ISO 27002:2022, Control 6.4 – Disciplinary Process

What Is the Purpose of Control 6.4?

The purpose of the disciplinary process is to ensure personnel and other relevant interested parties understand the consequences of an information security policy violation.

Apart from ensuring that employees and other relevant interested parties understand the consequences of information security policy violations, control 6.4 is designed to deter and help deal with those that violate these policies.

A key element of an effective information security programme is the ability to implement appropriate disciplinary actions for employees who violate information security policies and procedures. This way, employees are aware of the consequences of violating established policies and procedures, thus reducing the potential for intentional or accidental data breaches.

The following are examples of activities that may be included when implementing this control:

• Conduct periodic training sessions on policy changes;
• Design disciplinary actions for non-compliance with information security policies;
• Provide a copy of the organisation’s disciplinary procedures to each employee;
• Ensure that disciplinary procedures are followed consistently in similar situations.

The disciplinary actions spelled out in the framework/document should be taken promptly following an incident, to discourage others who may want to violate organisational policies.

What Is Involved and How to Meet the Requirements

To meet the requirements of control 6.4, disciplinary action must be taken when there is evidence of non-compliance with the policies, procedures, or regulations of the organisation. This includes non-compliance with legislation and regulations that apply to the organisation.

According to control 6.4, the formal disciplinary process should provide for a graduated response that takes into consideration the following factors:

1. The nature (who, what, when, how), gravity, and consequences of the breach;
2. Whether the offence was malicious (intentional) or unintentional (accidental);
3. Whether this is the first or second offence;
4. Whether or not the violator received adequate training.

The action should take into account all pertinent legal, legislative, regulatory, contractual, and corporate obligations, as well as any other pertinent circumstances.

Changes and Differences from ISO 27002:2013

If you are familiar with ISO 27002:2013, you will know that even though the control identity/ number has been changed, control 6.4 in ISO 27002:2022 is not exactly a new control. Rather, it is a modified version of control 7.2.3 in ISO 27002:2013.

That said, there are no significant differences between the two controls in both versions of ISO 27002. The little difference you will notice is that the control number has been changed from 7.23 to 6.4. Also, in the 2022 version of the standard, the attributes table and statement of purpose have been included. These two features are not in the 2013 version.

Aside from their different wording, these controls are basically identical in terms of their content and context. User-friendly terminology was used in ISO 27002:2022 to make sure that the standard’s users could better understand its content.

Who Is in Charge of This Process?

In most cases, the disciplinary process is handled by the department manager or human resources representative. It is not uncommon for the HR representative to delegate the responsibility of disciplinary action to someone else in the organisation, such as an information security specialist.

The main purpose of disciplinary action is to protect the organisation against any further violations by the employee. It also aims to prevent similar incidents from reoccurring by ensuring that all employees understand the significance of information security violations.

In order to make sure that disciplinary action is taken against an employee who has violated an organisation’s policies or procedures, it is important that there are clear guidelines for handling such situations. These guidelines should include specific instructions about how to conduct investigations and the actions that should be taken after investigations have been completed.

What Do These Changes Mean for You?

If you are wondering what these changes mean for you, here is a brief breakdown of the most important points:

• It is not a significant change, so you don’t need to re-certify.
• You can keep your existing certification until it expires (if it is still valid).
• There are no major changes in the content of ISO 27002.
• The focus is more on updating the standard to align with current best practices and standards.

The structure of the standard remains unchanged. Some controls have been amended, though, to clarify their meaning or improve consistency with other parts of the standard.

However, if you are intending on obtaining ISMS certification, you may need to examine your security procedures to verify they are in compliance with the revised standard.

To learn more about how the new ISO 27002 may affect your information security operations and ISO 27001 certification, please check out our free ISO 27002:2022 guide.

How ISMS.Online Helps

ISMS.Online is the leading ISO 27002 management system software that supports compliance with ISO 27002, and helps companies to align their security policies and procedures with the standard.

The cloud-based platform provides a complete set of tools to assist organisations in setting up an information security management system (ISMS) according to ISO 27002.

These tools include:

• A library of templates for common corporate documents;
• A set of predefined policies and procedures;
• An audit tool to support internal audits;
• An interface for customising ISMS policies and procedures;
• An approval workflow for all changes made to policies and procedures;
• A checklist for making sure that your policies and information security processes follow the approved international standards.

ISMS.Online also allows users to:

• Manage all aspects of the ISMS life-cycle with ease.
• Get real-time insights into their security posture and compliance gaps.
• Integrate with other systems like HR, finance, and project management.
• Demonstrate compliance of their ISMS with ISO 27001 standards.

ISMS.Online also provides guidance on how to best implement your ISMS by providing tips on how to create policies and procedures related to aspects such as risk management, personnel security awareness training, and incident response planning.

Our platform has been designed from scratch with the help of information security experts from around the world, and we have developed it in a way that makes it easy for people without any technical knowledge about information security management systems (ISMS) to use it.

Want to see it in action?

Get in touch today to book a demo.