# Disciplinary Process for Security Breaches: [Organization name]

> Formal, communicated process for handling breaches of information
> security policy by personnel: categories of breach, how a matter is
> raised and investigated, how HR and legal take part, how the process
> links to incident management, what outcomes are possible and which
> records are kept. It supports ISO/IEC 27001:2022 + Amd 1:2024, Annex A
> control A.6.4 (disciplinary process), with guidance in ISO/IEC
> 27002:2022, and works alongside A.5.24 to A.5.28 (incident management
> and evidence collection) and A.6.3 (awareness, education and training).
> It is a security layer on top of the organization's general
> disciplinary procedure, not a replacement for it. Replace every
> `[bracketed]` value and every row marked *Example*. This is a
> documentation format, not legal advice: employment law, works council
> rights and employee monitoring rules differ by country.

<!--
Guidance: How to use this template
- When to use: when you need a documented and communicated process for
  security policy breaches, typically before the Stage 1 audit, and each
  time the general HR disciplinary procedure or a local law changes.
- Fill first: section 4 (breach categories) and section 5 (how matters
  are raised and the hand-off from incident response). Then ask HR and
  legal counsel to confirm section 7 (fair process) for every country.
- Main pitfall: a process that punishes people for reporting their own
  mistakes. That kills reporting (A.6.8). Separate honest error, which is
  handled by training and coaching, from negligent or deliberate breach.
- Second pitfall: HR starting an investigation that destroys or taints
  forensic evidence. Incident response preserves evidence first.
- Related templates: `hr/disciplinary-grievance-procedure` (general HR
  procedure), `compliance/incident-response-plan`, `isms/security-event-reporting-procedure`,
  `security/forensic-evidence-record`, `isms/confidentiality-nda`,
  `compliance/acceptable-use-policy`, `isms/employee-security-handbook`,
  `isms/control-evidence-matrix`.
-->

## Document control

<!-- Guidance: HR owns the disciplinary procedure; the ISMS owner co-owns this security layer. Record who approved it and in which countries it has been checked. -->

| Field | Value |
|---|---|
| Document ID | DOC-ISMS-052 |
| Version | [1.0] |
| Status | [Draft / In review / Approved / Superseded] |
| Owner | [@head-of-people] (process), [@isms-manager] (security layer) |
| Approvers/reviewers | [@general-counsel], [@ciso], [@dpo], [employee representative body where consultation is required] |
| Last updated | YYYY-MM-DD |
| Classification | [Internal] (process), case records [Confidential, restricted] |
| Standard and edition | ISO/IEC 27001:2022 + Amd 1:2024, A.6.4; guidance ISO/IEC 27002:2022 |
| Base HR procedure | [Reference to the general disciplinary procedure, for example built from `hr/disciplinary-grievance-procedure`] |
| Countries covered | [Countries for which counsel has confirmed the process] |
| Next scheduled review | YYYY-MM-DD (at least annually and after any appeal that changes practice) |

### Approvals

| Role | Name | Decision | Date |
|---|---|---|---|
| HR | [@head-of-people] | [Prepared] | YYYY-MM-DD |
| Legal counsel | [@general-counsel] | [Approved for listed countries] | YYYY-MM-DD |
| ISMS owner | [@isms-manager] | [Approved] | YYYY-MM-DD |
| Top management | [@ceo] | [Approved] | YYYY-MM-DD |

### Revision history

| Version | Date | Author | Change |
|---|---|---|---|
| 1.0 *(Example)* | YYYY-MM-DD | [@head-of-people] | First approved version, communicated through the employee security handbook |
| 1.1 *(Example)* | YYYY-MM-DD | [@isms-manager] | Clarified honest-error route after the first annual review |

## Contents

1. Purpose and scope
2. Principles
3. Roles and responsibilities
4. Breach categories
5. Raising a matter and the link to incident management
6. Investigation
7. Fair process, decision and appeal
8. Outcomes and influencing factors
9. Contractors, agency staff and suppliers
10. Communication and awareness
11. Size tiers
12. Records and evidence
13. Metrics
14. References

## 1. Purpose and scope

<!-- Guidance: Explain why the process exists and who it covers. Questions to answer: does it cover contractors and agency staff (usually through their contracts, section 9)? Is it communicated to everyone before it is applied? An auditor checks that personnel know it exists. -->

This process makes sure that breaches of information security policy by
people working for [Organization name] are handled consistently, fairly
and in proportion to their seriousness, and that the existence of the
process deters deliberate misuse. It covers employees at all levels,
including managers and executives, and sets how breaches by contractors,
agency staff and supplier personnel are handled through their contracts.

It applies to breaches of the information security policy (DOC-ISMS-001),
the topic-specific policies listed in the policy framework (DOC-ISMS-005),
the acceptable use policy (DOC-ISMS-040) and confidentiality agreements
(DOC-ISMS-051).

## 2. Principles

<!-- Guidance: These principles are what an employee representative, a court or an auditor will test. Keep them short and apply them every time. -->

1. **Proportionate.** The response matches the seriousness of the breach,
   its intent and its consequences.
2. **Fair.** The person is told what is alleged, sees the relevant
   evidence where the law allows, can respond, can be accompanied where
   the law or policy gives that right, and can appeal.
3. **Consistent.** Similar breaches lead to similar outcomes regardless of
   seniority, team or relationships.
4. **Documented.** Every step, decision and reason is recorded in the
   case file.
5. **Just culture.** Honest mistakes and self-reported errors are handled
   by learning, coaching and training, not by sanctions. Reporting a
   security event is never itself a disciplinary matter, and neither is a
   disclosure that whistleblower law protects; retaliation against a
   person who reports in good faith is itself a breach under this
   process.
6. **Evidence first.** Incident response preserves and collects evidence
   before any disciplinary interview (A.5.28).
7. **Lawful.** Monitoring data and evidence are used only as local law,
   works council agreements and the monitoring notice given to staff
   allow.
8. **Confidential.** Case details are shared only with those who need them.

## 3. Roles and responsibilities

<!-- Guidance: Keep investigation, decision and appeal with different people. In a small organization, use an external adviser or a board member to keep that separation. -->

| Role | Responsibility |
|---|---|
| Line manager | Raises concerns, does not investigate alone, takes part in coaching outcomes |
| ISMS manager or security team | Assesses the security facts, provides technical findings, classifies the breach category with HR |
| Incident lead | Runs incident response, preserves evidence, decides when the disciplinary track may start without harming the investigation |
| HR | Owns the procedure, appoints the investigating officer, arranges meetings, keeps the case file |
| Investigating officer | Gathers facts, interviews, writes the investigation report, does not decide the outcome |
| Decision maker | Senior manager not involved in the investigation, decides outcome |
| Legal counsel | Advises on law, monitoring evidence, external reporting and litigation risk |
| Data protection officer or privacy lead | Advises on lawful use of personal data in evidence, access requests to case files |
| Appeal officer | More senior manager or panel not involved earlier |
| Employee representative body | Consulted or informed where law or agreement requires |

## 4. Breach categories

<!-- Guidance: Categories help consistency. Classify on facts found, not on first allegation. Examples below are illustrative; adapt to your policies and local law. -->

| Category | Description | Examples *(Example)* | Default route |
|---|---|---|---|
| C0 Honest error | Unintentional mistake, no negligence, often self-reported | Sends an internal file to the wrong colleague and reports it at once | Learning route: coaching, targeted training, process fix |
| C1 Minor breach | Careless non-compliance with limited impact | Leaves an unlocked laptop in the office, repeated failure to complete mandatory training after reminders | Informal action by line manager with HR record of the conversation |
| C2 Serious breach | Negligent or knowing breach with real or likely harm | Shares a password, disables endpoint protection, stores Confidential data in a personal cloud account | Formal process (sections 6 and 7) |
| C3 Gross misconduct | Deliberate, malicious or highly damaging breach | Exfiltrates customer data, sells access, deliberately sabotages systems, accesses records without any business reason | Formal process, possible suspension during investigation, possible referral to authorities |

Rules:

- Repeat C0 events by the same person in a short period are reviewed by
  HR and the ISMS manager to decide whether a process or training issue,
  or a C1, applies.
- A failed phishing simulation is never a disciplinary matter by itself
  (see `isms/phishing-simulation-plan`).
- Managers who instruct or knowingly allow a breach are assessed as if
  they committed it.

## 5. Raising a matter and the link to incident management

<!-- Guidance: Most security disciplinary cases start as incidents. Define the hand-off so HR does not move before evidence is safe, and incident responders do not make employment decisions. -->

A matter can start from:

- a security incident or event where personnel conduct contributed
  (`compliance/incident-response-plan`, DOC-ISMS-020, and the incident
  register DOC-ISMS-021);
- an audit finding, access review or monitoring alert;
- a report by a colleague, manager or third party, including through the
  whistleblowing channel. Keep the reporter's identity confidential as the
  applicable whistleblower law and policy require, and share it with the
  investigation only where that law allows.

Hand-off steps:

1. The incident lead records in the incident record that personnel
   conduct may be involved, and informs HR and the ISMS manager only.
2. The incident lead preserves evidence with chain of custody
   (`security/forensic-evidence-record`) and confirms when interviews
   will not compromise containment or the investigation.
3. HR and the ISMS manager agree the provisional category (section 4).
   C0 goes to the learning route and the case closes with a training or
   process action.
4. For C1, the line manager acts with HR. For C2 and C3, HR opens a case
   (ID DISC-YYYY-NNN) and appoints an investigating officer.
5. Legal counsel decides whether any external reporting (regulator, data
   protection authority, police) is required. Reporting duties under
   incident management are never delayed by the disciplinary track.

```mermaid
flowchart TD
  A["Incident, audit finding, alert or report"] --> B["Incident lead preserves evidence"]
  B --> C["HR and ISMS manager agree provisional category"]
  C --> D{"Category"}
  D -- C0 --> E["Learning route: coaching, training, process fix"]
  D -- C1 --> F["Informal action by line manager with HR"]
  D -- "C2 or C3" --> G["HR opens case DISC-YYYY-NNN"]
  G --> H["Investigation by investigating officer"]
  H -- "Allegation not supported" --> L
  H -- "Case to answer" --> I["Disciplinary meeting and decision"]
  I --> J{"Appeal?"}
  J -- Yes --> K["Appeal by appeal officer"]
  J -- No --> L["Case closed, lessons to ISMS"]
  K --> L
  E --> L
  F --> L
```

## 6. Investigation

<!-- Guidance: The investigation establishes facts. It should be timely, but not rushed. An auditor will not read case files, but may ask for an anonymised example to see that the process was followed. -->

1. **Terms of reference.** HR writes the scope of the investigation, the
   allegations and the investigating officer's name.
2. **Suspension.** For C3, suspension on full pay or removal of access may
   be used as a neutral, protective act, not as a sanction, where local law
   and the general HR procedure allow it, and kept under review. Remove access through the urgent leaver steps in
   `isms/offboarding-security-checklist` where needed.
3. **Evidence.** Use the technical findings from the security team, logs
   and records already collected under the incident process. Access to
   mailboxes, devices or monitoring data follows the monitoring notice,
   local law and legal counsel's advice.
4. **Interviews.** Interview the person and witnesses, record notes, and
   let interviewees check their notes.
5. **Report.** The investigating officer writes findings of fact, whether
   the allegation is supported, and a recommendation on whether a
   disciplinary meeting is needed. The report is not a decision.

| Case ID | Category | Source | Opened | Investigating officer | Status |
|---|---|---|---|---|---|
| DISC-2026-001 *(Example)* | C2 | INC-2026-014 | 2026-03-02 | [@hr-investigator] | Investigation |
| DISC-2026-002 *(Example)* | C3 | Access review finding | 2026-04-18 | [external investigator] | Decision pending |

## 7. Fair process, decision and appeal

<!-- Guidance: Follow the general HR procedure for meetings, timescales and companion rights. This section adds only what security cases need. -->

- Invite the person in writing to a meeting with enough notice to prepare,
  state the allegations, and share the evidence relied on, removing
  information that would compromise security (for example detection
  logic) where legal counsel agrees.
- Explain technical evidence in plain language. The security team may
  attend to explain findings but does not take the decision.
- The decision maker considers the investigation report, the person's
  response and the factors in section 8, and confirms the outcome and the
  reasons in writing, with the right of appeal.
- Appeals are heard by someone not involved before. The appeal decision
  is final within the internal process.
- Where an employee representative body has rights of consultation or
  attendance, follow them.

## 8. Outcomes and influencing factors

<!-- Guidance: List the outcomes your general procedure allows. Avoid fixed tariffs ("any password sharing means dismissal"): they ignore context and are often unlawful. -->

Possible outcomes, depending on the general HR procedure and local law:

| Outcome | Typical use |
|---|---|
| No action, or learning action | Allegation not supported, or C0 |
| Coaching and mandatory training | C1, or C2 with strong mitigating factors |
| Written warning, with review period | C2 |
| Final written warning | Repeat C2 or C2 with aggravating factors |
| Removal of privileged access or change of role | Where trust in a specific role is lost |
| Dismissal | C3, or repeat C2 after final warning, where lawful |
| Civil or criminal referral | C3 involving fraud, theft or sabotage, on legal advice |

Factors the decision maker weighs:

- **Aggravating:** intent, concealment, personal gain, harm to customers,
  privileged position, prior warnings, refusal to cooperate.
- **Mitigating:** self-reporting, honest belief, unclear policy or missing
  training, pressure from a manager, prompt cooperation, length of good
  record.

After each case, the ISMS manager checks whether a policy, control or
training gap contributed and records an improvement in the continual
improvement register (DOC-ISMS-088) or a corrective action (DOC-ISMS-087).

## 9. Contractors, agency staff and suppliers

<!-- Guidance: You cannot discipline people you do not employ. Use contract terms instead, and say so in the contracts. -->

| Relationship | Response to a breach |
|---|---|
| Individual contractor | Contract remedies: removal of access, termination for breach, claims under the confidentiality agreement (DOC-ISMS-051) |
| Agency staff | Removal from assignment, the agency applies its own disciplinary process, notification under the agency contract |
| Supplier personnel | Request removal of the individual, supplier corrective action under the supplier security agreement (DOC-ISMS-068), contract review |

## 10. Communication and awareness

<!-- Guidance: A.6.4 only deters if staff know the process exists before anything goes wrong. Evidence is the handbook acknowledgement and training records. -->

- Summarise this process in the employee security handbook
  (`isms/employee-security-handbook`) and in induction training.
- State the just-culture principle clearly: reporting mistakes is expected
  and protected.
- Include the process in manager training so managers do not act alone.
- Keep the process available on the intranet in every working language.

## 11. Size tiers

<!-- Guidance: These are the library's working tiers. -->

| Aspect | Small: Quillmere Analytics Ltd | Medium: Quillmere Health Systems | Large: Quillmere Group |
|---|---|---|---|
| Who investigates | External HR adviser, technical facts from the ISMS manager (0.5 FTE) | Trained HR investigators, 3-person security team for technical facts | Country HR teams, CISO office forensic support, group legal |
| Separation of roles | CEO decides, external adviser hears appeals | Department director decides, executive hears appeals | Site management decides, regional HR director hears appeals |
| Representative bodies | Usually none | Depends on office countries | Works councils or unions at plants in several countries, consultation built into process |
| Volume and tracking | A few cases a year, tracked in a restricted HR folder | Case log in HR system | Case management system with country reporting |

## 12. Records and evidence

<!-- Guidance: Link these records in the control evidence matrix (`isms/control-evidence-matrix`, DOC-ISMS-033). Keep case files restricted; an auditor needs proof the process exists and is communicated, and anonymised statistics, not personal case details. -->

| Record | Proves | Owner | Location | Retention |
|---|---|---|---|---|
| Approved process and communication record | Process formal and communicated | HR | Policy portal, handbook acknowledgements | Life of version plus [3] years |
| Case file (terms of reference, report, decision, appeal) | Fair, documented handling | HR | HR system, restricted | Per legal register DOC-ISMS-014, *Example*: [6] years after case closure |
| Link between incident record and case ID | Hand-off from incident management | Incident lead, HR | Incident register DOC-ISMS-021 | As incident register |
| Anonymised case statistics | Consistency and trends | HR, ISMS manager | Management review input | [3] years |
| Lessons learned actions | Improvement after cases | ISMS manager | DOC-ISMS-088 or DOC-ISMS-087 | As register |

## 13. Metrics

<!-- Guidance: Report anonymised measures only, through the measurement programme (DOC-ISMS-080). -->

| Metric | Target *(Example)* |
|---|---|
| Cases closed with a documented decision and reasons | 100% |
| Cases started from self-reports that led to sanctions | 0 for C0 |
| Median days from case opening to decision | Set per country, reviewed yearly |
| Staff acknowledgement of the handbook including this process | 98% or more |

## 14. References

<!-- Guidance: Cite editions exactly and check local employment law before applying any example. -->

| Reference | Edition | Use |
|---|---|---|
| ISO/IEC 27001:2022 + Amd 1:2024, https://www.iso.org/standard/82875.html, Amd: https://www.iso.org/standard/88435.html | 2022, Amd 1 2024-02-23 | Control A.6.4, links to A.5.24 to A.5.28 and A.6.3 |
| ISO/IEC 27002:2022, https://www.iso.org/standard/75652.html | 2022 | Guidance on disciplinary process |
| ISO/IEC 27037:2012, https://www.iso.org/standard/44381.html | 2012 | Handling of digital evidence |
| NIST SP 800-53 Rev. 5 (release 5.2.0, August 2025), control PS-8 Personnel Sanctions | Rev. 5 | Optional crosswalk |

Related templates: `hr/disciplinary-grievance-procedure`, `compliance/incident-response-plan`,
`isms/incident-register`, `isms/security-event-reporting-procedure`,
`security/forensic-evidence-record`, `isms/confidentiality-nda`,
`isms/offboarding-security-checklist`, `isms/phishing-simulation-plan`,
`isms/employee-security-handbook`, `compliance/acceptable-use-policy`,
`isms/continual-improvement-register`, `compliance/capa-nonconformity`,
`isms/control-evidence-matrix`.

## Standard and licence note

Structure aligned with ISO/IEC 27001:2022 including Amd 1:2024, Annex A
control A.6.4, with guidance in ISO/IEC 27002:2022. The principles,
categories, process, examples and guidance are original wording; no ISO
or IEC text is reproduced. ISO and IEC standards are copyrighted: obtain
the official standard from ISO or your national standards body
(https://www.iso.org/standard/82875.html). Check the current edition and
amendments, and the employment law of each country, before use. This is
a documentation format, not legal advice. Template licence: MIT.