Security Disciplinary Process Template (ISO/IEC 27001 A.6.4)

Disciplinary Process for Security Breaches: [Organization name]

Formal, communicated process for handling breaches of information security policy by personnel: categories of breach, how a matter is raised and investigated, how HR and legal take part, how the process links to incident management, what outcomes are possible and which records are kept. It supports ISO/IEC 27001:2022 + Amd 1:2024, Annex A control A.6.4 (disciplinary process), with guidance in ISO/IEC 27002:2022, and works alongside A.5.24 to A.5.28 (incident management and evidence collection) and A.6.3 (awareness, education and training). It is a security layer on top of the organization's general disciplinary procedure, not a replacement for it. Replace every [bracketed] value and every row marked Example. This is a documentation format, not legal advice: employment law, works council rights and employee monitoring rules differ by country.

Document control

Approvals

Revision history

Contents

1. Purpose and scope
2. Principles
3. Roles and responsibilities
4. Breach categories
5. Raising a matter and the link to incident management
6. Investigation
7. Fair process, decision and appeal
8. Outcomes and influencing factors
9. Contractors, agency staff and suppliers
10. Communication and awareness
11. Size tiers
12. Records and evidence
13. Metrics
14. References

1. Purpose and scope

This process makes sure that breaches of information security policy by people working for [Organization name] are handled consistently, fairly and in proportion to their seriousness, and that the existence of the process deters deliberate misuse. It covers employees at all levels, including managers and executives, and sets how breaches by contractors, agency staff and supplier personnel are handled through their contracts.

It applies to breaches of the information security policy (DOC-ISMS-001), the topic-specific policies listed in the policy framework (DOC-ISMS-005), the acceptable use policy (DOC-ISMS-040) and confidentiality agreements (DOC-ISMS-051).

2. Principles

1. Proportionate. The response matches the seriousness of the breach, its intent and its consequences.
2. Fair. The person is told what is alleged, sees the relevant evidence where the law allows, can respond, can be accompanied where the law or policy gives that right, and can appeal.
3. Consistent. Similar breaches lead to similar outcomes regardless of seniority, team or relationships.
4. Documented. Every step, decision and reason is recorded in the case file.
5. Just culture. Honest mistakes and self-reported errors are handled by learning, coaching and training, not by sanctions. Reporting a security event is never itself a disciplinary matter, and neither is a disclosure that whistleblower law protects; retaliation against a person who reports in good faith is itself a breach under this process.
6. Evidence first. Incident response preserves and collects evidence before any disciplinary interview (A.5.28).
7. Lawful. Monitoring data and evidence are used only as local law, works council agreements and the monitoring notice given to staff allow.
8. Confidential. Case details are shared only with those who need them.

3. Roles and responsibilities

4. Breach categories

Rules:

• Repeat C0 events by the same person in a short period are reviewed by HR and the ISMS manager to decide whether a process or training issue, or a C1, applies.
• A failed phishing simulation is never a disciplinary matter by itself (see isms/phishing-simulation-plan).
• Managers who instruct or knowingly allow a breach are assessed as if they committed it.

5. Raising a matter and the link to incident management

A matter can start from:

• a security incident or event where personnel conduct contributed (compliance/incident-response-plan, DOC-ISMS-020, and the incident register DOC-ISMS-021);
• an audit finding, access review or monitoring alert;
• a report by a colleague, manager or third party, including through the whistleblowing channel. Keep the reporter's identity confidential as the applicable whistleblower law and policy require, and share it with the investigation only where that law allows.

Hand-off steps:

1. The incident lead records in the incident record that personnel conduct may be involved, and informs HR and the ISMS manager only.
2. The incident lead preserves evidence with chain of custody (security/forensic-evidence-record) and confirms when interviews will not compromise containment or the investigation.
3. HR and the ISMS manager agree the provisional category (section 4). C0 goes to the learning route and the case closes with a training or process action.
4. For C1, the line manager acts with HR. For C2 and C3, HR opens a case (ID DISC-YYYY-NNN) and appoints an investigating officer.
5. Legal counsel decides whether any external reporting (regulator, data protection authority, police) is required. Reporting duties under incident management are never delayed by the disciplinary track.

6. Investigation

1. Terms of reference. HR writes the scope of the investigation, the allegations and the investigating officer's name.
2. Suspension. For C3, suspension on full pay or removal of access may be used as a neutral, protective act, not as a sanction, where local law and the general HR procedure allow it, and kept under review. Remove access through the urgent leaver steps in isms/offboarding-security-checklist where needed.
3. Evidence. Use the technical findings from the security team, logs and records already collected under the incident process. Access to mailboxes, devices or monitoring data follows the monitoring notice, local law and legal counsel's advice.
4. Interviews. Interview the person and witnesses, record notes, and let interviewees check their notes.
5. Report. The investigating officer writes findings of fact, whether the allegation is supported, and a recommendation on whether a disciplinary meeting is needed. The report is not a decision.

7. Fair process, decision and appeal

• Invite the person in writing to a meeting with enough notice to prepare, state the allegations, and share the evidence relied on, removing information that would compromise security (for example detection logic) where legal counsel agrees.
• Explain technical evidence in plain language. The security team may attend to explain findings but does not take the decision.
• The decision maker considers the investigation report, the person's response and the factors in section 8, and confirms the outcome and the reasons in writing, with the right of appeal.
• Appeals are heard by someone not involved before. The appeal decision is final within the internal process.
• Where an employee representative body has rights of consultation or attendance, follow them.

8. Outcomes and influencing factors

Possible outcomes, depending on the general HR procedure and local law:

Factors the decision maker weighs:

• Aggravating: intent, concealment, personal gain, harm to customers, privileged position, prior warnings, refusal to cooperate.
• Mitigating: self-reporting, honest belief, unclear policy or missing training, pressure from a manager, prompt cooperation, length of good record.

After each case, the ISMS manager checks whether a policy, control or training gap contributed and records an improvement in the continual improvement register (DOC-ISMS-088) or a corrective action (DOC-ISMS-087).

9. Contractors, agency staff and suppliers

10. Communication and awareness

• Summarise this process in the employee security handbook (isms/employee-security-handbook) and in induction training.
• State the just-culture principle clearly: reporting mistakes is expected and protected.
• Include the process in manager training so managers do not act alone.
• Keep the process available on the intranet in every working language.

11. Size tiers

12. Records and evidence

13. Metrics

14. References

Related templates: hr/disciplinary-grievance-procedure, compliance/incident-response-plan, isms/incident-register, isms/security-event-reporting-procedure, security/forensic-evidence-record, isms/confidentiality-nda, isms/offboarding-security-checklist, isms/phishing-simulation-plan, isms/employee-security-handbook, compliance/acceptable-use-policy, isms/continual-improvement-register, compliance/capa-nonconformity, isms/control-evidence-matrix.

Standard and licence note

Structure aligned with ISO/IEC 27001:2022 including Amd 1:2024, Annex A control A.6.4, with guidance in ISO/IEC 27002:2022. The principles, categories, process, examples and guidance are original wording; no ISO or IEC text is reproduced. ISO and IEC standards are copyrighted: obtain the official standard from ISO or your national standards body (https://www.iso.org/standard/82875.html). Check the current edition and amendments, and the employment law of each country, before use. This is a documentation format, not legal advice. Template licence: MIT.