10.4.2 The relevant entities shall review and, where appropriate, update the disciplinary process at …

Requirement

The relevant entities shall review and, where appropriate, update the disciplinary process at planned intervals and when necessary due to legal changes or significant changes to operations or risks.

Guidance

• Regularly review and update the disciplinary process at planned intervals and promptly when legal changes or significant operational or risk changes occur.

Examples of evidence

• Records of reviews and updates showing that the disciplinary process is reviewed regularly and updated as necessary.

Tips: guidance

• Include the disciplinary process for handling violations of network and information system security policies in the entity’s overall disciplinary process, if available.
• Recognize that deliberate violations of the policy on the security of network and information systems may require immediate actions.
• Do not initiate the disciplinary process without verifying that a violation of network and information system security policies has occurred.
• Consider the following factors for the process:
  • the nature (who, what, when, how) and gravity of the violation and its consequences;
  • whether the offence was intentional (malicious) or unintentional (accidental);
  • whether this is a first or repeated offence;
  • whether or not the employee who committed the violation was properly trained.
• Use the process as a deterrent to prevent employees from violating the network and information system security policies.
• Reward individuals who demonstrate excellent behaviour regarding network and information security as a means of promoting and encouraging good behaviour.

Tips: examples of evidence

• Disciplinary process documentation outlining the types of violations that may be subject to disciplinary actions, and what steps to take when a violation occurs .

1. Panoramica

1.1 Riferimenti

1.2 Requisiti identificati

1.3 Regolamentazioni correlate

2. Requisiti identificati

3. Regolamentazioni correlate

Ticket collegati

• ENISA -

  EN: Publications of the European Union Agency for Cybersecurity (ENISA), https://www.enisa.europa.eu/. © European Union Agency for Cybersecurity (ENISA). Unless otherwise noted, licensed under CC BY 4.0. Changes: divided into sections, converted into the GRCA format and linked to the EU legal acts they refer to; images and material of third parties are not reproduced. Only the versions published by ENISA are authoritative.

  DE: Veröffentlichungen der Agentur der Europäischen Union für Cybersicherheit (ENISA), https://www.enisa.europa.eu/. © European Union Agency for Cybersecurity (ENISA). Soweit nicht anders vermerkt, lizenziert unter CC BY 4.0. Änderungen: in Abschnitte aufgeteilt, in das GRCA-Format umgewandelt und mit den EU-Rechtsakten verknüpft, auf die sie sich beziehen; Bilder und Material Dritter werden nicht wiedergegeben. Maßgeblich sind allein die von der ENISA veröffentlichten Fassungen.