ISO 27001 A.6.4: disciplinary process, explained for startups

A.6.4 Disciplinary process

There is a fair process for handling breaches of security rules. What proves it: a disciplinary process staff know about that covers breaches of security policy.

A certification auditor samples the handbook clause on security violations. A file that usually does the job: the disciplinary section of your handbook that names breaches of security policy.

How to put it in place

Each step leaves a record, and the record is what the auditor samples rather than the step itself. Inside Polara, the control card for A.6.4 walks you through it in this order.

1. Add a paragraph to the handbook: breaches of security policy follow the disciplinary process, scaled to severity.
2. Point to it from the acceptable use policy.
3. Make sure staff acknowledge the handbook.

The free ISO 27001 readiness assessment asks one question that evidences it:

• Do you have a disciplinary process for security violations?

Policies, connectors and the SOC 2 overlap

In the ISO 27001 policy pack, the People and Human Resources Security Policy covers A.6.4. An auditor reads the policy for the rule, then samples the records to see the rule was followed.

The same evidence counts toward SOC 2. The Trust Services criteria that cover this ground: CC1.1, integrity and ethics and CC1.5, accountability.

People controls

A.6.4 is one of the 8 people controls in Annex A. What happens before, during and after someone works for you: screening, terms, training, discipline, remote work and reporting. Small teams meet these with a handful of signed records.

Nearby controls in the same theme:

• A.6.1, background screening
• A.6.2, employment terms
• A.6.3, security training
• A.6.5, duties after leaving
• A.6.6, confidentiality agreements
• A.6.7, remote work

Before it: A.6.3, security training. After it: A.6.5, duties after leaving. Every control, by theme, is on the Annex A controls page.