Disciplinary process

Plain-language summary

Having a formal, known and fair process for dealing with people who break information security policy — so that violations get a consistent, proportionate response, the deterrent works, and any action taken stands up when it is challenged.

What the clause is really asking

Rules without consequences are suggestions, but consequences applied unfairly get overturned, so this control asks for a formal disciplinary process that covers information security violations and that people know about before they need it. The response should be graduated, weighing seriousness, intent, repetition, impact and whether the person had been trained. Action should not start until the violation has been verified. The misunderstanding is that security needs its own disciplinary procedure; name information security offences in the existing disciplinary code instead and have HR apply it. In South Africa any action must still meet the Labour Relations Act and its code of good practice on dismissal: the rule must exist and be known, be applied consistently, and the procedure must be fair. If you cannot show the employee knew the rule, which is what the contract clause, acknowledgement and training records prove, a dismissal is likely to fail at the CCMA. Evidence from email or system monitoring must also have been lawfully collected.

What auditors look for

Auditors ask for the disciplinary code and look for information security offences named in it, then ask how staff are told about it — usually through the contract, induction and the policy acknowledgement. They ask HR for any security-related disciplinary cases in the period and trace one from the incident record through investigation, hearing and outcome, checking the violation was verified first and the sanction was proportionate. They compare outcomes across similar cases for consistency. They ask how the process protects people who report their own mistakes. The hard question: if someone emailed the customer list to a personal address tomorrow, what happens, and who decides?

Typical evidence

Disciplinary code naming information security offences and sanction ranges; evidence staff were informed (contract clause, induction records, policy acknowledgements); incident and investigation records linked to disciplinary cases; hearing records and outcomes; consistency review across similar cases; monitoring policy supporting lawful collection of evidence; management statement protecting good-faith self-reporting of mistakes.

How to comply — recommendations

Add a short schedule to your existing disciplinary code listing information security offences with a sanction range: sharing passwords, disabling security controls, removing confidential or personal information without authority, deliberate misuse of systems, failing to report a known incident. Have your labour lawyer check it against the Labour Relations Act. Reference it in contracts and the acceptable use policy so the rule is known. Write down that mistakes reported promptly and in good faith are handled through coaching, not discipline, so the reporting habit survives. Agree a simple route from incident management to HR, with verification first. Keep a confidential log of cases and outcomes to check consistency.

Common nonconformities

Disciplinary code silent on information security; staff never informed of consequences; serious violations with no recorded action; inconsistent sanctions for similar breaches; action taken before the violation was verified; no link between incident management and HR; evidence relied on that was collected outside the monitoring policy; self-reported mistakes punished, discouraging reporting.

Resources for this clause

• ArticleWhat ISO 27001 actually requires for security awareness and training — clauses 7.2 and 7.3, control A.6.3, and what the auditor tests on the floor
• ArticleISO/IEC 27001:2022 Annex A explained: the 93 controls in plain English, theme by theme, with the 114-to-93 map and the attribute tags
• ArticleThe Statement of Applicability, explained — what ISO/IEC 27001 clause 6.1.3 requires, the four ways an SoA fails Stage 1, and how to build one from the risk register
• ArticleISO/IEC 27001:2022 explained for people who already run ISO 9001: what is the same, what is new, and how to get certified
• Toolkit · $39Risk & SoA ToolkitScore your information security risks on a documented method, pick the Annex A controls that treat them, and the Statement of Applicability writes its own first draft — every justification citing the risks behind it.
• Toolkit · $29ISMS Metrics & Evidence TrackerThe three things an ISMS has to show after certification, in one workbook: measures with a live Green / Amber / Red status, management review minutes that cover every required input, and an evidence register that gives every control an owner, a rhythm and a due date.
• Free downloadAnnex A 93 Controls Quick ReferenceOne A3 page: all 93 Annex A controls in their four themes, the eleven new in 2022 flagged, and the ISO/IEC 27002:2022 attribute legend — the poster for the wall beside the Statement of Applicability.
• Free downloadISO 27001 Gap Analysis ChecklistWhere you stand against ISO/IEC 27001:2022 in one afternoon — the 30 management-system requirements and all 93 Annex A controls, scored, with owners, dates and a readiness figure that calculates itself.
• Free masterclass · ~27 minISO 27001 MasterclassYou already know four fifths of ISO 27001. Here is the other fifth — the risk method, the SoA, the 93 controls, the evidence rhythm, POPIA, and a 44-week path.
• Free appAudit ManagerPlan the programme, anchor each finding to its clause and drive the NC to closure.