Non-disclosure agreements (NDAs) are a crucial tool for protecting an organization's sensitive information. They establish legally binding terms that define what information is confidential, who can access it, and how it must be handled. Reviewing NDA requirements at regular intervals ensures they stay aligned with the organization's evolving security needs.

Where did this come from?

This control comes from the CSA Cloud Controls Matrix v4.0.10 - 2023-09-26. You can download the full matrix here. The matrix provides a comprehensive set of controls for securing cloud environments.

Who should care?

• Legal teams responsible for drafting and enforcing NDAs
• Security professionals looking to protect sensitive data
• Executives overseeing partnerships and vendor relationships
• Employees and contractors with access to confidential information

What is the risk?

Without proper NDAs in place, an organization risks unauthorized disclosure of its proprietary information, trade secrets, and customer data. This could lead to:

• Competitive disadvantage if key business strategies or IP are leaked
• Reputational damage and loss of customer trust after a data breach
• Regulatory fines and legal action for failing to protect sensitive data

The extent of damage depends on the sensitivity of exposed data and scale of disclosure. Well-crafted NDAs significantly reduce these risks by attaching clear legal consequences to confidentiality breaches.

What's the care factor?

For organizations handling highly sensitive data (e.g. cutting-edge tech, financial, healthcare), NDA controls should be a top priority. A single leak could be catastrophic. Even for lower-risk businesses, basic NDA hygiene is a must-have to maintain data integrity and customer confidence. Investing effort upfront to get NDAs right pays dividends.

When is it relevant?

NDAs are essential whenever sharing confidential data with external parties like:

• Vendors and service providers
• Business partners and acquisition targets
• Beta customers and user research subjects

They're also useful for employee and contractor onboarding. NDAs are less relevant for data that is already public or not sensitive in nature. Over-using NDAs can slow down business velocity.

What are the trade-offs?

Implementing NDA controls requires:

• Significant legal expertise to draft bulletproof agreements
• Ongoing time and effort to tailor NDAs to each engagement
• Potential friction in business relationships (NDAs can feel adversarial)
• Reduced speed and agility when engaging third-parties

However, these costs pale in comparison to a major breach. Strong NDAs protect the organization's crown jewel assets.

How to make it happen?

1. Catalog and classify data based on sensitivity
2. Define standard NDA templates with clear terms:
   • Scope of confidential data
   • Allowed uses and disclosures
   • Required safeguards
   • Consequences for breach
   • Duration of agreement
3. Establish NDA review cycle (e.g. annually)
4. Train employees on NDA protocols
5. Integrate NDAs into vendor onboarding
6. Monitor and enforce compliance
7. Securely retain signed NDAs
8. Update NDA terms as needed

What are some gotchas?

• Ensure NDA language is enforceable in relevant jurisdictions
• Watch out for loopholes or ambiguity that weaken protection
• Avoid NDA terms that unreasonably impede business
• Automate NDA lifecycle to reduce administrative burden
• Provide channel for safe reporting of suspected violations

AWS KMS and IAM can help secure storage and access to NDA documents:

• KMS Developer Guide
• IAM User Guide

What are the alternatives?

Alternative confidentiality controls include:

• Data encryption and access controls
• Confidentiality clauses in employment contracts
• Verbal confidentiality agreements (hard to enforce)
• Watermarking documents (does not prevent leaks)

However, NDAs are still the gold standard. Pair them with other controls for robust protection.

Explore further

• CSA Cloud Controls Matrix v4.0
• AWS Whitepaper on Data Protection
• ISO/IEC 27001 Information Security Management
• NIST SP 800-53 Rev. 5 Security Controls

This control supports:

• CIS Controls v8 - 3.3 (Data Protection), 17.6 (Incident Response Management)

Let me know if you have any other questions!

?