HR-06 Non-disclosure Agreements
Changed since C5:2020
Basic criterion
Specified which data types the criterion applies to.
Further specified frequency of reviews by requiring them to be conducted in case of significant changes to the cloud service as well.
Added requirement regarding cases in which no agreement regarding updated confidentiality agreements can be reached.
Wording in C5:2020
Basic criterion
The non-disclosure or confidentiality agreements to be agreed with internal employees, external service providers and suppliers of the Cloud Service Provider are based on the requirements identified by the Cloud Service Provider for the protection of confidential information and operational details.
The agreements are to be accepted by external service providers and suppliers when the contract is agreed. The agreements must be accepted by internal employees of the Cloud Service Provider before authorisation to access data of cloud customers is granted.
The requirements must be documented and reviewed at regular intervals (at least annually). If the review shows that the requirements need to be adapted, the non-disclosure or confidentiality agreements are updated.
The Cloud Service Provider must inform the internal employees, external service providers and suppliers and obtain confirmation of the updated confidentiality or non-disclosure agreement.
Basic criterion
The non-disclosure or confidentiality agreements to be agreed with internal personnel and service organisations of the cloud service provider are based on the requirements identified by the cloud service provider for the protection of confidential information and operational details.
Supplementary information
A non-disclosure agreement (NDA) is a legal document and has content required by both parties to protect confidential information. Processes and procedures around media handling can be managed separately outside of the NDA. An NDA should cover:
- Which information or data types must be kept confidential;
- The period for which this confidentiality agreement applies;
- What actions must be taken upon termination of this agreement, e.g. destruction or return of data medium;
- How the ownership of information is regulated;
- What rules apply to the use and disclosure of confidential information to other partners, if necessary; and
- The consequences of a breach of the agreement.
These agreements are described in general in HR-02.
The agreements are to be accepted by service organisations when the contract is agreed.
The agreements are to be accepted by internal personnel of the cloud service provider before authorisation to access cloud service customer data, cloud service derived data, cloud service provider data and account data is granted.
The requirements are documented and reviewed at regular intervals (at least annually), as well as in case of significant changes to the cloud service. If the review shows that the requirements need to be adapted, the non-disclosure or confidentiality agreements are updated.
The cloud service provider informs the internal personnel and service organisations and obtains confirmation of the updated confidentiality or non-disclosure agreement.
In instances where an agreement on the updates cannot be reached, the cloud service provider assesses the resulting risks to information security according to OIS-07.
Related criteria
BSI text from C5:2026 and its changelog: © Federal Office for Information Security 2026, reproduced unchanged under CC BY-ND 4.0. Unofficial site, not affiliated with BSI. Licence and sources