Disciplinary process
A formal disciplinary process is to be established and made known so that action can be taken against staff and relevant outside parties who break the security policy.
What the requirement asks
A formal disciplinary process is to be established and made known so that action can be taken against staff and relevant outside parties who break the security policy. Purpose: make sure people understand the consequences of breaching the policy, deter breaches and deal properly with those who commit them. Guidance: disciplinary action should start only after it has been verified that a violation actually occurred (5.28). The process provides a graduated response that weighs the nature of the breach (who, what, when, how), its seriousness and consequences; whether it was deliberate and malicious or accidental; whether it is a first or repeat offence; and whether the person had been properly trained. The response also accounts for legal, regulatory, contractual and business requirements and other relevant factors. The process doubles as a deterrent against breaching the policy, topic-specific policies and procedures, and deliberate violations may call for immediate action. Other information: where possible, protect the identity of people subject to disciplinary action in line with applicable requirements; consider rewarding people who show excellent security behaviour. In the ISMS the control is compared with the controls determined in risk treatment and recorded in the Statement of Applicability as included or excluded, with the reason and the implementation status.
What the guidance adds
The disciplinary process is the consequence behind the rules. The guidance asks for the process, the roles, the record and the consistent use of it.
Status of the guidance. The guidance lens for 6.4 reads the draft, which is at stage 40.00 and is not published, against the published ISO/IEC 27001:2022 requirement above. It is our reading, not a quotation, and it is not a requirement.
What good looks like
Put the control in the Statement of Applicability with an owner, a status and the risk it treats. Then keep the formal disciplinary procedure covering information security violations, communicated to personnel and relevant external parties and one live sample together.
Evidence an assessor asks for
- Disciplinary processThe formal disciplinary procedure covering information security violations, communicated to personnel and relevant external parties
- Disciplinary processCriteria for a graduated response considering nature, severity, intent, repetition and training received
- Disciplinary processCase records showing that violations were verified before action began
- Disciplinary processEvidence that legal, contractual and business requirements were considered in outcomes
- Disciplinary processCommunication or awareness material making the consequences of violations known
- Disciplinary processProvisions for protecting the identity of individuals subject to action
The question an assessor will ask
An assessor will ask for the formal disciplinary procedure covering information security violations, communicated to personnel and relevant external parties, then trace it to the system it protects. For A.6.4 the test is whether that record ties to a live sample, not whether the control is named in a policy.
Common gaps
- The HR disciplinary policy makes no mention of information security violations
- Action is taken on suspicion without verifying that a violation occurred
- Responses are inconsistent because there are no criteria for graduation
- Contractors and supplier staff fall outside any disciplinary mechanism
Before the next audit
Before the next audit, check one live sample for this gap: the hr disciplinary policy makes no mention of information security violations.