Why it matters
Sets a clear, enforceable expectation before anyone gets access to sensitive information.
How a self-led small team implements it
A standard NDA signed at onboarding, and separately with contractors/vendors, is sufficient.
What auditors expect to see
Signed NDAs.
Track A.6.6 in your own Statement of Applicability — mark it applicable, log your justification, and link it to the risk that drove it.
Start your ISMS