As part of a a security audit, a customer has asked for some documentation - usual stuff - data classification policy, incident management policy etc. They have also asked for a blank employment contract. I don't see what use this could really be to a security audit, what is it they are looking for in this document?

  • 2
    The only thing that could possibly be even remotely relevant is NDA and protection around customer data. Nothing else could make sense, nor is it legitimate (in my mind) to even be asking for it. Why would they even think you have a standard contract that applies to everyone, anyway? How about you ask them what they want it for? Just because they asked doesn't mean the need it, nor that they should get it... Worst case, send them a blank document with the company letterhead...
    – AviD
    Commented Apr 6, 2017 at 10:52

1 Answer 1


Employment contracts do things like describe limits of liability, employee responsibilities, remediations, punishments, etc. There's a lot in there that will tell an auditor about how the company views security and data protection.

As someone who had to supply all this documentation, it was not an unusual request from 3rd party auditors.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .