BrowseToolsGuidesComparePricingStacksPlaybooksBlogSearch
ComplianceReadiness checkISO 27001ISO 42001SOC 2PCI DSSPolicy templatesControl mapCompliance softwareFramework compare
A.6.4A.6 People controls

Disciplinary process

A.5EVIDENCEA.6EVIDENCEA.7EVIDENCEA.8EVIDENCECONTROL MAPA.6.4 Evidence MapPOLICY / CONTROL / EVIDENCE / REVIEW

Purpose

Make consequences of security violations clear, deter breaches and deal fairly with anyone who breaks the rules.

How to meet this control

In short: Establish and communicate a process for handling security violations.

  1. Step 01Document a formal disciplinary process for security violations and align it with the Fair Work Act and any enterprise agreement so action is procedurally fair
  2. Step 02Reference the disciplinary process inside the Acceptable Use Policy so consequences are visible before any breach occurs
  3. Step 03Define a graduated set of responses, from coaching and written warning through to termination, scaled to severity, intent and whether the act was a repeat
  4. Step 04Require evidence and a verified finding that a violation actually happened before any disciplinary step is taken
  5. Step 05Run the process jointly between HR and the line manager, with confidential records and protection of the identity of those involved
  6. Step 06Feed serious or deliberate cases into incident management and, where relevant, to authorities

Tip: Reference it in the AUP so consequences are clear up front.

What ISO 27002 says to cover

Reference points from the ISO/IEC 27002:2022 guidance for this control. Use them to check the steps above cover everything relevant to you.

  • ›Formalise and communicate the disciplinary process so people know action will follow a violation
  • ›Do not start disciplinary action until you have verified that a violation actually occurred
  • ›Apply a graduated response that weighs the nature, seriousness and impact of the breach
  • ›Take into account whether the act was deliberate or accidental
  • ›Consider whether it is a first offence or a repeat one
  • ›Consider whether the person had actually been properly trained
  • ›Factor in legal, regulatory and contractual requirements, and act immediately on deliberate violations
  • ›Protect the identity of those facing disciplinary action where required

Audit evidence to keep

  • - The documented disciplinary process or procedure
  • - The Acceptable Use Policy clause referencing disciplinary consequences
  • - Anonymised records of a disciplinary case showing the steps followed
  • - Evidence that violations are verified before action, such as an investigation summary
  • - HR sign-off confirming the process was applied consistently

Common mistakes

  • - Writing a policy but not operating the process
  • - Keeping evidence in personal folders where auditors cannot trace it
  • - Letting exceptions stay open with no owner or expiry date

Owner, cadence, and proof

Assign one accountable owner for A.6.4. Review this control at least annually, after related incidents, and whenever the underlying process, supplier, system, office, or legal obligation changes. The control is audit-ready when the owner can show the policy or procedure, the latest operating evidence, the latest review, and any open exceptions with due dates.

Policy templates for this control

Use these starting documents to turn the control into evidence. Adapt each template to your scope, systems, legal obligations and actual operating process.

Acceptable use policyUse for ISO 27001 A.5.10, A.6.3, A.6.4, endpoint controls, remote work, and SOC 2 Security awareness.Data breach response policyUse for ISO 27001 A.5.24 to A.5.28, SOC 2 incident handling, privacy notification, and PCI DSS requirement 12.10.Human resources security policyUse for ISO 27001 A.6.1 to A.6.6, A.6.8, SOC 2 Security, and personnel security controls.Incident response policyUse for ISO 27001 A.5.24 to A.5.28, SOC 2 incident response, PCI DSS 12.10, and security event handling.
Open the control-to-policy map
← A.6.3 Information security awareness, education and trainingA.6.5 Responsibilities after termination or change of employment →
Back to all people controls or see the requirements (clauses 4 to 10). To run this control with automation, read how AI manages controls.