10.4.2 The relevant entities shall review and, where appropriate, update the disciplinary process at …

Requirement

The relevant entities shall review and, where appropriate, update the disciplinary process at planned intervals and when necessary due to legal changes or significant changes to operations or risks.

Guidance

• Regularly review and update the disciplinary process at planned intervals and promptly when legal changes or significant operational or risk changes occur.

Examples of evidence

• Records of reviews and updates showing that the disciplinary process is reviewed regularly and updated as necessary.

Tips: guidance

• Include the disciplinary process for handling violations of network and information system security policies in the entity’s overall disciplinary process, if available.
• Recognize that deliberate violations of the policy on the security of network and information systems may require immediate actions.
• Do not initiate the disciplinary process without verifying that a violation of network and information system security policies has occurred.
• Consider the following factors for the process:
  • the nature (who, what, when, how) and gravity of the violation and its consequences;
  • whether the offence was intentional (malicious) or unintentional (accidental);
  • whether this is a first or repeated offence;
  • whether or not the employee who committed the violation was properly trained.
• Use the process as a deterrent to prevent employees from violating the network and information system security policies.
• Reward individuals who demonstrate excellent behaviour regarding network and information security as a means of promoting and encouraging good behaviour.

Tips: examples of evidence

• Disciplinary process documentation outlining the types of violations that may be subject to disciplinary actions, and what steps to take when a violation occurs .

1. Yleiskatsaus

1.1 Viittaukset

1.2 Tunnistetut vaatimukset

1.3 Liittyvät säädökset

2. Tunnistetut vaatimukset

3. Liittyvät säädökset

Linkitetyt tehtävät

• ENISA -