Why it matters
Security expectations need to be a stated condition of employment, not an assumption.
How a self-led small team implements it
A clause in your standard employment contract or handbook referencing security responsibilities is sufficient.
What auditors expect to see
Employment contract or handbook excerpt.
Track A.6.2 in your own Statement of Applicability — mark it applicable, log your justification, and link it to the risk that drove it.
Start your ISMS