Disciplinary process

What the control asks

A formal disciplinary process is to be established and made known so that action can be taken against staff and relevant outside parties who break the security policy. Purpose: make sure people understand the consequences of breaching the policy, deter breaches and deal properly with those who commit them. Guidance: disciplinary action should start only after it has been verified that a violation actually occurred (5.28). The process provides a graduated response that weighs the nature of the breach (who, what, when, how), its seriousness and consequences; whether it was deliberate and malicious or accidental; whether it is a first or repeat offence; and whether the person had been properly trained. The response also accounts for legal, regulatory, contractual and business requirements and other relevant factors. The process doubles as a deterrent against breaching the policy, topic-specific policies and procedures, and deliberate violations may call for immediate action. Other information: where possible, shield the identity of anyone facing disciplinary action in line with applicable requirements; consider rewarding people who show excellent security behaviour.

Purpose in the standard’s terms, in our words: Ensures people understand the consequences of policy violations, deters violations and deals appropriately with those who commit them.

Attribute values in one line: Preventive, Corrective; Confidentiality, Integrity, Availability; Protect, Respond; Human resource security; Governance and ecosystem.

The five attribute values

These are the published values for this control, from ISO/IEC 27002:2022 clause 4.2 and Annex A Table A.1. Where your own value differs, record the difference and the reason in the same row rather than replacing the published value.

Evidence an auditor asks for

The attribute is a claim about how the control behaves. The evidence is what proves it operates. Keep both, and keep them together.

• The formal disciplinary procedure covering information security violations, communicated to personnel and relevant external parties
• Criteria for a graduated response considering nature, severity, intent, repetition and training received
• Case records showing that violations were verified before action began
• Evidence that legal, contractual and business requirements were considered in outcomes
• Communication or awareness material making the consequences of violations known
• Provisions for protecting the identity of individuals subject to action

Where audits commonly find gaps

• The HR disciplinary policy makes no mention of information security violations
• Action is taken on suspicion without verifying that a violation occurred
• Responses are inconsistent because there are no criteria for graduation
• Contractors and supplier staff fall outside any disciplinary mechanism

What ISO/IEC 27028 changes for this control

It carries more than one control type (preventive, corrective), so the register should record each and the evidence that proves each one operates. It contributes no detect function, so a control set built from this row alone would not show detection. Its earlier numbering (07.2.3) is kept in the register so an older audit file can still be traced.

The guidance expands how the five values are used; it does not change the control or add a requirement. A register that carries the values and the evidence can answer the attribute question for this control without a new document. A register that does not can add the columns at the next SoA version, with an owner and a review date.

Controls that share its values

• 6.1 Screening
• 6.2 Terms and conditions of employment
• 6.3 Information security awareness, education and training

Read the five attributes All 93 controls