ISO 27001 A.6.4: Apply a Fair Security Disciplinary Process

What A.6.4 requires in practice

Annex A control 6.4 asks the organisation to have a disciplinary process for people who break information security rules, and to make that process formal and known. Three ideas sit inside it. The process is formalised, meaning it is defined rather than improvised case by case. It is communicated, so personnel understand in advance that violations have consequences and how a case would be handled. It reaches personnel and other relevant parties, which can include contractors whose agreements allow action. The control does not demand automatic punishment, and it does not replace employment law or fairness. It exists so that action, where warranted, is consistent, proportionate and defensible. The outputs are a documented process agreed with HR and legal, evidence that people have been told about it, and records showing how any real case was handled in line with it.

Establish the facts before a disciplinary decision

An alert or allegation is not by itself proof of a policy violation. Determine what happened, which requirement applied and whether the evidence supports the alleged conduct. ISO 27002 guidance emphasises prior verification of a violation before initiating the disciplinary process.

Distinguish fact-finding and immediate protective measures from a disciplinary conclusion. Restricting access to prevent further exposure may be necessary while facts are assessed, but the organisation should not describe that precaution as proof of wrongdoing. Use authorised roles and protect the information associated with the investigation.

Make responsibilities clear. Security personnel may provide technical facts; managers and HR may have different decision responsibilities. Avoid allowing a tool’s automated score or an investigator’s unreviewed assumption to determine a sanction without the appropriate process.

Consider context and proportionality

Evaluate the nature and consequence of the violation, whether it was intentional, whether it was repeated and whether the person had appropriate instruction and training. These considerations help distinguish deliberate disregard from a mistake influenced by unclear rules or an unavailable approved method.

A proportionate process can maintain accountability while recognising system weaknesses. If a policy requires a protection that the organisation never provided, that gap needs action. It should not be hidden by focusing exclusively on the individual closest to the incident.

Why a fair disciplinary process matters to the business

Rules without consequences are rarely taken seriously, but consequences applied inconsistently damage trust and invite legal challenge. A clear, fair process protects the organisation from both problems. It also protects people: a staff member who reports a mistake should know they will be treated proportionately. Customers and regulators look for evidence that the organisation can hold its own people to account, particularly where personal data is involved. For audit purposes, the process shows that policy violations lead to a managed response rather than silence, and well-handled cases demonstrate that the control works in practice.

How to implement A.6.4

Build the process with HR and legal from the outset, because the security team alone cannot define employment consequences.

1. Review the existing HR disciplinary procedure and identify whether it covers breaches of security policy explicitly.
2. Agree who is involved in a case: security for technical facts, the line manager, HR and, where relevant, legal advice.
3. Define how facts are verified before a disciplinary step begins, and how protective measures such as temporary access restriction are separated from conclusions.
4. Set out the factors considered, such as intent, repetition, consequence and whether the person had received instruction.
5. Extend the process, where lawful, to contractors and other parties through their agreements.
6. Communicate the process during induction and refresher learning so that it is known before any case arises.
7. Review completed cases for fairness and consistency, and feed lessons back into awareness and policy. Where a rule was unclear or the approved method unavailable, fix that as well.

Illustrative BPO example: reporting a mistaken disclosure

Illustrative manufacturing example: a repeated unauthorised workaround

A hypothetical manufacturing supervisor repeatedly shares an account after receiving clear instructions and a workable individual-access alternative. The organisation has evidence of the activity and the prior communication. The situation differs from an employee encountering an unexplained system limitation for the first time.

The responsible functions consider the verified conduct, recurrence and consequences through the established process. They also check whether the account design or supervision needs improvement. The example shows that a fair process can address deliberate or repeated violations without abandoning broader control improvement.

Communicate expectations before a violation occurs

Personnel should know that a process exists and understand its connection to security responsibilities. Explain applicable requirements, reporting routes and how concerns will be handled. Communication should be clear enough to support responsible behaviour without relying on fear or vague threats.

For supplier personnel, clarify how relevant action is coordinated through the contractual relationship. Your organisation may not be the employer or hold the same disciplinary authority. Establish an appropriate route with the supplier rather than assuming internal HR measures apply directly to everyone.

Protect confidentiality and consistent treatment

Limit case information to authorised need and retain it appropriately. Publishing personal details to make an example can create additional harm and undermine trust. Share sanitised lessons where useful, while respecting applicable requirements and the integrity of the process.

Review whether similar circumstances receive consistent consideration. Consistency does not mean identical outcomes regardless of facts; it means using a defensible process and relevant criteria. Preserve the reasoning for consequential decisions so that outcomes can be understood and appropriately reviewed.

Evidence and common failures