[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:iso-27001\u002Fa-6-6":3},{"item":4,"lessons":16,"controls":22,"related":27},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"iso-27001","a-6-6","Annex A 6.6","Confidentiality or non-disclosure agreements",1,"International Organization for Standardization (ISO) and IEC","**What it asks for.** Agreements reflecting the organisation's need to protect information should be identified, documented, regularly reviewed and signed by personnel and other relevant interested parties.\n\n**In practice.** Legal maintains standard agreements for employees, contractors, suppliers and other parties, covering what information is protected, how long obligations last, what happens on breach and how information is returned or destroyed at the end. Agreements are signed before access is given and stored so they can be found. Templates are reviewed periodically and when the organisation's needs or the law change. Evidence includes current templates, signed agreements for sampled people or suppliers and a record of template reviews.\n\n**Common gaps.** Signed copies are often missing for long standing staff or for contractors engaged through agencies. Templates also go years without review, so they may not reflect current information types or legal requirements.",null,"https:\u002F\u002Fwww.iso.org\u002Fstandard\u002F27001","See the standard at ISO","2026-10-18T15:18:43.664+00:00",{"total":9,"list":17},[18],{"slug":19,"title":20,"published_at":21},"insider-threat-hidden-recorder-found-in-openai-executive-conference-room","Insider Threat: Hidden Recorder Found in OpenAI Executive Conference Room","2026-10-14T04:20:18.348+00:00",[23],{"slug":24,"name":25,"problem":26,"stories":9},"deception","Deception and honeypots","An attacker who gets in quietly can explore the network for weeks before any alarm goes off.",[28,33,37,42,46,50,55,59],{"family":29,"item":30,"code":31,"title":32,"together":9},"cis","17","Control 17","Incident Response Management",{"family":29,"item":34,"code":35,"title":36,"together":9},"6","Control 6","Access Control Management",{"family":38,"item":39,"code":40,"title":41,"together":9},"gdpr","32","Article 32","Security of processing",{"family":5,"item":43,"code":44,"title":45,"together":9},"a-7-2","Annex A 7.2","ISO\u002FIEC 27001:2022 Annex A 7.2: Physical entry",{"family":47,"item":48,"code":49,"title":49,"together":9},"itil","overview","ITIL",{"family":51,"item":52,"code":53,"title":54,"together":9},"nist-800-53","at-2","AT-2","Literacy Training and Awareness",{"family":51,"item":56,"code":57,"title":58,"together":9},"ir-6","IR-6","Incident Reporting",{"family":51,"item":60,"code":61,"title":62,"together":9},"pe-3","PE-3","Physical Access Control"]