Confidentiality Review Checklist
1. Purpose
The Confidentiality Review Checklist provides a structured process for reviewing whether confidentiality requirements remain appropriate and effective for employees, contractors, consultants, suppliers, partners, customers, and other parties who have access to non-public information.
The objective is to verify that:
- Confidentiality obligations are identified
- Information requiring protection is understood
- Access remains appropriate
- NDAs and confidentiality agreements remain valid
- Confidentiality requirements reflect current risks
- Changes in roles, services, systems, or data are addressed
- Third-party confidentiality obligations remain appropriate
- Information is protected throughout its lifecycle
- Expired or unnecessary access is removed
- Confidentiality gaps are identified and corrected
- Review evidence is retained
Core Principle
Identify → Classify → Review Obligations → Review Access → Verify Protection → Address Gaps → Approve → Record → Monitor
2. When to Use
Perform a confidentiality review:
- Periodically
- During employee/contractor role changes
- Before contract renewal
- When new confidential information is introduced
- When information classification changes
- When customer requirements change
- When a supplier/subprocessor changes
- When new systems or cloud services are introduced
- After a confidentiality incident
- After a data breach
- When an NDA expires
- When an engagement is extended
- When a third party receives additional information
- During internal or independent security reviews
3. Review Information
| Field | Details |
|---|---|
| Review ID | |
| Review Date | |
| Review Type | |
| Person/Organization Reviewed | |
| Employee/Contractor/Supplier ID | |
| Business Owner | |
| Information Owner | |
| Reviewer | |
| Department/Project | |
| Contract/Engagement ID | |
| NDA/Agreement ID | |
| Previous Review Date | |
| Next Review Date | |
| Overall Result |
4. Review Type
Select the applicable review:
☐ Employee confidentiality review
☐ Contractor confidentiality review
☐ Supplier confidentiality review
☐ Customer confidentiality review
☐ Partner confidentiality review
☐ Consultant confidentiality review
☐ Project confidentiality review
☐ Information classification review
☐ NDA review
☐ Contract renewal review
☐ Post-incident review
☐ Periodic ISMS review
☐ Other: ______________________
5. Business Relationship Review
Confirm that the underlying relationship remains valid.
☐ Relationship remains active
☐ Business purpose remains valid
☐ Role remains unchanged
☐ Responsibilities remain unchanged
☐ Contract remains active
☐ Statement of Work remains current
☐ Project remains active
☐ Business owner remains correct
☐ Information owner remains correct
☐ Contractor/supplier organization remains correct
☐ Expected end date remains accurate
Changes Identified
6. Information Requiring Confidentiality
Identify the information currently accessible to the person or organization.
☐ Business information
☐ Customer information
☐ Personal data
☐ Financial information
☐ Intellectual property
☐ Source code
☐ Product information
☐ Architecture information
☐ Security information
☐ Vulnerability information
☐ Credentials/secrets
☐ Contracts
☐ Pricing information
☐ Strategic information
☐ Employee information
☐ Legal information
☐ Other: ______________________
Information Description
7. Information Classification Review
Confirm that information remains correctly classified.
☐ Public
☐ Internal
☐ Confidential
☐ Restricted
Questions
| Question | Response |
|---|---|
| Is the classification still appropriate? | |
| Has sensitivity increased? | |
| Has sensitivity decreased? | |
| Has new information been added? | |
| Has information been removed? | |
| Are customer requirements different? | |
| Are regulatory requirements different? |
Classification Decision
☐ No Change
☐ Classification Increased
☐ Classification Reduced
☐ Further Assessment Required
Rationale
8. Confidentiality Agreement Review
Verify the applicable NDA or confidentiality agreement.
☐ Agreement exists
☐ Correct party identified
☐ Correct legal entity identified
☐ Agreement is signed
☐ Agreement is effective
☐ Agreement has not expired
☐ Scope remains appropriate
☐ Confidential information definition remains appropriate
☐ Permitted-use requirements remain appropriate
☐ Disclosure restrictions remain appropriate
☐ Return/deletion requirements remain appropriate
☐ Post-termination confidentiality remains appropriate
☐ Legal requirements remain addressed
Agreement Details
Agreement ID: ______________________
Effective Date: ______________________
Expiry Date: ______________________
Confidentiality Period: ______________________
9. NDA Scope Review
Determine whether the existing agreement covers the information actually being shared.
☐ Business information
☐ Customer information
☐ Personal data
☐ Source code
☐ Product information
☐ Security information
☐ Vulnerability information
☐ Credentials/secrets
☐ Intellectual property
☐ Financial information
☐ Strategic information
☐ AI-related information
☐ Other: ______________________
Scope Adequacy
☐ Adequate
☐ Requires Amendment
☐ New NDA Required
☐ Legal Review Required
10. Access Review
Review all systems and information accessible to the person or organization.
| System | Information | Access Level | Required? | Owner | Action |
|---|---|---|---|---|---|
Confirm:
☐ Access remains necessary
☐ Access matches current role
☐ No unnecessary access exists
☐ Least privilege remains appropriate
☐ Shared access is avoided
☐ Access is individually attributable
☐ Expired access has been removed
☐ Privileged access remains justified
☐ Production access remains justified
☐ Customer access remains justified
11. Confidential Information Access
For each sensitive information category, verify:
☐ Business need exists
☐ Access is authorized
☐ Access is limited
☐ Need-to-know principle applied
☐ Information owner identified
☐ Access reviewed
☐ Unnecessary access removed
Access Decision
☐ Continue
☐ Reduce
☐ Remove
☐ Further Review Required
12. Employee Confidentiality Review
For employees:
☐ Employee remains in the same role
☐ Responsibilities reviewed
☐ Confidentiality obligations remain understood
☐ NDA/confidentiality acknowledgement remains valid
☐ Access remains appropriate
☐ Role-based access reviewed
☐ Privileged access reviewed
☐ Customer information access reviewed
☐ Source-code access reviewed
☐ Security information access reviewed
☐ Training remains current
If the employee has changed roles, perform the appropriate role-change and access review.
13. Contractor Confidentiality Review
For contractors:
☐ Contract remains active
☐ SOW remains current
☐ Contractor role remains unchanged
☐ NDA remains valid
☐ Information access remains required
☐ Project access remains appropriate
☐ Production access reviewed
☐ Privileged access reviewed
☐ Customer access reviewed
☐ Cloud access reviewed
☐ End date remains accurate
☐ Security requirements remain appropriate
14. Supplier Confidentiality Review
For suppliers/service providers:
☐ Supplier relationship remains active
☐ Contract remains valid
☐ NDA remains valid
☐ Security requirements remain current
☐ Information shared remains appropriate
☐ Access remains necessary
☐ Subprocessors reviewed
☐ Data locations reviewed
☐ Customer requirements reviewed
☐ Incident requirements reviewed
☐ Data return/deletion requirements reviewed
15. Third-Party Personnel
Where suppliers provide personnel:
☐ Personnel identified
☐ Personnel access individually attributable
☐ NDA/confidentiality requirements flow down
☐ Security requirements flow down
☐ Access is limited
☐ Personnel changes communicated
☐ Departed personnel access revoked
☐ Replacement personnel reviewed
16. Customer Confidentiality
Where customer information is involved:
☐ Customer confidentiality requirements identified
☐ Contract reviewed
☐ Customer NDA reviewed
☐ Data classification confirmed
☐ Access remains appropriate
☐ Customer-specific restrictions identified
☐ Data-sharing requirements reviewed
☐ Data retention requirements reviewed
☐ Data deletion/return requirements reviewed
17. Personal Data Confidentiality
If personal data is involved:
☐ Personal data identified
☐ Purpose of processing remains valid
☐ Access remains necessary
☐ Data minimization applied
☐ Privacy requirements reviewed
☐ Processing agreement reviewed where applicable
☐ Data location reviewed
☐ Retention reviewed
☐ Deletion requirements reviewed
☐ Breach notification requirements reviewed
18. Source Code and Intellectual Property
For source code or intellectual property:
☐ Access remains necessary
☐ Repository access reviewed
☐ Repository permissions appropriate
☐ Production deployment rights reviewed
☐ Branch permissions reviewed
☐ Source-code confidentiality remains applicable
☐ IP ownership requirements remain clear
☐ Download/export permissions reviewed
☐ Personal repository use prohibited where applicable
19. Credentials and Secrets
If the party can access credentials or secrets:
☐ Access remains required
☐ Secret access is restricted
☐ Individual accountability maintained
☐ Secrets stored securely
☐ Shared credentials minimized
☐ API keys reviewed
☐ Tokens reviewed
☐ SSH keys reviewed
☐ Certificates reviewed
☐ Rotation requirements assessed
☐ Unnecessary credentials revoked
Confidentiality review should never require copying passwords, private keys, API secrets, or other authentication values into the review record.
20. Cloud Confidentiality Review
For cloud environments:
☐ Cloud environment identified
☐ Data stored in cloud identified
☐ Access reviewed
☐ IAM permissions reviewed
☐ Privileged access reviewed
☐ Production access reviewed
☐ Logging available
☐ Data-sharing arrangements reviewed
☐ External integrations reviewed
☐ Cloud storage permissions reviewed
☐ Backup access reviewed
21. AWS SaaS Confidentiality Review
For an AWS SaaS startup, review:
☐ AWS account access
☐ IAM roles
☐ IAM groups
☐ SSO assignments
☐ Production access
☐ S3 bucket access
☐ Database access
☐ CloudWatch access
☐ Secrets Manager access
☐ KMS/key access
☐ CI/CD access
☐ Security tooling access
☐ Customer environment access
Example
A contractor previously had access to:
- AWS production
- S3 customer-data bucket
- GitHub
- CI/CD
- Monitoring
During review:
Need-to-Know Review → Reduce S3 Access → Confirm Production Need → Review GitHub Permissions → Review IAM Role → Verify NDA → Record Evidence
22. Information Storage Review
Determine where confidential information is stored.
☐ Approved corporate systems
☐ Approved cloud storage
☐ Approved SaaS applications
☐ Approved repositories
☐ Approved databases
☐ Approved collaboration platforms
☐ Local devices
☐ Removable media
☐ Personal cloud storage
☐ Personal email
☐ External AI services
Unauthorized Storage
☐ None identified
☐ Identified and corrected
☐ Risk accepted
☐ Incident investigation required
23. Information Transfer Review
Review how confidential information is transferred.
☐ Approved communication channels
☐ Encryption used where appropriate
☐ Secure file transfer
☐ Recipient verification
☐ Access-controlled sharing
☐ Data minimization
☐ External sharing approved
☐ Transfer logging where appropriate
Transfer Findings
24. Remote Work Review
Where remote access is permitted:
☐ Remote-working requirements remain appropriate
☐ Device security requirements satisfied
☐ MFA enabled
☐ Confidential information protected
☐ Screen-lock requirements followed
☐ Public Wi-Fi requirements understood
☐ Printing/storage requirements understood
☐ Personal-device restrictions followed
25. AI and Generative AI Review
Determine whether confidential information may be entered into AI or external services.
☐ Approved AI tools identified
☐ Confidential-data restrictions communicated
☐ Customer-data restrictions communicated
☐ Personal-data restrictions communicated
☐ Source-code restrictions communicated
☐ Security-information restrictions communicated
☐ AI data retention understood
☐ External processing understood
☐ Approved organizational accounts used
☐ No unauthorized confidential-data submission identified
Finding
26. Confidentiality Training
Verify that relevant personnel understand current confidentiality requirements.
☐ Security awareness training current
☐ Confidentiality requirements communicated
☐ Information classification training completed
☐ Data protection training completed where applicable
☐ Secure information handling understood
☐ Incident reporting understood
☐ AI/data-sharing requirements understood
Training Record
| Training | Date | Status | Evidence |
|---|---|---|---|
| Security Awareness | |||
| Confidentiality | |||
| Privacy | |||
| Role-Specific |
27. Confidentiality Incidents
Review whether confidentiality incidents occurred since the previous review.
☐ No incidents
☐ Unauthorized disclosure
☐ Accidental disclosure
☐ Data leakage
☐ Misdelivery
☐ Lost device
☐ Unauthorized access
☐ Unauthorized sharing
☐ Unapproved external service
☐ Other
If an incident occurred:
☐ Incident recorded
☐ Investigation completed/in progress
☐ Impact assessed
☐ Corrective action identified
☐ Access reviewed
☐ Confidentiality requirements updated where necessary
Incident Reference
28. Subprocessors and Subcontractors
For third parties:
☐ Subprocessors reviewed
☐ Subcontractors reviewed
☐ New parties identified
☐ Confidentiality obligations flow down
☐ Customer requirements flow down
☐ Security requirements flow down
☐ Data access reviewed
☐ Locations reviewed
29. Data Location Review
Confirm where confidential information is:
- Stored
- Processed
- Backed up
- Transferred
- Accessed
| Location | Activity | Information | Approved? | Action |
|---|---|---|---|---|
30. Retention and Disposal
Review whether confidential information is retained appropriately.
☐ Retention period defined
☐ Business need remains
☐ Legal retention considered
☐ Customer requirements considered
☐ Unnecessary copies removed
☐ Temporary files removed
☐ Local copies addressed
☐ Secure deletion applied where required
☐ Return/deletion obligations fulfilled
31. Confidentiality After Termination
Confirm continuing confidentiality obligations.
☐ Post-employment confidentiality applies
☐ Post-contract confidentiality applies
☐ Supplier confidentiality continues
☐ Customer confidentiality continues
☐ Return/deletion requirements defined
☐ Access revocation completed where applicable
☐ Assets returned where applicable
☐ Personal copies addressed
☐ Continuing obligations communicated
32. Contract and Legal Review
Determine whether contractual or legal requirements have changed.
☐ Contract reviewed
☐ NDA reviewed
☐ Customer requirements reviewed
☐ Privacy requirements reviewed
☐ Regulatory requirements reviewed
☐ Security requirements reviewed
☐ Data-location requirements reviewed
☐ Retention requirements reviewed
☐ Incident notification requirements reviewed
Legal/Contractual Changes
33. Confidentiality Findings
Record identified gaps.
| Finding ID | Area | Finding | Risk | Action | Owner | Due Date |
|---|---|---|---|---|---|---|
34. Risk Assessment
Assess significant confidentiality risks.
| Risk | Likelihood | Impact | Risk Level | Treatment | Owner |
|---|---|---|---|---|---|
Possible treatments:
- Reduce
- Avoid
- Transfer/Share
- Accept
Risk acceptance should follow the organization’s defined risk-acceptance process.
35. Corrective Actions
For identified issues:
☐ Access reduction
☐ Access removal
☐ NDA renewal
☐ Contract amendment
☐ Additional training
☐ Information classification update
☐ Data deletion
☐ Credential rotation
☐ Security control improvement
☐ Supplier remediation
☐ Incident investigation
☐ Policy update
☐ Other: ______________________
Corrective Action Register
| Action | Owner | Due Date | Status | Evidence |
|---|---|---|---|---|
36. Review Decision
Overall Result
☐ Satisfactory
☐ Satisfactory with Minor Actions
☐ Remediation Required
☐ NDA/Contract Update Required
☐ Access Reduction Required
☐ Risk Acceptance Required
☐ Further Investigation Required
☐ Not Satisfactory
Conditions
37. Approval
Information Owner
Name: ______________________
Role: ______________________
Date: ______________________
Business Owner
Name: ______________________
Role: ______________________
Date: ______________________
Security Reviewer
Name: ______________________
Role: ______________________
Date: ______________________
38. Follow-Up Review
Where findings were identified:
☐ Corrective actions completed
☐ Evidence reviewed
☐ Access changes verified
☐ NDA/contract updated
☐ Information deleted where required
☐ Risk reassessed
☐ Residual risk accepted where applicable
☐ Review closed
Closure Evidence
39. Confidentiality Review Register
Maintain a central register.
| Review ID | Party | Type | Classification | NDA Status | Access Status | Risk | Result | Next Review |
|---|---|---|---|---|---|---|---|---|
The register should help identify:
- Expiring NDAs
- Upcoming reviews
- High-risk relationships
- Open confidentiality findings
- Excessive access
- Missing agreements
- Overdue corrective actions
40. Evidence Requirements
Retain appropriate evidence such as:
- Completed confidentiality review
- NDA/confidentiality agreement
- Contract/SOW
- Access review evidence
- Information classification record
- Training record
- Security acknowledgement
- Data-processing agreement where applicable
- Supplier review evidence
- Subprocessor review
- Corrective actions
- Risk assessment
- Risk acceptance
- Incident records
- Deletion/return evidence
Do not store unnecessary passwords, API keys, private keys, credentials, or sensitive personal information in the review record.
41. Startup-Friendly Confidentiality Review Model
A startup can perform an effective confidentiality review without creating excessive administrative work.
Low Risk
Review:
- Relationship
- Information involved
- NDA/contract
- Access
- Classification
- Security acknowledgement
- Findings
Medium Risk
Add:
- Privacy assessment
- Access review
- Security training
- Data-location review
- Supplier/subprocessor review
- Retention review
High/Critical Risk
Add:
- Detailed access review
- Privileged-access review
- Production-access review
- Cloud review
- Customer requirements
- Independent assurance
- Subprocessor review
- Enhanced monitoring
- Formal risk assessment
- Corrective-action tracking
The review should be risk-based rather than a one-size-fits-all questionnaire.
42. Common Mistakes
Avoid:
- Treating an NDA as the complete confidentiality control.
- Failing to review access after a role change.
- Allowing expired NDAs to remain unnoticed.
- Ignoring confidentiality requirements in customer contracts.
- Giving suppliers more information than necessary.
- Ignoring subcontractors and subprocessors.
- Failing to review personal cloud storage.
- Allowing confidential information into unapproved AI tools.
- Keeping unnecessary copies of confidential information.
- Ignoring source-code confidentiality.
- Ignoring credentials and security information.
- Failing to review production access.
- Not tracking NDA expiry dates.
- Performing reviews but not recording evidence.
- Identifying findings without assigning owners and due dates.
43. Relationship With Other ISMS Documents
| Document | Relationship |
|---|---|
| Confidentiality and Non-Disclosure Policy | Defines confidentiality requirements |
| Employee Confidentiality Acknowledgement | Records employee acceptance |
| Employee NDA | Establishes employee confidentiality obligations |
| Contractor NDA | Establishes contractor confidentiality obligations |
| Supplier Confidentiality Agreement | Establishes supplier obligations |
| Mutual NDA | Protects information exchanged between parties |
| Confidentiality Requirements Matrix | Defines protection requirements by classification |
| NDA and Confidentiality Agreement Register | Tracks agreements and expiry |
| Information Classification Policy | Defines information sensitivity |
| Access Management Procedure | Controls access to information |
| Access Review Checklist | Reviews system access |
| Supplier Security Review | Reviews supplier security |
| Data Processing Agreement | Addresses personal-data processing |
| Incident Response Procedure | Handles confidentiality incidents |
| Employee Offboarding Policy | Addresses confidentiality after exit |
| Contractor Offboarding Procedure | Addresses contractor exit |
| Information Retention Policy | Defines retention requirements |
| Secure Disposal Procedure | Controls information disposal |
| Risk Register | Tracks significant confidentiality risks |
44. ISO 27001 / SOC 2 Connection
Confidentiality reviews support the organization’s broader information-security and risk-management processes.
Relevant areas may include:
- Information classification
- Access control
- Identity management
- Information transfer
- Supplier security
- Confidentiality obligations
- Personnel security
- Data protection
- Information retention
- Incident management
- Secure disposal
- Cloud security
For SOC 2, confidentiality review activities can support controls relating to:
- Logical access
- Confidentiality commitments
- Protection of confidential information
- Vendor/third-party management
- Data handling
- User access lifecycle
- Monitoring and review
The organization should determine the specific controls and evidence applicable to its ISMS and SOC 2 scope based on its risk assessment and contractual requirements.
45. Quick Audit Checklist
☐ Business relationship reviewed
☐ Information identified
☐ Information classification reviewed
☐ NDA identified
☐ NDA validity confirmed
☐ NDA scope reviewed
☐ Contract reviewed
☐ Access reviewed
☐ Least privilege confirmed
☐ Privileged access reviewed
☐ Production access reviewed
☐ Customer information reviewed
☐ Personal data reviewed
☐ Source-code access reviewed
☐ Cloud access reviewed
☐ AI/external-service use reviewed
☐ Information storage reviewed
☐ Information transfer reviewed
☐ Retention reviewed
☐ Subprocessors reviewed
☐ Confidentiality training reviewed
☐ Incidents reviewed
☐ Findings documented
☐ Risk assessed
☐ Corrective actions assigned
☐ Approval obtained
☐ Evidence retained
☐ Next review date defined
46. Document Control
| Field | Details |
|---|---|
| Document Name | Confidentiality Review Checklist |
| Document Owner | |
| Security Owner | |
| Version | |
| Effective Date | |
| Review Frequency | |
| Classification | Internal |
| Approved By | |
| Next Review Date |
47. Final Audit Trail
For every significant confidentiality relationship, the organization should be able to demonstrate:
What information is being protected?
How is it classified?
Who has access to it?
Why do they need access?
Is a valid NDA or confidentiality agreement in place?
Does the agreement cover the information actually being shared?
Are access permissions still appropriate?
Are customer and privacy requirements addressed?
Are subcontractors or subprocessors involved?
Where is the information stored and processed?
How is the information transferred?
How long is it retained?
Have any confidentiality incidents occurred?
What corrective actions were required?
Who reviewed and approved the outcome?
When will confidentiality be reviewed again?
Final Principle
Confidentiality is not established once by signing an NDA. It must remain appropriate throughout the relationship, information lifecycle, access lifecycle, and eventual termination of the relationship.
The complete control cycle should be:
Identify → Classify → Agree → Authorize → Protect → Review → Correct → Verify → Record → Reassess