The process for handling disciplinary breaches under ISO 27001 comprises the following steps.
Under Annex A 6.4 of ISO 27001:2022, organisations must establish and communicate a formal disciplinary process to address violations of the information security policy.
DYG's process
- Reporting: Any disciplinary breach is reported immediately to the information security officer or the head of department.
- Initial investigation: An initial investigation confirms whether a breach occurred and gathers the necessary evidence.
- Formal communication: The information security officer informs the employee of the breach and its possible consequences.
- Assessment: The severity of the breach is assessed and appropriate sanctions are decided.
- Sanctions: Sanctions are applied and may include warnings, training or, in serious cases, dismissal.
- Documentation: Every step of the process is documented for future reference and to ensure transparency.
- Review and improvement: The process is reviewed regularly to ensure it remains effective and compliant with ISO 27001.
This process helps prevent and manage breaches, ensuring that all employees understand the consequences of their actions and the importance of information security, while reducing the likelihood of intentional or accidental data leaks.