Control A.6.4Disciplinary process
A disciplinary process must be formalised and communicated to take actions against personnel and other relevant interested parties who have committed an information security policy violation.
Two elements, and both are required. It must be formalised — a defined process with defined steps, proportionate to the violation, consistent with employment law — and it must be communicated, because a consequence nobody was told about cannot fairly be applied and will not deter anything.
Clause 7.3 requires people to be aware of the implications of not conforming, and this is the implication.
The judgement that matters is the distinction between a mistake and a violation. Someone who clicks a phishing link has made a mistake, and treating it as a disciplinary matter guarantees the next one is concealed. Someone who disables a control to avoid an inconvenience has made a choice. An organisation that blurs the two loses the reporting culture A.6.8 depends on, and gains nothing.
How to put this in place
If security rules never have consequences, people learn that they are optional. The project needs a fair, known route that applies to breaches of the policies, not only to misconduct in general.
- Check that the existing HR disciplinary procedure can be applied to security policy breaches.
- Add a reference to it in the security policies and the acceptable use rules.
- Agree with HR and Legal how intent, impact and repeat behaviour are weighed.
- Brief managers on how to start the process and keep records confidential.
- Review cases yearly to check treatment is consistent across seniority.
Evidence an auditor usually looks for: the disciplinary procedure that covers security breaches, policies that state the consequences, and, where cases occurred, how they were handled.
What is in the packs for this
From ISO 27001 Implementation & Certification Readiness. Each one helps with this requirement.
Annex A Control Implementation LibraryExcel
Its row in the Control Library: what it is for, practical steps, what an auditor samples, the usual owner, common mistakes and whether it usually applies.
Statement of Applicability TemplateExcel
Has its own row on the Statement of Applicability sheet, where you record whether it applies, why and how far it is implemented.