10.4.1 The relevant entities shall establish, communicate and maintain a disciplinary process for handling …

Requirement

The relevant entities shall establish, communicate and maintain a disciplinary process for handling violations of network and information system security policies. The process shall take into consideration relevant legal, statutory, contractual and business requirements.

Guidance

• Make sure that the process holds employees accountable for violations of the network and information system security policies.
• Involve human resources in implementing the disciplinary process, ensuring it aligns with legal and regulatory requirements (e.g. national labour laws and the GDPR).
• Communicate and raise awareness of the process among employees.
• Protect the identity of individuals subject to disciplinary action, where possible, in line with applicable requirements.

Examples of evidence

• Disciplinary process documentation outlining the types of violations that may be subject to disciplinary actions, and what steps to take when a violation occurs.
• Evidence that the policy has been communicated to all employees, which could include email records, meeting minutes or training session materials.
• Records of any violations of the network and information system security policies that have occurred and the corresponding disciplinary actions taken, demonstrating adherence to the disciplinary process. Examples of such records may include interviews with employees, witness statements, e-mails, paperwork, digital records, system logs and phone records.

1. Übersicht

1.1 Referenzen

1.2 Identifizierte Anforderungen

1.3 Zugehörige Regulierungen

2. Identifizierte Anforderungen

3. Zugehörige Regulierungen

Verknüpfte Vorgänge

• ENISA -