---
notetype: reference
standard: ISO 27002
version: 2022
language: EN
type: control
id: "A.6.4"
title: "Disciplinary process"
theme: People
control_type:
  - Preventive
  - Corrective
information_security_properties:
  - Confidentiality
  - Integrity
  - Availability
cybersecurity_concepts:
  - Protect
  - Respond
operational_capabilities: [Human_resource_security]
security_domains: [Governance_and_Ecosystem]
tags:
- iso27002/2022/EN
- sourcetext
status: active
---

## 6.4 Disciplinary process

  

### Control

  

A disciplinary process should be formalized and communicated to take actions against personnel and other relevant interested parties who have committed an information security policy violation.

  

### Purpose

  

To ensure personnel and other relevant interested parties understand the consequences of information security policy violation, to deter and appropriately deal with personnel and other relevant interested parties who committed the violation.

  

### Guidance

  

The disciplinary process should not be initiated without prior verification that an information security policy violation has occurred (see [5.28](a-5.28-Collection-of-evidence.md)).

  

The formal disciplinary process should provide for a graduated response that takes into consideration factors such as:

  

a\) the nature (who, what, when, how) and gravity of the breach and its consequences;

  

b\) whether the offence was intentional (malicious) or unintentional (accidental);

  

c\) whether or not this is a first or repeated offence;

  

d\) whether or not the violator was properly trained.

  

The response should take into consideration relevant legal, statutory, regulatory contractual and business requirements as well as other factors as required. The disciplinary process should also be used as a deterrent to prevent personnel and other relevant interested parties from violating the information security policy, topic-specific policies and procedures for information security. Deliberate information security policy violations can require immediate actions.

  

### Other information

  

Where possible, the identity of individuals subject to disciplinary action should be protected in line with applicable requirements.

  

When individuals demonstrate excellent behaviour with regard to information security, they can be rewarded to promote information security and encourage good behaviour.