A.6.4
Disciplinary process
People controlsCheckpoints 6Evidence 6Cases 6
Control objective
This control requires a formal, previously communicated disciplinary process to be established and applied consistently to employees and other relevant personnel who breach information security policies and rules. When the consequences of a breach are defined in advance and enforced fairly, personnel understand the importance of compliance, which produces a deterrent effect that discourages violations. The control aims to determine the level of action according to the severity, intent, recurrence, and legal implications of the breach, while ensuring that the process is fair and lawful.
Key checkpoints
- Is a disciplinary process for breaches of information security policies/rules documented formally and communicated in advance to employees and other relevant personnel?
- Are criteria in place to graduate the level of action based on the severity of the breach, whether it was intentional or negligent, whether it recurred, and its business impact?
- Is the disciplinary process designed to be consistent with applicable laws (labour/employment law) and the organization's work rules/internal regulations?
- When a breach is confirmed, are the steps of fact-finding investigation, opportunity for the individual to respond, decision, and notification carried out fairly and recorded?
- Is the existence of the disciplinary process and the consequences of a breach made known to personnel through training, security pledges, and similar means?
- Are disciplinary outcomes linked to preventing recurrence and improving the management system (policy revision, additional training, and so on)?
Implementation guidance
- Establish a formal disciplinary process that defines applicable actions by type of violation (warning, retraining, revocation of access rights, HR measures) and obtain management approval.
- Set criteria for deciding the level of action, considering the severity, intent, recurrence, organizational impact, and legal implications of the breach as a whole.
- Review consistency with labour/employment law, work rules, and collective agreements in advance to ensure the process is lawful and fair.
- When handling a breach, follow and record the stages of fact-finding investigation, giving the individual an opportunity to respond, deliberation/decision, and notification of the outcome.
- Communicate the existence of the disciplinary process and the consequences of a breach in advance through a security pledge signed at hiring and regular security training to achieve a preventive/deterrent effect.
- Because personal and sensitive HR information is handled, restrict access to investigation/disciplinary records and apply retention/disposal rules.
- Analyze the causes drawn from disciplinary cases and feed them into corrective actions such as policy/procedure revision and additional training to prevent recurrence.
Evidence
- Disciplinary process/regulation document applied to information security breaches, and record of management approval
- Action criteria by violation type (for example, a table for deciding the level of action) and documents linking to work rules/internal regulations
- Breach investigation reports, the individual's response materials, and deliberation/decision records
- Notification documents of disciplinary outcomes and records of follow-up actions such as revocation of access rights
- Training materials and security pledges used to make the disciplinary process known
- Records of cause analysis of disciplinary cases and of recurrence-prevention measures (policy revision, additional training)
Nonconformity examples
- There is no documented formal disciplinary process for information security breaches, so cases are handled arbitrarily on an individual basis.
- The disciplinary process is not communicated to personnel in advance, so they are unaware of the consequences of a breach.
- Similar breaches are handled inconsistently because severity, intent, and other factors are not taken into account.
- The process proceeds without fact-finding or giving the individual an opportunity to respond, so fairness/lawfulness is not ensured.
- A clear security breach occurs but the matter is closed with no action or record at all.
- Disciplinary cases are not linked to cause analysis or recurrence-prevention measures, so the same breach keeps recurring.