What it asks for. Employment contracts should state the information security responsibilities of both the individual and the organisation. Personnel should understand and accept these before they are given access.
In practice. Contracts or linked documents reference the security policy, acceptable use rules, confidentiality obligations and the consequences of non compliance, and they cover duties that continue after employment ends. Equivalent terms are included in contractor and agency agreements. When responsibilities or legislation change, terms are updated and staff are informed. Evidence includes contract templates, signed acknowledgements and the policy documents they reference.
Common gaps. Older contracts predating current policies are rarely updated, and agency staff are often engaged on supplier paperwork that says nothing about security. Acceptable use acknowledgements may be collected once and never refreshed.