ISO 27001:2022 · People controls
ISO 27001:2022 6.4: Disciplinary process
ISO 27001:2022 6.4 covers Disciplinary process. The held text names 5 evidence records for it, the first being Statement of Applicability entry for control A.6.4, showing inclusion or justified exclusion, implementation status and the risks it.... The common gap an assessor flags is The HR disciplinary policy makes no mention of information security violations.
A formal disciplinary process is to be established and made known so that action can be taken against staff and relevant outside parties who break the security policy. Purpose (stated in ISO/IEC 27002:2022): ensures people understand the consequences of policy violations, deters violations and deals appropriately with those who commit them. As an Annex A reference control, it is compared with the controls determined in risk treatment (6.1.3 c) and recorded in the Statement of Applicability as included or excluded, with the justification and implementation status (6.1.3 d); implementation guidance is ISO/IEC 27002:2022 6.4.
What evidence supports 6.4?
- Annex A people controlStatement of Applicability entry for control A.6.4, showing inclusion or justified exclusion, implementation status and the risks it treats
- Annex A people controlThe formal disciplinary procedure covering information security violations, communicated to personnel and relevant external parties
- Annex A people controlCriteria for a graduated response considering nature, severity, intent, repetition and training received
- Annex A people controlCase records showing that violations were verified before action began
- Annex A people controlEvidence that legal, contractual and business requirements were considered in outcomes
Where this requirement comes from
This is our own statement of ISO 27001:2022 6.4, read from the copy we hold (licensed complete copy) and stated in our words, not the standard verbatim. The framework as we hold it.
Common gaps an assessor flags
- The HR disciplinary policy makes no mention of information security violations
- Action is taken on suspicion without verifying that a violation occurred
- Responses are inconsistent because there are no criteria for graduation
- Contractors and supplier staff fall outside any disciplinary mechanism
How it maps to SOC 2
- CC1.1 high A disciplinary process is how deviations from expected conduct are addressed.
- CC1.5 high A disciplinary process holds individuals accountable for control responsibilities.
A link is a topical overlap with a confidence and a reason. It does not establish that meeting one requirement satisfies the other, and it is not certification.