ISO 27001 Annex A 6.4: disciplinary process without the bloat

Your auditor asks to see the security disciplinary process. HR points to a handbook that never mentions information security, and the security team points to an incident log that never reaches HR. This guide shows how to satisfy ISO 27001 Annex A 6.4 in a 25–250 person UK firm without writing a bespoke procedure that HR will resist.

It covers what the control requires, the two additions that meet it, the proportionality factors, the employment-law guardrails, and how auditors sample and grade it, including when you have never disciplined anyone.

What does ISO 27001 Annex A 6.4 require?

The ISO 27001 Annex A disciplinary process, control 6.4, requires a written, communicated answer to what happens when someone breaks the security rules, decided before anyone does. It closes the loop opened by A.6.2's contractual warning and makes the response a deterrent as well as a correction.

Without that decision made in advance, a 50-person firm meets its first real violation in the worst possible way: improvised, in the heat of the moment, by whoever is angriest. Two failures follow. Under-reaction gives a serious breach a quiet word, and the rules lose their force. Over-reaction, such as a summary dismissal without fair process, hands the person an employment tribunal claim and turns your incident into their case.

The control works in two directions. Knowing that consequences exist deters people before they break a rule, and the process corrects behaviour and stops repeats afterwards. It protects confidentiality, integrity and availability alike, because a violation can damage any of them.

Most of what the control asks already exists in a functioning HR department: a disciplinary policy, a fair-process habit and a record of outcomes. The work is connecting that machinery to the incident process, not building a second one.

Auditors read the absence of a process as an ISMS that cannot enforce its own policies. There is a cultural dividend too: people report mistakes when they trust the response will be proportionate, and a fair, published process earns that trust.

What are the ISO 27001 disciplinary process requirements?

An ISO 27001 disciplinary process needs three properties: it is written down and communicated to staff, it establishes the facts before any sanction is applied, and it is applied consistently regardless of seniority. Everything else in the control is a way of proving those three properties to an auditor.

Each property has a matching exhibit, because the auditor will not take your word for it:

• Written and communicated: the HR disciplinary policy or incident procedure showing security violations in scope, plus contract clauses, handbook extracts and onboarding acknowledgements showing staff were actually told.
• Facts before sanction: investigation notes, an evidence trail and a record that the person could respond before any decision was made.
• Consistent application: the criteria used to grade a response, and outcomes that match those criteria whoever was involved.

Checking the facts is where firms are most exposed. Preserve evidence to the standard of Annex A 5.28, because a disputed dismissal can end up in front of an employment tribunal.

Three habits break these properties:

• Improvising each case, so outcomes depend on who is involved and how visible the incident was. Inconsistency is exactly what auditors and tribunals look for.
• Sanctioning before investigating, or on evidence handled so loosely it would not survive challenge.
• Seniority bias, where everyone remembers the founder's exception.

One sampled counter-example, a junior analyst warned for what a director laughed off, undoes the whole control.

How do you implement a disciplinary process in a 50-person firm?

Don't write a standalone security disciplinary procedure. Add one line to the existing HR disciplinary policy confirming that security violations are misconduct handled through it, and one step to the incident procedure defining when and how an incident is handed to HR. The standard is satisfied and nothing new needs maintaining.

The two additions are deliberately small. The HR line makes a security violation a form of misconduct, so it inherits the notice, hearing and appeal steps HR already runs. The incident step says who raises the handover, at what point in the investigation and what HR receives. Drafting takes about half a day with HR, once the incident management procedure exists and Annex A 6.2 has put the contractual hook in place.

Staff must know the process exists. Reference it in three places and re-flag it whenever policies change:

• Employment contracts, where the A.6.2 terms already warn of consequences.
• The staff handbook, in the HR section people actually read.
• Onboarding, with a signed or logged acknowledgement.

A disciplinary process nobody knew about deters nothing, and it is harder to defend when it is finally used.

Keep a case record for any case you run: what happened, how it was investigated, what was decided and why. It lives with HR, not in the ISMS document store.

Training is the dependency to respect. Security awareness training must be in place, with records to prove it, before the process is used, or "were they trained?" answers itself against you.

The pitfall to resist is importing a standalone enterprise procedure with sanction matrices that nobody at a 40-person firm will ever operate. Extra documents are extra maintenance, and a procedure nobody follows is worse evidence than one line that is actually used.

Which proportionality factors should a disciplinary process define in writing?

Four factors, written down because auditors ask for them: how severe the impact was, whether the act was malicious or accidental, whether it is a first or repeat occurrence, and whether the person had been trained on the rule broken. Together they decide whether a case ends in a conversation, a warning or dismissal.

The factors separate a defensible decision from a gut reaction, and each draws on a record you already keep:

• Impact: the severity rating on the incident record.
• Intent: what the investigation found about whether the act was deliberate or a mistake.
• Repetition: earlier incidents or cases involving the same person or the same rule.
• Training status: completion records for the awareness training that covers the rule.

The training factor cuts both ways. An untrained employee's mistake is partly the organisation's failure, so the individual response should soften and the fix belongs to the awareness programme as much as to the person. Punishing someone for a rule they were never trained on turns an organisational failing into an individual one, and it poisons incident reporting for everyone watching.

Pair the factors with a short graduated ladder rather than a sanction matrix: informal conversation and retraining at the bottom, written warnings in the middle, dismissal or legal proceedings for gross misconduct at the top. The policy should reserve the right to jump straight up the ladder for deliberate acts, so a malicious data copy is never forced through a first-warning step.

The table below shows what each tier looks like in practice, and the record each one leaves behind.

How do you discipline security breaches without silencing incident reporting?

Treat innocent mistakes as learning, not misconduct. The NCSC's culture principles state that people involved in an incident are treated fairly, with no punishment for innocent mistakes; staff who fear punishment hide their mistakes. A.6.4 and A.6.8 work together only when sanctions are reserved for deliberate or repeated, trained-for violations.

The NCSC cyber security culture principles on psychological safety say incidents should be investigated to learn and improve, not to blame. The logic is practical. Someone who expects punishment hides the breach, and a hidden breach is one your incident process never sees.

Annex A 6.8 depends on that candour, so we recommend drawing the line in the policy. A mistake reported promptly is handled as an incident with corrective actions. Sanctions apply where an act was deliberate, repeated after retraining, or broke a rule the person had been trained on.

The test is what colleagues conclude when a case closes. If they conclude that reporting is how you get into trouble, the disciplinary process has made your ISMS blinder, not safer.

Balance the stick. Recognising good security behaviour, such as thanking the person who reports a suspicious email, costs nothing and shifts culture more than sanctions do.

What does UK employment law require when you discipline for a security breach?

Section 98 of the Employment Rights Act 1996 makes conduct a potentially fair reason for dismissal, but only if the employer acted reasonably. The Acas Code sets out what reasonable looks like: investigate, put the case in writing, allow a companion and offer an appeal. Tribunals can adjust awards by up to 25% when the Code is unreasonably ignored.

The statute measures reasonableness against the circumstances, including the size and administrative resources of the employer, so a 50-person firm is not held to a corporate HR department's standard. It is still held to a fair one.

Treat the Acas statutory Code of Practice on disciplinary and grievance procedures as the skeleton of every security case:

1. Investigate first. Use the incident process to show the violation occurred, and keep the evidence. Where you can, have one person investigate and a different person hear the case.
2. Give written notice. Tell the person in writing what is alleged, with copies of the written evidence.
3. Hold a meeting. Let them respond, and let them be accompanied.
4. Decide proportionately. Apply the four factors, record the rationale and confirm the outcome in writing.
5. Offer an appeal. Where possible, route it to a manager not involved in the original decision.

A process that follows this sequence, written down before the first case, gives HR the confidence to act and gives you the strongest footing if a tribunal ever reviews it. We recommend taking employment-law advice before any dismissal.

Does A.6.4 apply to contractors and third parties?

Yes. The control reaches beyond employees to other relevant parties, so contractors and agency staff are in scope. They are typically held to account through the sanctions and termination clauses in their own contract or their agency's, rather than through your employee disciplinary procedure.

The reason is commercial leverage. You cannot issue a warning under your handbook to someone who is not your employee, but you can enforce the termination clauses and breach remedies in their contract, or in the agency's agreement with you.

The evidence an auditor wants is therefore the contract itself: a clause that makes the security rules binding, names the consequence of breach and permits termination. Check these clauses before the contractor receives access, not after the first violation. For agency staff, confirm the agency agreement carries the same terms.

The sequencing logic still applies. Get the facts straight before you use a clause, because a wrongly terminated contract is a commercial dispute you would rather not have.

What happens at audit, and how is the control graded?

Auditors ask who decides, where the process is written, what separates a conversation from a warning, and to see a redacted case file. With no cases, scrutiny shifts to the paper and to staff awareness; a missing process or arbitrary handling grades major, while communication gaps grade minor.

Expect five questions in the room:

• Someone shares their password with a colleague. What happens next, and who decides?
• Where is this process written down, and how would a new joiner learn of it?
• What determines whether a violation gets a conversation or a warning?
• Have you used it? Show me a case file, with the name redacted.
• How do you confirm a violation happened before you act?

If incident records show a violation, the auditor traces whether the documented route was followed and whether the response matched your stated criteria. Staff are asked what they think would happen if they broke a rule, which tests whether the communication landed. That interview test is the one most worth rehearsing with your team.

Where the process has never been used, a Stage 2 audit looks only at the paper and at whether staff know about it. An empty case file is fine; an absent process is not. Bring the HR policy or incident procedure with the handover step, contract and handbook extracts, onboarding acknowledgements, training completion records, and any management review minutes showing violation trends reaching the awareness programme.

Certification bodies generally grade the control along these lines:

• Major: no defined process at all, or violations clearly ignored or handled arbitrarily.
• Minor: a process not referenced in contracts or onboarding, or a thinly documented case file.
• Pattern: minor gaps of this kind can aggregate to a major when they recur.

Walk in with those five answers rehearsed and the review becomes a short conversation rather than an interrogation.

How do you engineer the HR-to-security bridge?

Automate the plumbing, keep the judgement human. An incident-workflow rule raises a confidential HR case whenever a violation flag is set, so the handover cannot be forgotten; case records capture the investigation trail as a by-product; anonymised violation trends flow into management review to steer awareness training.

The rule exists to prevent a specific failure: violations surface in incident tickets and quietly die there, with no route to HR. The flag is set when the investigator concludes a rule was broken. From that moment a confidential case exists in HR's restricted workspace, with the incident evidence attached.

The case record builds itself. Investigation notes, the evidence trail, the decision rationale and the outcome attach to the case as the work happens, so the file an auditor asks to see exists without anyone reconstructing it afterwards. Redact the name and it is ready.

Keep the trend view anonymous. Management review rarely needs to know who broke a rule, and naming people there spreads HR data beyond need-to-know. Counts by rule, team and training status are enough to show where the next round of awareness training should aim.

Three people failing the same rule is an awareness gap, not three disciplinary cases.

At 50 people this runs in the background, and the result is a control auditors can sample and enterprise customers can believe. Designing the handover, setting the proportionality criteria and steering real cases through them fairly is judgement work that sits inside our Fractional CISO service.

Frequently asked questions