As part of a a security audit, a customer has asked for some documentation - usual stuff - data classification policy, incident management policy etc. They have also asked for a blank employment contract. I don't see what use this could really be to a security audit, what is it they are looking for in this document?
1
-
2The only thing that could possibly be even remotely relevant is NDA and protection around customer data. Nothing else could make sense, nor is it legitimate (in my mind) to even be asking for it. Why would they even think you have a standard contract that applies to everyone, anyway? How about you ask them what they want it for? Just because they asked doesn't mean the need it, nor that they should get it... Worst case, send them a blank document with the company letterhead...– AviD ♦Apr 6, 2017 at 10:52
Add a comment
|
1 Answer
Employment contracts do things like describe limits of liability, employee responsibilities, remediations, punishments, etc. There's a lot in there that will tell an auditor about how the company views security and data protection.
As someone who had to supply all this documentation, it was not an unusual request from 3rd party auditors.
answered Apr 6, 2017 at 11:05
