Skip to main content
All measures

Measure · ISO 27001 and other standards

Agree security duties and hand them over

Clarify mutual security responsibilities and suitable confidentiality agreements in the existing contract process. Carry continuing duties and security responsibilities forward at a change or departure.

Accountable: Personnel or contract lead and relevant business roleReviewed

Reuse existing records

Use existing employment, engagement and project contracts and the change record. The employee and information protection policies remain the leading working rules; agreed clauses are not maintained a second time in those policies.

What to do

  1. 1

    Determine the required agreements

    For the duties, review the security responsibilities of the organisation and the person or external party. Clarify relevant legal and contractual duties, third-party information, intellectual property and the handling of violations. Define which information is confidential, its permitted use, permitted disclosure and which duties continue for how long. Include return or deletion at the end and the response to unauthorised disclosure; check suitable legal terms and enforceability.

  2. 2

    Agree existing terms and explain them

    Review suitable existing contract clauses, add missing terms and obtain signatures from relevant parties on required confidentiality agreements. Keep the contract version and parties in the protected contract records. Explain relevant duties before the work starts and refer to current employee and information protection rules. Acknowledgement does not replace a required signature.

  3. 3

    Handle changes and continuing duties

    Review agreements at the defined interval and when information, cooperation or legal conditions change. Explain continuing duties at a change or departure, such as confidentiality or protection of third-party information. In the existing change record, note the person or party, current agreement, communicated duties and outstanding clarifications.

  4. 4

    Hand over responsibilities and work resources

    Name the role taking over continuing security duties and inform relevant contacts. At a role change, address both the ending of previous duties and the start of new ones. Connect the record to existing asset return and actual access changes. Record acceptance and open points in the same record.

Worked example

An external project lead changes

Fictional example: An external project lead finishes the engagement. Confidential customer information and a security responsibility remain in the project.

Continuing duties and a new owner
DecisionThe contract owner explains the continuing confidentiality terms. The named replacement takes over the security duty; return and access changes use the existing change record.
EvidenceReference to the signed contract version, communicated continuing duties, new responsible role and actual handover status.

Record the result

  • Protected contract records with suitable agreed terms, relevant parties and required signatures.
  • Existing change record with continuing duties, communication, accepted security responsibility and linked asset-return and access-change results.

Common implementation mistakes

A new NDA document for every rule

Use suitable existing clauses and references to leading policies. Add only missing terms.

Only blocking the account

Also transfer security responsibilities and explain continuing duties.

Reuse the implementation across requirements

The references below show which requirements the measure contributes to.

View controls and standards
  • A.6.2 · BeschäftigungsbedingungenGerman guide

    The workflow addresses mutual security responsibilities in employment and engagement terms and their agreement and communication.

  • A.6.5 · Verantwortlichkeiten nach Beendigung oder Änderung der BeschäftigungGerman guide

    Continuing duties and the transfer of security responsibilities are handled in the existing record at a change or departure. Asset return and access changes reuse their separate workflows.

  • A.6.6 · Vertraulichkeits- oder GeheimhaltungsvereinbarungenGerman guide

    The steps determine suitable confidentiality terms, use appropriate existing contracts, obtain required signatures and maintain review. Specific content and legal effectiveness must be determined for the organisation.

  • TISAX · 2.1.2

    VDA ISA 6.0.3 · Partial overlap

    Security and confidentiality duties, including continuing obligations, are addressed contractually and communicated. This does not establish all remaining requirements, particularly actual compliance and handling of violations.

    Reference

Templates for your implementation

Related resources

Sources and further reading