Policy Register
Every policy type · People

Disciplinary process

What happens to a person who breaks a security or privacy rule: the steps, the proportionality and who decides.

How the register reads it

Also calledsanctions policy, misconduct procedure
FamilyPeople
Document typeProcedure. The regimes ask for the content, not the label; a line pasted as a standard, procedure, plan or schedule is placed here with the label noted.
Folds intoThe regimes accept it folded into the hr security policy (joiners, movers, leavers); when neither is listed, the gap is counted once, under the parent.
Expected ownerThe head of HR.
Review cadenceAnnual (the register's default: the clauses say planned intervals and on significant change, and do not fix a period).
On the gap list whennever on its own: the register recognises it and names the clauses, but no ticked regime lists it as a separate document (its parent, hr security policy (joiners, movers, leavers), is).
TemplateNo template yet. The clauses below say what the document is expected to contain.

Which standards require it, and what each expects it to contain

1 requiring clauses, 1 regimes

Shown on a register for the regimes you tick; with none ticked, ISO 27001 is applied. Requirement text drawn from a human-verified compliance corpus under licence: the corpus statement of each clause, not the instrument verbatim.

ISO/IEC 27001:2022

ISO 27001 6.4 Disciplinary process

Have a formal, communicated disciplinary process for security policy violations.

What the ISO 27002 guidance expects the document to say: Requires a formalised disciplinary process, communicated in advance, so that action can be taken where personnel or other relevant parties have breached information security policy.

Evidence an auditor accepts: The formalised disciplinary process covering information security breaches, and evidence it was communicated in advance; evidence of the link from incident and compliance findings into the disciplinary route, including who decides to invoke it; records of cases where the process was invoked, with the assessment of the breach and the outcome
Common gap: Policy exists but not communicated to staff
Source: ISO/IEC 27001:2022; guidance ISO/IEC 27002:2022

Do this for every document on your list

Paste the list and get this reading for every document at once, with the owner and cadence against each, the clauses quoted, and the documents the regimes expect that the list does not carry. Eight documents free, no account.

Build a register

Confidentiality and non-disclosure agreement · HR security policy (joiners, movers, leavers)