If a member of staff breaks the security policy, then how do we decide the disciplinary response?

Start

A member of staff has broken a security rule

One Annex A control asks for a formal disciplinary process that is communicated and covers breaches of security rules by staff and other relevant parties. The guidance expects it to be applied fairly. Security does not decide the sanction. HR, the line manager and Legal do, under employment law. Security's part is the facts, the link from the policies to the procedure, and a response that fits what happened.

• Then: Did they report their own mistake promptly and in good faith?

Decision

Did they report their own mistake promptly and in good faith?

People who report their own mistakes should not be blamed for reporting. The pack's incident routes say everyone must report at once and that a report made in good faith is never blamed. A person who clicked a real phishing email and told the service desk helped you. Not known: carry on to the facts.

• Yes: No disciplinary action for the report itself; handle it as an incident
• No, or not known: Preserve the facts and give them to HR

Outcome

No disciplinary action for the report itself; handle it as an incident

Thank the person, deal with the incident and fix the cause. Tell the person what happened. The report is the right behaviour and should look like it. Do not use a good-faith report as evidence against the person in a later case. If the facts later show a deliberate act, the report does not stop the process; take it to HR.

Step

Preserve the facts and give them to HR

Keep the logs, tickets and messages that show what happened, who did it and when, in a way that cannot be altered. Do not question the person yourself. Take advice on monitoring and data protection law before you look at anything personal, because what you may use differs by country.

• Then: Is there a disciplinary procedure that covers security breaches?

Decision

Is there a disciplinary procedure that covers security breaches?

The usual finding is a procedure that exists but is never linked to security, or one applied only to junior staff. The policies should say what the consequences are and point to the procedure. Not known takes the no branch.

• Yes: Is it deliberate, reckless, or a repeat after support?
• No, or not known: Ask HR to cover security breaches and to link the policies to it

Step

Ask HR to cover security breaches and to link the policies to it

Ask HR to name breaches of the security policies in the procedure, and add a sentence on consequences to the policies that refers to it. The case in hand goes through the general misconduct route with HR and Legal until that is done.

• Then: Is it deliberate, reckless, or a repeat after support?

Decision

Is it deliberate, reckless, or a repeat after support?

The facts decide this, not the outcome. A mistake, an unclear rule, a tool that made the right thing hard, or workload are all causes of accidents. Deliberate means the person knew the rule and chose to break it. Repeat means they were told and supported first. Not known takes the cautious, supportive branch until the facts are clear.

• No, or not known: Respond with support: explain, fix the cause and record it
• Yes: Did it cause, or risk, serious harm?

Step

Respond with support: explain, fix the cause and record it

Remind the person of the rule, find why it was broken and fix that: an unclear policy, a missing tool, too much workload. Offer training where it helps. The line manager is told as HR advises. This is not a sanction, and it is recorded.

• Then: Record the decision and the reasons, kept as the law allows

Decision

Did it cause, or risk, serious harm?

Serious means loss or exposure of sensitive or regulated data, fraud, safety risk or damage to a customer. The more serious the effect, the stronger the case for the formal process. Impact and intent are different measures; weigh both.

• Yes: HR starts the formal process; security limits access meanwhile
• No: HR and the line manager apply a proportionate step under the procedure

Step

HR starts the formal process; security limits access meanwhile

HR runs the process and Legal advises. Follow due process and any consultation local law requires, such as with a works council or union. HR and Legal decide the sanction. Security can restrict the person's access to the affected systems while the matter is open, as the leaver and mover procedures allow, and records what it did and when. Access limits are a safety measure and not a sanction.

• Then: Is the person senior, privileged or a close colleague of the decider?

Step

HR and the line manager apply a proportionate step under the procedure

This may be a recorded conversation, a written warning or retraining, as the procedure sets. Choose a step that matches intent, impact and history. Consistency matters more than severity: similar cases should lead to similar steps.

• Then: Is the person senior, privileged or a close colleague of the decider?

Decision

Is the person senior, privileged or a close colleague of the decider?

A common failing is a procedure that is applied to junior staff and not to senior ones. If the person is senior, an administrator or has authority over the people deciding, move the decision out of their reporting line.

• Yes: Move the decision to someone outside the person's reporting line
• No: Record the decision and the reasons, kept as the law allows

Step

Move the decision to someone outside the person's reporting line

Ask HR to appoint a decider who does not report to the person and is not close to the case, such as a senior HR lead with Legal, or the body to which the person is accountable. Apply the same procedure and the same standard.

• Then: Record the decision and the reasons, kept as the law allows

Step

Record the decision and the reasons, kept as the law allows

Keep the facts, the factors weighed, who decided and the outcome in the HR file, with a reference from the incident or finding. Keep it only as long as the law allows and restrict who can see it. The record is what lets you show consistency.

• Then: Remind staff in general terms that consequences exist

Step

Remind staff in general terms that consequences exist

Do not name the person or describe the case in a way that identifies them. Use the policy statement and the induction to say that breaches have consequences, applied fairly, and that good-faith reports are welcome.

• Then: Are similar breaches recurring across different people?

Decision

Are similar breaches recurring across different people?

If many people break the same rule, the rule, the tool or the training is the likely cause. More sanctions will not fix that.

• Yes: Treat it as a control failure: change the rule, tool or training
• No: Response matched the facts, followed the procedure, was recorded

Step

Treat it as a control failure: change the rule, tool or training

Review whether the rule is clear and workable, whether the tool makes the right thing easy, and whether people were trained for the real risk. Record the change and check that the pattern stops.

• Then: Response matched the facts, followed the procedure, was recorded

Outcome

Response matched the facts, followed the procedure, was recorded

Keep the case record in HR and a note of any change to the rule or tool. Do not tell the board or customers that staff have been disciplined for a breach unless Legal agrees, and do not say discipline fixed the weakness.