we change security terms without employee consent? A: For non-union employees, you can update terms with reasonable notice (typically 30 days) if the contract allows. For union employees, changes may require negotiation. Always provide notice and re-acknowledgment.

Q6: Are non-compete clauses enforceable in India? A: Section 27 of the Indian Contract Act generally renders non-compete clauses void as restraint of trade. However, courts have enforced reasonable confidentiality and non-solicitation clauses. Focus on NDA and IP protection rather than non-compete.

Q7: Do we need separate security terms for remote workers? A: Yes. Remote work introduces unique risks (home environment, personal networks, family access). A specific remote work addendum should address workspace security, VPN use, device security, and data handling at home.

Q8: Can contractors be held to the same security terms as employees? A: Yes, through contractor agreements. However, enforcement mechanisms differ. Ensure contractor agreements have clear security terms, and require contractor companies to enforce them. Joint liability can be structured.

Q9: What should be in a BYOD addendum? A: Device registration, encryption requirement, MDM enrollment, approved apps, data separation, remote wipe authorization, no jailbreak/root, OS updates, and data transfer restrictions.

Q10: How do we handle security terms for international employees? A: Comply with local labor law in each country. Security terms should be globally consistent but locally compliant. Use local legal counsel for contract review. Data protection terms must comply with local privacy law (GDPR, etc.).

Q11: Can we include security responsibilities in the offer letter? A: Yes, offer letters can include a summary of security responsibilities with a reference to the full security policy and acknowledgment form. This sets expectations before the detailed contract.

Q12: What is the difference between a security policy and security terms in a contract? A: The security policy defines what the organization requires. The contract terms make compliance a contractual obligation with consequences for breach. Both are needed, the policy educates, the contract enforces.

Q13: Do interns and trainees need security terms? A: Yes, if they have access to information or systems. Use simplified terms appropriate to their role and duration. Include confidentiality obligations and return of assets.

Q14: How do we handle security terms for board members? A: Board members should sign NDAs and confidentiality agreements. They should acknowledge security responsibilities if they have access to sensitive information. Director agreements under Companies Act should include relevant terms.

Q15: Can we monitor employees based on security terms? A: Yes, but monitoring must be proportionate, transparent, and comply with DPDP Act 2023 and labor law. Employees should be informed of monitoring. Personal monitoring must be minimized. Consult Legal.

Q16: What is a garden leave and when should we use it? A: Garden leave is when an employee remains employed during notice period but does not work. It's useful for sensitive roles to prevent data theft during transition. Must be in contract and complies with labor law.

Q17: Do we need an employment bond for security? A: Indian courts generally enforce only reasonable recovery of genuine training costs (Indian Contract Act s.74); penalty-style bonds are not enforced. For security, focus on enforceable terms (NDA, IP assignment, return of assets) rather than bonds.

Q18: How do we integrate security into performance reviews? A: Define security KPIs (training completion, incident involvement, policy compliance, security suggestions). Include them as 5-10% of performance score for relevant roles. Recognize security excellence.

Q19: What is the role of CISO in employment security terms? A: CISO defines security responsibilities, sanctions, and policy content. CISO reviews violations, participates in sanctions committee, and ensures security terms are technically enforceable.

Q20: What will an ISO 27001 auditor look for in A.6.2? A: The auditor will verify: (1) security responsibilities are in employment contracts, (2) responsibilities are communicated to employees, (3) employees acknowledge responsibilities, (4) sanctions are defined, (5) sanctions are applied when appropriate, (6) contractor terms exist, (7) records are maintained, and (8) the program is reviewed.

References and Further Reading

ISO Standards

• ISO 27001:2022: Information Security Management Systems
• ISO 27002:2022: Information Security Controls
• ISO 27701:2019: Privacy Information Management System
• ISO 27036: Information Security for Supplier Relationships

Indian Law

• Indian Contract Act 1872: Section 27 (restraint of trade)
• Industrial Relations Code 2020 (standing orders; replaced the Industrial Employment (Standing Orders) Act 1946)
• Industrial Relations Code 2020 (replaced the Industrial Disputes Act 1947)
• OSH Code 2020 (replaced the Factories Act 1948)
• Shops and Establishments Act (state-specific)
• Companies Act 2013: Director duties, DIN
• DPDP Act 2023: Data protection obligations
• IT Act 2000: Reasonable security practices
• POSH Act 2013: Employee obligations
• OSH Code 2020 (replaced the Contract Labour Act 1970)
• Code on Wages 2019 (replaced the Minimum Wages Act 1948)
• Code on Social Security 2020 (replaced the EPF Act 1952)
• ESI Act 1948

International

• GDPR (EU): Articles 5, 28, 32
• HIPAA (US): §164.308(a)(3)**, Workforce security
• SOX (US): Internal controls
• UK Employment Rights Act 1996
• EU Whistleblower Directive
• ILO Conventions: Worker rights

Industry

• NASSCOM: IT industry employment practices
• ISACA: Security and governance guidance
• CII: Industrial employment practices
• FICCI: Business and employment law