Assessment Objective

Determine if:

• PS-08a. a formal sanctions process is employed for individuals failing to comply with established information security and privacy policies and procedures;
• PS-08b. [Assignment: personnel or roles] is/are notified within [Assignment: time period] when a formal employee sanctions process is initiated, identifying the individual sanctioned and the reason for the sanction.

Assessment Methods

Examine

• Personnel security policy
• personnel security procedures
• procedures addressing personnel sanctions
• access agreements (including non-disclosure agreements, acceptable use agreements, rules of behavior, and conflict-of-interest agreements)
• list of personnel or roles to be notified of formal employee sanctions
• records or notifications of formal employee sanctions
• system security plan
• privacy plan
• personally identifiable information processing policy
• other relevant documents or records

Interview

• Organizational personnel with personnel security responsibilities
• legal counsel
• organizational personnel with information security and privacy responsibilities

Test

• Organizational processes for managing formal employee sanctions
• mechanisms supporting and/or implementing formal employee sanctions notifications

Lingitud teemad

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final