10.4 Disciplinary process

Requirement

The relevant entities shall establish, communicate and maintain a disciplinary process for handling violations of network and information system security policies. The process shall take into consideration relevant legal, statutory, contractual and business requirements.

Guidance

• Make sure that the process holds employees accountable for violations of the network and information system security policies.
• Involve human resources in implementing the disciplinary process, ensuring it aligns with legal and regulatory requirements (e.g. national labour laws and the GDPR).
• Communicate and raise awareness of the process among employees.
• Protect the identity of individuals subject to disciplinary action, where possible, in line with applicable requirements.

Examples of evidence

• Disciplinary process documentation outlining the types of violations that may be subject to disciplinary actions, and what steps to take when a violation occurs.
• Evidence that the policy has been communicated to all employees, which could include email records, meeting minutes or training session materials.
• Records of any violations of the network and information system security policies that have occurred and the corresponding disciplinary actions taken, demonstrating adherence to the disciplinary process. Examples of such records may include interviews with employees, witness statements, e-mails, paperwork, digital records, system logs and phone records.

Requirement

The relevant entities shall review and, where appropriate, update the disciplinary process at planned intervals and when necessary due to legal changes or significant changes to operations or risks.

Guidance

• Regularly review and update the disciplinary process at planned intervals and promptly when legal changes or significant operational or risk changes occur.

Examples of evidence

• Records of reviews and updates showing that the disciplinary process is reviewed regularly and updated as necessary.

Tips: guidance

• Include the disciplinary process for handling violations of network and information system security policies in the entity’s overall disciplinary process, if available.
• Recognize that deliberate violations of the policy on the security of network and information systems may require immediate actions.
• Do not initiate the disciplinary process without verifying that a violation of network and information system security policies has occurred.
• Consider the following factors for the process:
  • the nature (who, what, when, how) and gravity of the violation and its consequences;
  • whether the offence was intentional (malicious) or unintentional (accidental);
  • whether this is a first or repeated offence;
  • whether or not the employee who committed the violation was properly trained.
• Use the process as a deterrent to prevent employees from violating the network and information system security policies.
• Reward individuals who demonstrate excellent behaviour regarding network and information security as a means of promoting and encouraging good behaviour.

Tips: examples of evidence

• Disciplinary process documentation outlining the types of violations that may be subject to disciplinary actions, and what steps to take when a violation occurs .