Key takeaways
- Have a formal, communicated process for handling security policy breaches.
- A fair disciplinary process deters deliberate breaches and ensures consistent consequences.
- Start here: document a disciplinary process covering security breaches.
Purpose
Have a formal, communicated process for handling security policy breaches.
Requirement
Requirement summaryA disciplinary process shall be formalized and communicated to take actions against personnel and other relevant interested parties who have committed an information security policy violation
Why it matters
A fair disciplinary process deters deliberate breaches and ensures consistent consequences.
How to implement
- Document a disciplinary process covering security breaches.
- Make sure staff know it exists, for example in the handbook.
- Apply it consistently and in proportion to the breach.
- Coordinate with HR and legal.
What evidence you need to provide
Here is what you will typically need to provide for Annex A 6.4. It does not matter which system it lives in: a document, screenshot or export is fine.
Documents to have ready
- Your disciplinary process, mentioning security breaches.
- Your Statement of Applicability (SoA: the list of all 93 controls showing which you use and why) with A.6.4 marked as used or not used, a short reason, and its current status.
Records and examples to show
- Records of any security-related disciplinary cases.
- Proof staff have been told about the process, such as in the handbook.
Things you should be able to show or explain
- HR should be able to explain how security breaches are handled.
How much to show: Any cases in the last year, or a walkthrough if none.
Common mistakes
- Process doesn't mention security.
- Rules applied unevenly.
- Process exists but is never applied.
- Inconsistent treatment of senior staff.
- Tip: Make sure HR and security agree on the process.
Policies & documents to have
- Human Resource Security Policy
- Information Security Policy
FAQ
Is A.6.4 mandatory?
Annex A controls are not automatically mandatory. You must consider every control and record in your Statement of Applicability whether it applies and why. In practice, most organisations include this one.
What will I need to show for A.6.4?
Be ready to explain how the control works in your organisation and to provide things like: Your disciplinary process, mentioning security breaches…