Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

When bringing in an intern to help you in the IT world and with access to servers and client information, what kind of forms should be signed, especially when they work remotely?

share|improve this question
In addition to legally protecting yourself, your security should be set up in a way to easily revoke access once the intern leaves. ie not using shared passwords, etc – aus Mar 13 '13 at 3:26
up vote 4 down vote accepted

Since this mainly deals with law, the usual IANAL and YMMV disclaimers apply to this answer.

Most of what you're going to need in terms of protection should be part of the NDA clause in the intern's contract anyway, i.e. that they may not disclose any information about the operational details of the company or its clients to 3rd parties, even after his/her employment is terminated.

Having said that, here's a list of the types of cover I'd expect:

  • Non-disclosure agreement - a document that defines the types of operational information that are classed as sensitive, as well as the limitations on the intern in relation to such information. There are also usually clauses referring to ramifications of violating the NDA, recovery or destruction of storage media upon employment termination, etc. This is a standard legal document and any lawyer or legal department should have NDA templates galore.
  • Cessation agreement - a document that clearly defines the boundaries of access to client systems and data, enforcing that no access is to be allowed or maintained by the intern after his/her employment is terminated. Should the intern illegally log into a client system using an old password after they've left the company, this kind of document provides a reasonable legal barrier between you and the intern, so that they get sued/prosecuted instead of you.
  • Statement of liability - a document that defines liability for damages caused by or sustained to the intern, as well as details about public liability insurance and other regulatory statutes. This should be integrated into client contracts too, since they need to know who is liable should a damaging situation arise. For example, if your intern accidentally rm -rf /'s your client's production box, who does liability fall with? Is it directly on the employee (thus opening them up to lawsuits), on you as a company (thus opening you up to lawsuits), or is the damage considered something that the client must agree to upfront? This kind of document is designed to protect you, the intern, and your clients.
  • Acceptable conduct policy - a document which outlines various types of expected conduct and improper conduct. These are a staple of most employment handbooks, so it shouldn't be hard to write one. Make sure to include details about conduct when interacting with clients and client machines. This isn't strictly a legal document, but provides you with recourse should the intern go rogue. Without this kind of policy, you can potentially fall into the minefield of unfair dismissal laws if you have to fire the intern for bad behaviour.

Most importantly, make sure to speak to a lawyer and have a professional draft up the documents! This isn't the kind of thing you can do yourself, since most legal language is a quagmire of incredibly specific and colloquial meanings. Getting it wrong might mean it's not binding, which could leave you in a nasty situation later.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.