[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:iso-27001\u002Fa-6-2":3},{"item":4,"lessons":16,"controls":22,"related":27},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"iso-27001","a-6-2","Annex A 6.2","Terms and conditions of employment",1,"International Organization for Standardization (ISO) and IEC","**What it asks for.** Employment contracts should state the information security responsibilities of both the individual and the organisation. Personnel should understand and accept these before they are given access.\n\n**In practice.** Contracts or linked documents reference the security policy, acceptable use rules, confidentiality obligations and the consequences of non compliance, and they cover duties that continue after employment ends. Equivalent terms are included in contractor and agency agreements. When responsibilities or legislation change, terms are updated and staff are informed. Evidence includes contract templates, signed acknowledgements and the policy documents they reference.\n\n**Common gaps.** Older contracts predating current policies are rarely updated, and agency staff are often engaged on supplier paperwork that says nothing about security. Acceptable use acknowledgements may be collected once and never refreshed.",null,"https:\u002F\u002Fwww.iso.org\u002Fstandard\u002F27001","See the standard at ISO","2026-10-18T15:18:43.664+00:00",{"total":9,"list":17},[18],{"slug":19,"title":20,"published_at":21},"460k-gdpr-fine-for-unlawful-retrospective-employee-email-monitoring","€460K GDPR Fine for Unlawful Retrospective Employee Email Monitoring","2026-08-11T14:21:30.792+00:00",[23],{"slug":24,"name":25,"problem":26,"stories":9},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",[28,33,37,42,46,51,55,60],{"family":29,"item":30,"code":31,"title":32,"together":9},"cis","3","Control 3","Data Protection",{"family":29,"item":34,"code":35,"title":36,"together":9},"8","Control 8","Audit Log Management",{"family":38,"item":39,"code":40,"title":41,"together":9},"gdpr","5","Article 5(1)(f)","Principles relating to processing of personal data",{"family":38,"item":43,"code":44,"title":45,"together":9},"88","Article 88","Processing in the context of employment",{"family":47,"item":48,"code":49,"title":50,"together":9},"iso","27701","ISO\u002FIEC 27701","ISO\u002FIEC 27701: Privacy information management systems",{"family":52,"item":53,"code":54,"title":54,"together":9},"itil","overview","ITIL",{"family":56,"item":57,"code":58,"title":59,"together":9},"nist-800-53","ac-3","AC-3","Access Enforcement",{"family":56,"item":61,"code":62,"title":63,"together":9},"au-2","AU-2","Event Logging"]