Measure · ISO 27001 and other standards
Handle security rule violations fairly
Include security violations in the existing personnel process. Communicate the procedure, investigate a suspicion and give reasons for the appropriate response under applicable rules.
Reuse existing records
Use the existing personnel procedure and current employee rules. An incident stays in its existing case record; do not copy confidential personnel decisions into an open sanctions register.
What to do
- 1
Define and communicate the procedure
Review how the existing personnel process handles security violations. Name responsible roles, fact-finding, possible graduated responses and required participation under applicable legal and contractual rules. Consider nature, severity and consequences, intent, repetition and prior training. Explain the intended handling to the people concerned.
- 2
Establish facts and give reasons for the decision
Distinguish a report or suspicion from an established violation. Have the authorised function review known facts and relevant circumstances before making a disciplinary decision. Necessary immediate protection uses the existing incident procedure. In the protected personnel record, note the established facts, basis for the decision, decision and subsequent handling with date and responsible role.
- 3
Implement the result confidentially
Communicate and carry out the permissible decision through the designated personnel process. Restrict access to personal information. Feed necessary improvements to rules or training into existing improvement workflows without unnecessary personal details.
Worked example
A confidential file goes to the wrong distribution list
Fictional example: A confidential file has been sent to the wrong distribution list. It is unclear whether a deliberate violation occurred.
- Separate protection from the personnel decision
- DecisionIncident coordination limits disclosure. The authorised personnel function investigates the facts, including known rules and training, then makes a reasoned decision.
- EvidenceProtected personnel record with facts and decision; the incident record contains only the reference needed for its task.
Record the result
- A known formal procedure with responsibility, fact-finding and a proportionate decision.
- Where a case exists, protected evidence of the reviewed basis and actual decision.
Common implementation mistakes
Automatically sanctioning the person who reports
Assess an established violation and its circumstances. Early reporting is not evidence of deliberate misconduct.
Documenting personal sanctions openly
Keep the confidential decision in the designated personnel process and share only necessary information.
Reuse the implementation across requirements
The references below show which requirements the measure contributes to.
View controls and standards
- A.6.4 · DisziplinarverfahrenGerman guide
The workflow describes a communicated formal procedure, verifies a violation before a disciplinary decision and leads to a reasoned, proportionate response. Specific legal permissibility and actual decisions remain organisation-specific.
TISAX · 2.1.2
VDA ISA 6.0.3 · Partial overlap
The handling of violations supports the corresponding part of ISA. Contractual security and confidentiality duties and actual compliance are not established in full.
Reference
Templates for your implementation
Related resources
Related measure
Handle the actual incident separatelyView measureUse the existing case record for containment, evidence and lessons learned.
Kopexa
Policies and acknowledgements in the Workforce HubExplore featureConnect current versions to target groups, acknowledgements and knowledge checks.