ISO 27001 A.6.4: Disciplinary Process

Quick Reference (60 Seconds)

What the Control Asks For

Do you need this control?

A.6.4 is not mandatory in itself: under clause 6.1.3 you include it if your risk assessment calls for it, and record the decision in your Statement of Applicability. Most organisations with staff include it, usually by linking information security breaches to the existing HR disciplinary process. The process must follow Indian labour law and natural justice.

The Control in Brief

Annex A 6.4 asks organizations to formalise and communicate a disciplinary process so that action can be taken against personnel and other relevant interested parties who violate the information security policy.

Implementation Guidance (ISO 27002:2022, paraphrased)

• The disciplinary process should not start without prior verification that a violation occurred (evidence collected under A.5.28)
• It should provide a graduated response that takes into account: (a) the nature (who, what, when, how) and gravity of the breach and its consequences; (b) whether it was intentional (malicious) or unintentional (accidental); (c) whether it is a first or repeated offence; (d) whether the person was properly trained
• The response should consider legal, statutory, regulatory, contractual and business requirements
• The process should act as a deterrent, and allow immediate action for deliberate violations
• The identity of people subject to disciplinary action should be protected in line with applicable requirements
• Good information security behaviour can be recognised and rewarded

Good practice on top of this: a documented procedure, communication to all staff, consistency, an appeal route and securely kept records.

"Shall" vs "Should" Analysis

• Shall (once you have selected this control): a disciplinary process is formalised and communicated
• Should: Specific sanctions and procedures are flexible based on organizational context and legal requirements

Common Misinterpretations

Why Disciplinary Process Matters

The Business Risk Narrative

A formal disciplinary process is essential for maintaining security culture and accountability. Without it, security policies become unenforceable:

• Labour disputes can take years to resolve, and reinstatement with back wages can be ordered if the process was unfair
• DPDP Act 2023: a breach caused by staff misuse is still the fiduciary's breach; failing to take reasonable safeguards can attract penalties of up to ₹250 crore
• Courts in India look at whether the employer followed "principles of natural justice" (fair hearing, opportunity to defend)

Regulatory Landscape in India

Industry-Specific Consequences

Cost of Getting It Wrong

• Inconsistent or unfair discipline is challenged before labour authorities and courts, often for years, with possible reinstatement and back wages
• Perceived unfairness damages morale and discourages people from reporting incidents

Scope and Applicability

What the Control Covers

• Formal disciplinary procedure: Documented, step-by-step process for handling violations
• Graduated sanctions: Proportionate consequences based on violation severity
• Investigation process: Fair, evidence-based investigation of alleged violations
• Due process: Show cause, hearing, opportunity to defend, reasoned decision
• Appeal mechanism: Process for challenging disciplinary decisions
• Communication: Employees informed of disciplinary process and consequences
• Record keeping: Secure maintenance of disciplinary records
• Corrective action: Retraining, mentoring, improvement plans alongside sanctions
• Union compliance: Process aligned with collective bargaining agreements and standing orders
• Cross-reference: Linkage to employment terms, security policies, and legal requirements

Who It Applies To

What It Does NOT Cover

• General performance management (covered by HR processes)
• Grievance handling by employees against employer (covered by grievance procedures)
• Criminal prosecution (covered by law enforcement)
• Civil litigation (covered by Legal)
• Termination for non-security reasons (covered by general HR/termination procedures)

Size-Based Applicability

Key Definitions and Terminology

Relationship to Other Controls

Upstream Controls (Prerequisites)

Downstream Controls (Enabled By)

Parallel Controls (Work Alongside)

Implementation Roadmap (Week-by-Week)

Phase 1: Discovery & Assessment (Weeks 1-2)

Week 1: Current Disciplinary Process Assessment

• Deliverable: Current disciplinary process maturity assessment
• Owner: HR + Legal + CISO
• Activities:
  1. Review existing disciplinary policy (if any)
  2. Assess current handling of security violations (ad-hoc? formal?)
  3. Interview managers about how they handle security violations
  4. Review past disciplinary cases (security-related) for consistency and fairness
  5. Assess current documentation of disciplinary cases
  6. Identify legal compliance gaps (Industrial Relations Code, standing orders, CBA)
  7. Survey employees on their understanding of disciplinary process
  8. Benchmark against industry practices and ISO 27001 requirements

Week 2: Risk and Gap Analysis

• Deliverable: Disciplinary process gap analysis report
• Owner: HR + Legal + CISO + Compliance
• Activities:
  1. Map security violations to current disciplinary response (or lack thereof)
  2. Identify violations that have gone undisciplined
  3. Assess legal risk of current ad-hoc approach (wrongful termination, labor disputes)
  4. Identify inconsistencies in how different departments handle violations
  5. Map regulatory requirements for disciplinary process
  6. Assess union/CBA implications for disciplinary process
  7. Define target state for disciplinary process maturity
  8. Create gap closure plan

Phase 2: Design & Planning (Weeks 3-4)

Week 3: Disciplinary Policy and Procedure Design

• Deliverable: Draft Disciplinary Policy + Procedure + Sanctions Matrix
• Owner: HR + Legal + CISO
• Activities:
  1. Draft formal Disciplinary Policy for Information Security Violations
  2. Define violation categories (Minor, Moderate, Major, Critical)
  3. Create graduated sanctions matrix for each category
  4. Design investigation procedure (who investigates, evidence standards, timeline)
  5. Design due process procedure (show cause, hearing, defense, decision)
  6. Design appeal mechanism (who hears appeals, timeline, grounds)
  7. Define roles (Enquiry Officer, Presenting Officer, Defence Representative, Appellate Authority)
  8. Create documentation templates (charge sheet, findings, order, appeal)
  9. Review for labor law compliance (Industrial Relations Code, standing orders, CBA)
  10. Create union/CBA alignment strategy (if applicable)

Week 4: Communication and Training Design

• Deliverable: Communication Plan + Training Materials + Employee FAQ
• Owner: HR + CISO + Training Team
• Activities:
  1. Design employee communication strategy (why, what, how, consequences)
  2. Create disciplinary process FAQ for employees
  3. Create manager training on identifying and reporting violations
  4. Create HR training on conducting investigations and inquiries
  5. Create enquiry officer training on conducting fair inquiries
  6. Create employee awareness materials (posters, videos, intranet)
  7. Design case tracking system (HRIS, ticketing, or dedicated tool)
  8. Create metrics and reporting framework

Phase 3: Implementation (Weeks 5-8)

Week 5: Policy Approval and Publication

• Deliverable: Approved policy published and communicated to all employees
• Owner: HR + Legal + CISO + Management
• Activities:
  1. Finalize policy and procedure with Legal review
  2. Obtain management approval (CEO, board if required)
  3. Align with Standing Orders (if applicable, submit for certification)
  4. Communicate policy to all employees (email, town hall, intranet)
  5. Publish policy on employee portal
  6. Add to employee handbook
  7. Create acknowledgment requirement (all employees must acknowledge)
  8. Track acknowledgment completion

Week 6: Training Rollout

• Deliverable: All managers and HR trained; employees aware
• Owner: HR + CISO + Training Team
• Activities:
  1. Train all managers on violation identification and reporting (2-hour session)
  2. Train all HR staff on investigation and inquiry procedures (4-hour session)
  3. Train designated enquiry officers on conducting fair inquiries (1-day session)
  4. Conduct employee awareness sessions (30 minutes, all hands)
  5. Create and share disciplinary process video (5 minutes)
  6. Publish FAQ on intranet
  7. Create quick reference card for managers

Week 7: Case Tracking and Tools Implementation

• Deliverable: Case tracking system operational; first mock case processed
• Owner: HR + IT + CISO
• Activities:
  1. Implement case tracking system (HRIS module, ServiceNow, or spreadsheet)
  2. Create case intake form (violation report, evidence, initial assessment)
  3. Create case workflow (intake → investigation → inquiry → decision → appeal → close)
  4. Configure alerts and escalations (SLA, overdue cases, critical cases)
  5. Create case documentation templates (charge sheet, findings, order)
  6. Process first mock case end-to-end to test workflow
  7. Train case managers on system use

Week 8: Union and CBA Alignment (if applicable)

• Deliverable: Union agreement or CBA alignment achieved
• Owner: Legal + HR + Union Representatives
• Activities:
  1. Present disciplinary process to union representatives
  2. Negotiate security-related disciplinary terms in CBA
  3. Establish joint disciplinary committee (management + union) if required
  4. Align Standing Orders with new disciplinary process
  5. Obtain union sign-off on security violation definitions and sanctions
  6. Create union-specific communication materials
  7. Ensure grievance mechanism integrates with appeal process

Phase 4: Testing & Validation (Weeks 9-10)

Week 9: Process Testing

• Deliverable: Process validation report with mock cases
• Owner: HR + Internal Audit + CISO
• Activities:
  1. Process mock minor violation case (e.g., unreported lost badge)
  2. Process mock moderate violation case (e.g., unauthorized software installation)
  3. Process mock major violation case (e.g., data leakage to wrong party)
  4. Test investigation procedure (evidence collection, witness interviews)
  5. Test due process (show cause, hearing, defense, decision)
  6. Test appeal process (filing, hearing, decision)
  7. Test case tracking system workflow and documentation
  8. Test union/CBA compliance (if applicable)
  9. Verify legal compliance at each step

Week 10: Compliance and Audit Validation

• Deliverable: Compliance validation report
• Owner: Legal + Compliance Manager + HR
• Activities:
  1. Validate policy against Industrial Relations Code 2020 requirements
  2. Validate Standing Orders compliance (if applicable)
  3. Validate CBA compliance (if applicable)
  4. Verify employee acknowledgment completion
  5. Test case record security and confidentiality
  6. Verify DPDP compliance for disciplinary records (personal data)
  7. Prepare compliance evidence package
  8. Conduct internal audit of disciplinary process

Phase 5: Documentation & Certification Prep (Weeks 11-12)

Week 11: Documentation

• Deliverable: Complete disciplinary process documentation
• Owner: HR + Compliance Manager
• Activities:
  1. Document all policies, procedures, and templates
  2. Create illustrative scenarios and examples (anonymized)
  3. Create training materials and videos
  4. Create FAQ and quick reference guides
  5. Create metrics dashboard and reporting templates
  6. Create evidence repository for audits
  7. Document union/CBA agreements (if applicable)

Week 12: Certification Readiness

• Deliverable: Audit-ready evidence package
• Owner: CISO + Compliance Manager
• Activities:
  1. Conduct internal audit of disciplinary process
  2. Prepare evidence for external ISO 27001 auditor
  3. Remediate any gaps found
  4. Conduct management review
  5. Make the programme and its records available for internal and certification audits

Detailed Implementation Guidance

Step-by-Step Implementation

Step 1: Define Security Violation Categories

Simulated phishing: a click in a phishing simulation is a learning event, not a violation. It triggers coaching, never sanctions (see A.6.3). Discipline applies to wilful or concealed breaches and to failing to report. ISO 27002 also expects the disciplinary process to consider whether the person was properly trained.

Step 2: Create Graduated Sanctions Matrix

Weigh the 27002 factors in every case: nature and gravity, intentional or accidental, first or repeat, and whether the person was properly trained. Suspension as a punishment must stay within your certified or model standing orders (the model standing orders cap it at four days at a time); check with Legal.

Note: For critical violations, the process may skip graduated steps. Immediate termination is possible only after due process, not as a knee-jerk reaction. Suspension pending investigation is appropriate.

Step 3: Design Investigation Procedure

1. Violation Detection: Security monitoring, incident report, audit finding, tip, or manager observation
2. Initial Assessment: Security team assesses if the incident constitutes a violation and determines category
3. Case Assignment: HR assigns case to investigator (Enquiry Officer or investigation team)
4. Evidence Collection: Gather logs, emails, witness statements, device analysis, access records
5. Employee Notification: Employee informed of alleged violation and invited to respond (show cause)
6. Employee Response: Employee provides explanation, evidence, and context
7. Investigation Report: Investigator prepares report with findings, evidence, and recommendation
8. Sanctions Committee Review: Committee (HR, Legal, CISO, manager) reviews report and recommends sanction
9. Decision: Sanction determined and documented
10. Communication: Employee notified of decision in writing with appeal rights
11. Execution: Sanction implemented (warning, suspension, termination, etc.)
12. Appeal: Employee may appeal within specified timeframe
13. Close: Case closed, records maintained, lessons learned documented

Step 4: Design Due Process Procedure (For Major and Critical Violations)

Under Indian labor law, for major and critical violations, a formal domestic inquiry must be conducted before termination:

1. Charge Sheet: Formal document listing specific charges against the employee with supporting evidence
2. Show Cause Notice: Employee given 3-7 days to explain why disciplinary action should not be taken
3. Enquiry Officer Appointment: Neutral officer appointed to conduct inquiry (can be internal or external)
4. Presenting Officer: Management representative who presents the case
5. Defence Representative: Employee may be represented by a colleague or union representative
6. Witness Examination: Management and employee examine witnesses; cross-examination allowed
7. Employee Defense: Employee presents evidence and defense against charges
8. Findings: Enquiry officer prepares findings based on evidence and testimony
9. Order of Punishment: Management issues order based on findings; must be proportionate and reasoned
10. Appeal: Employee may appeal to appellate authority (higher management)

Note: For minor and moderate violations, a simplified process may be used (manager inquiry, HR review, documented warning) rather than full domestic inquiry. However, for dismissing a "worker" under the Industrial Relations Code 2020 (formerly a "workman" under the ID Act), a full domestic inquiry following natural justice is generally required.

Step 5: Create Documentation Templates

Charge Sheet Template:

Order of Punishment Template:

Step 6: Implement Case Tracking System

Use a case tracking system to manage all disciplinary cases:

Case Status Values: Reported → Under Investigation → Awaiting Show Cause → Under Inquiry → Awaiting Decision → Sanction Issued → Appeal Filed → Under Appeal → Closed

Step 7: Create Appeal Mechanism

Step 8: Implement Corrective Action alongside Sanctions

For non-termination cases, always include corrective action:

• Retraining: Mandatory security training relevant to the violation
• Mentoring: Pair with security-conscious colleague for guidance
• Shadowing: Observe security procedures before independent work
• Access Review: Restricted or supervised access until improvement demonstrated
• Check-ins: Regular manager check-ins on security behavior
• Improvement Plan: 30/60/90-day plan with specific security goals
• Peer Support: Security champion buddy system

Step 9: Create Manager Training

Managers must be trained on:

• Identifying security violations (what to look for)
• Reporting violations (how, when, to whom)
• Supporting investigations (providing evidence, witness statements)
• Enforcing sanctions fairly and consistently
• Supporting employee improvement (retraining, mentoring)
• Avoiding bias and discrimination in enforcement
• Documenting violations and actions
• When to escalate to HR and Security

Step 10: Implement Union/CBA Compliance

For unionized organizations:

• Include security violation definitions in CBA negotiations
• Establish joint disciplinary committee (management + union)
• Define union representative rights in disciplinary inquiries
• Ensure standing orders reflect security disciplinary process
• Get labor authority certification for updated standing orders
• Ensure grievance mechanism integrates with appeal process
• Conduct union training on security risks and business impact
• Frame security as job protection and worker safety

Step 11: Create Communication Plan

Employees must understand:

• What the disciplinary process is
• What behaviors can lead to disciplinary action
• What the graduated sanctions are
• What their rights are (defense, appeal, representation)
• How to report violations (without fear of retaliation)
• That the process is fair, consistent, and non-discriminatory
• Examples of violations and consequences (anonymized)

Step 12: Maintain Records Securely

• Store all disciplinary records in secure, access-controlled system
• Limit access to HR, Legal, and CISO (need-to-know)
• Maintain confidentiality of records
• Retain records for 7 years or employment duration + 7 years
• Secure disposal after retention period (cryptographic erasure)
• DPDP compliance for all personal data in disciplinary records
• Separate disciplinary records from general personnel files (confidential)

Step 13: Implement Metrics and Reporting

• Track violations by category (minor, moderate, major, critical)
• Track sanctions applied (warning, suspension, termination)
• Track repeat violations (recidivism rate)
• Track investigation timelines (time to resolution)
• Track appeal rates and outcomes
• Track training completion for sanctioned employees
• Track improvement rates (employees who improve after sanctions)
• Report quarterly to management and board
• Benchmark against industry data

Step 14: Integrate with Incident Management

• All security incidents involving employee misconduct should be evaluated for disciplinary action
• Incident response team should notify HR of potential violations
• Disciplinary investigation should be separate from incident investigation (but coordinated)
• Incident findings can be used as evidence in disciplinary inquiry
• Disciplinary outcome should be recorded in incident register
• Learn from incidents to improve disciplinary policy

Step 15: Continuous Improvement

• Annual review of disciplinary policy and sanctions
• Quarterly metrics review
• Annual training for managers and enquiry officers
• Post-incident review of disciplinary process effectiveness
• Benchmark against industry best practices
• Update for regulatory changes (labor law, DPDP, industry-specific)
• Gather feedback from employees and managers on process fairness
• Learn from appeals and legal challenges to improve process

Tools, Technologies, and Solutions

Complete Tool Comparison

Recommendations by Organization Size

Policy and Procedure Templates

Disciplinary Policy for Information Security (Key Sections)

Disciplinary Procedure

Risk Assessment and Treatment

Key Risks Addressed by This Control

Audit and Compliance Checklist

Audit Questions (25 Questions)

Metrics and KPIs

Key Metrics Dashboard

Common Pitfalls and How to Avoid Them

Illustrative Scenarios

Illustrative scenario, a composite example for guidance, not a specific Singahi engagement or a verified outcome.

Illustrative Scenario 1: Indian SaaS Company, TechFlow Analytics

Company Profile:

• Size: 180 employees
• Industry: B2B SaaS, Data Analytics Platform
• Location: Gurgaon, India
• Customers: 200 enterprise clients globally
• Regulatory Scope: DPDP Act 2023, SOC 2 Type II, ISO 27001, GDPR

Challenge: TechFlow had no formal disciplinary process for security violations:

• When a developer accidentally committed AWS credentials to GitHub, the CTO "had a chat" with him but no formal action
• When a sales rep emailed customer list to personal Gmail, no action was taken because "sales needs data"
• When a QA engineer repeatedly ignored mandatory security training, the manager just "reminded" him with no documentation
• When a developer intentionally bypassed code review for a critical fix, no investigation was conducted
• No employee understood what would happen if they violated security policies
• Managers were afraid to take action because they didn't know the process
• A developer who was "warned" 3 times for credential leaks finally caused a breach exposing 50,000 customer records
• The breach led to remediation costs, a regulatory inquiry and customer churn
• The developer could not be terminated quickly because there was no formal procedure or documentation
• The company faced a wrongful termination lawsuit when they eventually terminated the developer without due process

Solution:

1. Week 1-2: Emergency Policy Creation

   • Engaged an external security consultant for emergency disciplinary process design
   • Created formal Disciplinary Policy for Security Violations
   • Defined 4 violation categories with specific examples
   • Created graduated sanctions matrix
   • Created investigation and due process procedure
   • Created documentation templates (charge sheet, findings, order)
   • Legal review for labor law compliance
   • Created anonymous hotline for reporting violations

2. Week 3-4: Manager Training and Communication

   • Trained all 25 managers on identifying and reporting violations (2-hour session)
   • Created manager quick reference card for violation handling
   • Communicated policy to all employees (town hall, email, intranet)
   • Created employee FAQ (20 questions)
   • Required 100% employee acknowledgment
   • Created anonymous reporting hotline (EthicsPoint)

3. Week 5-6: Case Tracking and Implementation

   • Implemented case tracking in BambooHR (HRIS module)
   • Created case intake workflow (violation → investigation → decision → close)
   • Closed the 12 outstanding cases under the rules in force when the conduct happened
   • Created enquiry officer roster (5 trained HR and security staff)
   • First case processed: minor violation (clean desk) → verbal warning + retraining
   • Second case: moderate (unauthorized software) → written warning + retraining + restricted access

4. Week 7-8: Integration and Culture Change

   • Integrated disciplinary process with incident management (security incidents auto-flag HR)
   • Created security champion program (employees recognized for reporting violations)
   • Created monthly security culture report (violations, sanctions, improvements)
   • First major case: developer bypassed security review → formal inquiry → final written warning + 5-day suspension + mandatory security training
   • Employee accepted sanction without appeal; completed retraining successfully

5. Week 9-12: Metrics and Continuous Improvement

   • Created quarterly metrics review with management
   • 100% employee acknowledgment achieved
   • 25 managers trained and certified
   • 5 enquiry officers trained
   • Zero appeals in first 10 cases (fairness perceived)
   • Created lessons learned documentation from each case
   • Policy updated based on first-quarter experience

Results:

• Security violations: 45% reduction in 6 months (deterrence effect)
• Repeat violations: 15% recidivism rate (down from 60% before formal process)
• Employee understanding: 91% of employees understand disciplinary process (survey)
• Reporting: 40% increase in violation reporting (hotline + culture change)
• Case resolution: Average 12 days for minor, 18 days for moderate (within SLA)
• Legal risk: Zero legal challenges; zero wrongful termination risk
• Breach prevention: Zero breaches in 6 months (vs. 3 in previous 6 months)
• Culture: Security compliance became part of organizational culture

Illustrative Scenario 2: Large Manufacturing, Indian Auto Components Ltd. (IACL)

Company Profile:

• Size: 4,500 employees, 3,800 unionized workers
• Industry: Automotive Components Manufacturing
• Location: Chennai, India
• Customers: 15 major automotive OEMs
• Regulatory Scope: DPDP Act 2023, OSH Code 2020, ISO 27001, IATF 16949, ISO 14001
• Union: Strong trade union; CBA renewal every 3 years

Challenge: IACL had a strong union and outdated disciplinary framework:

• Standing Orders from 1995 had no information security provisions
• CBA had no security-related disciplinary terms
• Security violations were handled by "suspending the worker for 3 days" (arbitrary, no process)
• Workers did not understand what constituted a security violation
• A union leader was suspended for 10 days for "computer misuse" without charge sheet or inquiry
• Union filed unfair labor practice claim; labour court ordered reinstatement with back wages
• OT/ICS systems were repeatedly accessed by unauthorized personnel; no disciplinary action because "workers need to do their job"
• A worker stole proprietary CAD designs from shared drive; no formal procedure to investigate
• No formal inquiry for any security violation in 10 years
• Management was afraid to take action due to union power and labor court risk
• ISO 27001 certification was at risk because A.6.4 was not implementable in union environment

Solution:

1. Months 1-2: Union Engagement and Partnership

   • Engaged an external security consultant for union-compliant disciplinary process design
   • Established Joint Security-Disciplinary Committee (3 management + 3 union representatives)
   • Conducted 8 workshops with union leaders on security risks in manufacturing
   • Presented data: 1 OT security incident could halt production, affecting 4,500 jobs
   • Shared industry examples: competitors with security breaches lost OEM contracts
   • Union agreed to security disciplinary terms if:
     • Security training is paid work time
     • Security equipment is provided by company
     • No surveillance of personal activity
     • Full due process (charge sheet, inquiry, representation)
     • Union representative on every enquiry committee

2. Months 3-4: Standing Orders and CBA Update

   • Updated Standing Orders with information security misconduct provisions
   • Added 12 security misconduct categories (unauthorized access, data theft, sabotage, credential sharing, etc.)
   • Defined graduated sanctions: oral warning → written warning → suspension → dismissal
   • Included due process: charge sheet, show cause, enquiry, order, appeal
   • Standing Orders submitted to Labor Commissioner for certification
   • CBA updated with security terms in appendix (jointly signed by management and union)
   • Created joint enquiry committee for security violations (3 management + 3 union)

3. Months 5-6: Training and Communication

   • Security training made mandatory and paid (union requirement)
   • Created plant-floor security awareness in Tamil and Hindi
   • Created visual posters on shop floor: "Security Misconduct = Production Risk"
   • Trained 50 supervisors on violation identification and reporting
   • Trained 20 enquiry committee members on conducting fair inquiries
   • Created worker-friendly FAQ on security and discipline

4. Months 7-9: Implementation and First Cases

   • First case: Worker accessed OT system without authorization (minor) → oral warning + safety briefing
   • Second case: Supervisor shared OT password with junior worker (moderate) → written warning + 2-day suspension + retraining
   • Third case: Worker copied CAD files to USB (major) → formal enquiry → final written warning + 5-day suspension + access restriction
   • Union supported all decisions because process was fair and agreed
   • Zero union disputes in first 9 cases

5. Months 10-12: Continuous Improvement and Certification

   • Quarterly joint committee review of all cases
   • Worker suggestion scheme for security improvements (5 suggestions implemented)
   • Created case tracking system (shared access for management and union)
   • Annual review of Standing Orders security provisions
   • ISO 27001 audit raised no findings on A.6.4
   • Passed IATF 16949 audit with zero findings on personnel security

Results:

• Union relations: Security disciplinary terms agreed with the union
• Security incidents: 55% reduction in security violations in 12 months
• OT security: Zero unauthorized OT access incidents in 6 months
• Labor disputes: Zero labor disputes related to security discipline
• IP protection: No IP theft incidents after formal process implementation
• Production impact: Zero production stoppages due to security incidents
• OEM contracts: Won 2 new OEM contracts citing security program
• Cost: program cost vs. potential labor court costs ( per case) + production loss + contract loss
• Industry recognition: Featured in CII manufacturing security best practices

Multi-Framework Mapping

The references below genuinely overlap with A.6.4. Use them when one set of evidence must satisfy several frameworks.

Regulatory and Industry Context

India Regulatory Framework

International Regulations

Sector-Specific Requirements

Roles and Responsibilities (RACI)

Documentation and Evidence Requirements

Required Documents

Continuous Improvement

Figure · Tiers

Maturity levels for disciplinary process

Maturity Model (Level 1-5)

Improvement Cycle

• Plan: Annual review of disciplinary policy; quarterly metrics; industry benchmarking; regulatory updates; union feedback
• Do: Deploy new tools; update sanctions; train managers; enhance investigation; improve documentation; corrective action innovation
• Check: Measure fairness; audit consistency; benchmark; gather feedback; review appeals; analyze trends
• Act: Standardize; communicate; update procedures; report to management; share best practices; union collaboration

Technology Trends

• AI Investigation Support: AI analyzing logs and evidence for investigation insights
• Insider-risk monitoring: detecting risky activity for investigation (never pre-emptive discipline: action must follow a verified violation)
• Behavioral Forensics: Analyzing behavior patterns to detect insider threat risk
• Digital Case Management: End-to-end digital case management with blockchain evidence integrity
• Automated Due Process: Workflow automation for charge sheet, inquiry, and order generation
• Real-Time Monitoring: Continuous monitoring triggering automated case creation
• Anonymous Reporting AI: AI-powered anonymous hotline with natural language processing
• Union-Tech Collaboration: Digital platforms for joint management-union case review

FAQ

Frequently Asked Questions (20 Questions)

Q1: Is a formal disciplinary process required for ISO 27001 certification? A: Not automatically. No Annex A control is mandatory. Under clause 6.1.3 you choose the controls your risk assessment calls for, then record A.6.4 in your Statement of Applicability as included (and how) or excluded (and why). Most organisations with employees include it, often by linking information security breaches to their existing HR disciplinary procedure. If you include it, auditors will look for a documented, communicated process and evidence that it is applied fairly.

Q2: Can we terminate an employee immediately for a security breach? A: In India, immediate termination without due process is legally risky, especially for "workers" under the Industrial Relations Code 2020. For gross misconduct, you can suspend immediately pending inquiry, but termination requires a formal inquiry and reasoned order. Consult Legal.

Q3: What is the difference between a minor and major violation? A: Minor: unintentional, no impact (e.g., unlocked screen). Major: significant impact or intentional circumvention (e.g., data leakage, unauthorized access). The distinction determines the investigation depth and sanction severity.

Q4: Do we need a domestic inquiry for every violation? A: No. Minor and moderate violations can be handled through manager inquiry and HR review. Major and critical violations (especially those leading to termination) require a formal domestic inquiry under Indian labor law.

Q5: Can a manager issue a warning without HR involvement? A: For minor verbal warnings, yes, but it should be documented. For written warnings and above, HR should be involved to ensure consistency and legal compliance.

Q6: What is a show cause notice and when is it required? A: A show cause notice is a written document requiring the employee to explain why disciplinary action should not be taken. It is required for moderate and above violations, and mandatory before termination.

Q7: How do we handle a unionized workforce? A: Include security disciplinary terms in the CBA. Establish a joint committee. Ensure union representation in inquiries. Get standing orders certified. Frame security as job protection.

Q8: What is the role of CISO in disciplinary process? A: CISO defines security violations, assesses severity, provides technical evidence, recommends sanctions, and participates in the sanctions committee. CISO does not unilaterally terminate employees.

Q9: Can we discipline an employee for a mistake (not intentional)? A: Yes, if the mistake caused harm or violated a clear policy. Negligence can be a disciplinary matter. However, sanctions should be lighter than for intentional violations. Focus on corrective action.

Q10: What if an employee refuses to attend the inquiry? A: Proceed with the inquiry after due notice. The enquiry officer can make an ex-parte decision based on available evidence. However, ensure the employee was properly notified and given adequate opportunity.

Q11: How do we protect employees from retaliation for reporting violations? A: Create a non-retaliation policy. Protect anonymous reporters. Investigate retaliation claims. Discipline retaliators. Celebrate reporting culture.

Q12: Can we use security monitoring as evidence in disciplinary inquiry? A: Yes, but the evidence must be reliable, relevant, and obtained legally. Monitoring must comply with DPDP Act 2023 and labor law. Employees should be informed of monitoring. Evidence must be preserved with chain of custody.

Q13: What is the maximum suspension period? A: Suspension pending inquiry should not be indefinite and carries a subsistence allowance. Suspension as a punishment must stay within your certified or model standing orders (the model standing orders cap it at four days at a time). Prolonged suspension may be challenged in labor courts. Consult Legal.

Q14: Do contractors have the same disciplinary rights? A: Contractors are not employees under labor law, so Industrial Relations Code protections may not apply to them directly. However, their contracts should include disciplinary terms. The contractor's employer may also take action. Contractual terms govern.

Q15: How do we handle a security violation discovered after the employee has left? A: If the violation is discovered post-employment, legal action may still be possible if the contract has post-employment obligations (NDA, IP assignment). Criminal action is possible for theft, sabotage, or fraud. Consult Legal.

Q16: What is the role of HR in disciplinary process? A: HR manages the disciplinary process: case management, investigation coordination, due process, documentation, records, legal compliance, union liaison, and employee communication. HR ensures fairness and legal compliance.

Q17: Can we reduce salary as a disciplinary sanction? A: Under the Code on Wages 2019 (s.18), deductions from wages are allowed only on listed grounds and within limits, and fines are restricted. Wages due on exit must be paid within two working days (s.17(2)). Consult Legal before imposing financial penalties.

Q18: How do we ensure disciplinary process is not discriminatory? A: Use structured procedure, sanctions matrix, committee review, diverse decision-makers, bias training, metrics analysis, and regular audits. Document rationale for all decisions.

Q19: What is the difference between a disciplinary process and a grievance process? A: Disciplinary process: employer takes action against employee for violation. Grievance process: employee raises complaint against employer or situation. They are different but related. Employees should be able to grieve disciplinary decisions.

Q20: What will an ISO 27001 auditor look for in A.6.4? A: The auditor will verify: (1) formal disciplinary policy exists, (2) process is communicated to employees, (3) violation categories are defined, (4) sanctions are graduated, (5) cases are documented, (6) process is applied consistently, (7) there is evidence of use, (8) appeal mechanism exists, and (9) legal compliance is maintained.

References and Further Reading

ISO Standards

• ISO 27001:2022: Information Security Management Systems
• ISO 27002:2022: Information Security Controls
• ISO/IEC 27701:2025: Privacy information management systems

Indian Law

• Industrial Relations Code 2020 (standing orders; replaced the Industrial Employment (Standing Orders) Act 1946)
• Industrial Relations Code 2020 (from 21 Nov 2025 replaced the Industrial Disputes Act 1947 and the Industrial Employment (Standing Orders) Act 1946)
• OSH Code 2020 (replaced the Factories Act 1948)
• Shops and Establishments Act (state-specific)
• OSH Code 2020 (replaced the Contract Labour Act 1970)
• Code on Wages 2019: Section 18 (permitted deductions; replaced the Payment of Wages Act 1936)
• Code on Wages 2019 (replaced the Minimum Wages Act 1948)
• Companies Act 2013
• DPDP Act 2023
• IT Act 2000
• POSH Act 2013
• Official Secrets Act 1923

International

• GDPR (EU): Articles 5, 32, 28
• HIPAA (US): §164.308(a)(3)**, Workforce security
• SOX (US): Internal controls
• UK Employment Rights Act 1996: Fair dismissal
• EU Whistleblower Directive
• ILO Convention: Worker rights and fair treatment

Industry

• NASSCOM: IT industry employment practices
• ISACA: Security and governance guidance
• CII: Industrial employment and security practices
• FICCI: Business and employment law
• Labour Law Journals: Indian labour court judgments