ISO 27001 Disciplinary Process: Complete A.6.4 Guide 2026

The ISO 27001 disciplinary process is the control most organizations think they already have, because HR owns a disciplinary policy and nobody has read it since induction. Annex A 6.4 asks for something narrower and more specific than that policy usually delivers, and clause 7.3 quietly makes it impossible to opt out of. This guide covers what the control actually says, why the Statement of Applicability is not an escape route, what the process has to contain, where it stops for contractors, and the records a certification auditor can realistically look at without reading anyone’s personnel file.

What the ISO 27001 disciplinary process requires under Annex A 6.4

Control 6.4 in ISO/IEC 27001:2022 (Edition 3, published October 2022) asks for a disciplinary process that is formalized and communicated, so that action can be taken against personnel and other relevant interested parties who have committed an information security policy violation.

Two verbs carry the whole ISO 27001 disciplinary process requirement. Formalized means written down and approved — most organizations pass that on the strength of an HR document. Communicated means the people it applies to knew about it before the violation, not after. That second verb is where the ISO 27001 disciplinary process usually fails an audit, and it is the one that costs nothing to fix.

Item	Detail
Control reference	Annex A 6.4, Disciplinary process
Theme	People controls — 8 of the 93 controls sit here
Control type	Preventive
2013 predecessor	A.7.2.3, same title, then filed under Human Resource Security
Required verbs	Formalized, communicated
Mandatory document under clause 7.5?	No
Appears in the Statement of Applicability?	Yes — clause 6.1.3 requires every one of the 93

The 2022 renumbering moved this control rather than rewrote it. If your Information Security Management System transitioned from the 2013 edition, the document behind A.7.2.3 is still the right document — it just needs the new reference and, in most cases, a communication record it never had. The wider restructure put the 93 controls into four themes: 37 organizational, 8 people, 14 physical and 34 technological. Our guide to the ISO 27001:2022 Annex A controls covers how the four themes fit together.

Why clause 7.3 makes the ISO 27001 disciplinary process unavoidable

Annex A is a list of candidate controls, and clause 6.1.3 lets you exclude any of them in the Statement of Applicability with a documented justification. That is the usual escape route for controls an organization does not need, and it is the reason teams assume the ISO 27001 disciplinary process is optional for a small, trusting company.

It is not, and the reason sits in the main clauses rather than in Annex A. Clause 7.3 requires that persons doing work under the organization’s control are aware of the information security policy, their contribution to the effectiveness of the ISMS, and the implications of not conforming with the ISMS requirements. That third item is a main-clause requirement. It cannot be excluded, justified away or scoped out, because clauses 4 to 10 are not optional in the way Annex A is.

So if you exclude A.6.4, clause 7.3 still obliges you to tell people what happens when they do not conform — and then an auditor will ask what, in fact, does happen. An exclusion that leaves that question unanswered reads as a gap rather than a decision. In practice the honest options are to implement the ISO 27001 disciplinary process properly, or to implement it and be able to point at where it lives.

Note what is not required: a standalone document called “Disciplinary Procedure”. A.6.4 is not on the clause 7.5 documented-information list — our ISO 27001 mandatory documents checklist sets out what actually is. The mandatory artifact here is the Statement of Applicability line that says the control is applied and names where. An incident management procedure with a disciplinary referral step can satisfy the control perfectly well in a 25-person company.

A.6.4 and A.5.36: the detection half and the response half

A.6.4 is a response control. It assumes somebody has already established that a violation happened. The control that produces that finding is A.5.36, compliance with policies, rules and standards for information security — the one that asks you to review, periodically, whether people are actually following the policies you wrote.

Read together, the pair exposes the most common structural failure: organizations write both controls into the Statement of Applicability, implement neither as a loop, and then have a disciplinary process that has never been triggered because nothing ever detects a violation. Monitoring, logging and access reviews are what feed it. If your last access review found three accounts belonging to people who left, that is either a joiners-and-leavers process failure or an individual one, and the ISO 27001 disciplinary process is how you tell the difference on the record.

What a working ISO 27001 disciplinary process looks like

Seven elements make the difference between a document and an ISO 27001 disciplinary process an auditor can follow end to end.

1. A definition of what counts as a violation. Not “misconduct” — specific categories referencing your own policies: sharing credentials, taking data to a personal account, bypassing a control, ignoring a classification rule, failing to report an incident.
2. Proportionality, written down in advance. A graduated response, so the same decision is reached twice for the same facts by two different managers.
3. A named decision-maker and escalation path. Usually HR plus the information security manager plus the line manager, with legal for anything that may be criminal.
4. Evidence handling that does not destroy the case. A.5.28 covers the collection of evidence; a log export taken badly is still the only proof you had.
5. Fair-process steps. Notice of the allegation, a chance to respond, accompaniment at formal meetings where local law provides for it, and an appeal route.
6. A retention rule for the records. How long the outcome stays on file, and who can see it.
7. A feedback loop into awareness. If three people made the same mistake, the ISO 27001 disciplinary process has told you something about your training, not about those three people.

The table below is an example structure, not a requirement of the standard — ISO 27001 sets no categories, no tariff and no review frequency for this control. Build your own and keep it consistent with whatever your employment contracts and local law already allow.

Category	Example	Typical proportionate response
Low — error, no harm	Sent an internal file to a personal email to work at home	Documented conversation, refresher training, note on file
Medium — careless, recoverable	Shared a login with a colleague; left a classified document unattended	First written warning, mandatory retraining, control tightened
High — deliberate circumvention	Disabled endpoint protection; used an unapproved cloud service for client data	Final written warning, access restricted, incident raised
Severe — intentional harm or theft	Exfiltrated a customer database before resigning	Dismissal process, legal referral, regulator notification assessed
Repeat — same category twice	Second credential-sharing finding within the retention window	Escalate one level, treat as a management failure as well

Contractors, and where the ISO 27001 disciplinary process stops

The control text reaches “personnel and other relevant interested parties”, which is broader than your payroll. The practical problem is that you cannot discipline somebody you do not employ. There is no warning to issue to a contractor and no final written warning for an agency worker’s umbrella company.

For non-employees the route is contractual, and it has to exist before it is needed. That means the obligation sits in the engagement terms, the confidentiality agreement and the supplier agreement, with a stated consequence: removal from the engagement, suspension of access, a breach notification duty, a right to terminate. An ISO 27001 disciplinary process that describes only the employee route leaves the larger population — in many organizations, the one with the most privileged access — covered by nothing at all.

Population	Where the consequence is defined	What the record looks like
Employees	Employment contract and disciplinary procedure	HR case file, outcome letter
Fixed-term and probationary staff	Same procedure, shorter protections in some jurisdictions	HR case file
Agency and umbrella workers	Agency contract plus your site rules	Removal-from-assignment notice to the agency
Independent contractors	Engagement terms and the confidentiality agreement	Breach notice, access revocation record
Supplier and managed-service staff	Supplier agreement security clauses	Supplier incident record, corrective action request

The Acas Code of Practice and its 2026 revision

For UK organizations, ISO 27001 is not the binding constraint on how you run a disciplinary case — employment law is. The Acas Code of Practice on disciplinary and grievance procedures is a statutory code, and employment tribunals must take it into account. The current version was published on 11 March 2015 and remains the one in force.

Acas consulted during 2026 on a redrafted Code. Two proposals matter to anyone writing an ISO 27001 disciplinary process this year: the draft puts early, informal resolution ahead of formal action, and it extends its application from “employees” to “workers” more broadly. As of this writing the draft has not been approved or laid before Parliament, so treat it as direction of travel rather than a requirement — but if you are rewriting the document anyway, drafting it to the wider population costs nothing and matches ISO’s own “other relevant interested parties” scope better than the 2015 Code does.

Outside the UK, the principle transfers even where the statutory machinery does not. US employment is generally at will, which removes the procedural floor but not the evidentiary problem: an inconsistent response to two similar security violations is exactly what a discrimination or wrongful-termination claim is built on. Consistency is a legal defense before it is an audit answer.

Evidence your ISO 27001 disciplinary process has to produce

The ISO 27001 disciplinary process has the most awkward evidence problem in Annex A. Proving it works means showing cases, and cases are among the most sensitive personal records an organization holds. You should not be handing personnel files to a certification auditor, and a competent auditor will not ask for them.

Evidence	What it proves	Privacy handling
Approved procedure with a version and owner	Formalized	None needed
Induction and awareness records showing it was covered	Communicated	Names can be a count
Signed acknowledgments or policy-acceptance log	Communicated, per person	Show the log, not the content
Anonymized case log: date, category, outcome	The process runs	No names, no identifying detail
One redacted worked example	The steps were followed in order	Redact before the audit, not during
Awareness or control changes traced to a case	The feedback loop closes	Reference the case by log ID
Management review minutes referencing the pattern	Clause 9.3 input	Aggregate only

Build that anonymized case log now rather than at audit time. Minimizing what you disclose is a data protection obligation in its own right, and reconstructing a redacted example under time pressure is how identifying details end up in an auditor’s notes.

One more thing worth saying plainly: zero cases is not a failure. Plenty of organizations genuinely have no disciplinary action in a certification cycle. What that changes is the test — without cases, the auditor has to assess the ISO 27001 disciplinary process through a walkthrough, the awareness records and the A.5.36 compliance reviews instead. Prepare for that interview rather than inventing a case.

Five ISO 27001 disciplinary process mistakes that earn a finding

1. A generic HR template that never mentions information security. If the document does not reference your security policies, classification rules or acceptable-use rules, it does not implement A.6.4 — it implements HR’s own obligations and happens to sit nearby.
2. Formalized but never communicated. The document exists, approved and version-controlled, and nobody outside HR has seen it. This is the single most common finding on this control, and the fix is a line in induction plus an acknowledgment record.
3. No proportionality, so no consistency. Without written categories, two managers reach two different outcomes for the same facts, which is both an audit nonconformity and the foundation of an employment claim.
4. Evidence gathered without a method. Logs pulled informally, devices wiped before imaging, interviews unrecorded. A.5.28 exists for this reason and the ISO 27001 disciplinary process depends on it.
5. No loop back into awareness. Three cases of the same mistake is a security awareness training problem. Treating it as three people problems is how the same incident recurs for a fourth time.

Where this sits against NIST CSF 2.0

If you also map to NIST CSF 2.0, the nearest subcategory is GV.RR-02: cybersecurity roles, responsibilities and authorities are established, communicated, understood and enforced. The last word is the one that lines up with A.6.4 — enforcement is treated as part of governance rather than as an HR afterthought. GV.RR-04, which puts cybersecurity into human resources practices, covers the neighboring ground. CSF 2.0 is not certifiable, so this is a mapping convenience rather than a second obligation.

ISO 27001 disciplinary process FAQ

Is a disciplinary procedure a mandatory ISO 27001 document?

No. Clause 7.5 lists the documented information the standard requires, and a disciplinary procedure is not on it. What is mandatory is the Statement of Applicability under clause 6.1.3, which has to record a decision on A.6.4 like every other control. In practice almost every organization applies it, and the document it points to can be an existing HR procedure or an incident management procedure with a referral step.

Can we just point the auditor at our existing HR disciplinary policy?

Often yes, with one condition: it has to cover information security violations explicitly, and people have to have been told. A policy that lists theft, lateness and insubordination but never mentions data, systems or confidentiality is not evidence for this control. Adding a security section and an acknowledgment record is usually a half-day of work.

Can we exclude A.6.4 from the Statement of Applicability?

You can write an exclusion, but it is hard to justify and it does not remove the underlying obligation. Clause 7.3 independently requires that people are aware of the implications of not conforming with the ISMS, and that clause cannot be excluded. An exclusion here usually creates more audit conversation than implementation would.

What if nobody has ever been disciplined for a security violation?

That is normal and it is not a nonconformity. The auditor tests the process differently — a walkthrough of what would happen, the communication and acknowledgment records, and the A.5.36 compliance reviews that would surface a violation in the first place. Do not manufacture a case to fill the gap.

Does A.6.4 apply to contractors and agency staff?

The control reaches personnel and other relevant interested parties, so yes in scope — but not through the same mechanism. For non-employees the consequence has to live in the contract, the confidentiality agreement or the supplier agreement, and the record is a breach notice or removal from the engagement rather than a warning letter.

How often should the ISO 27001 disciplinary process be reviewed?

ISO 27001 sets no interval for this control. Annual review alongside the rest of the policy set is the convention, and it is what most certification bodies expect to see. Review it out of cycle after any case, after an employment-law change in a country you operate in, and whenever your background screening or joiners-and-leavers process changes, since the three share the same population.

Getting the document written

Most of the work in an ISO 27001 disciplinary process is drafting and communication, not technology. If you would rather start from something structured than from a blank page, the ISO 27001 Toolkit ships 165 editable templates for the 2022 edition, including an Employee Disciplinary Process document, Employment Contracts Clauses for the security obligations that belong in the contract itself, and the Statement of Applicability workbook where the A.6.4 decision has to be recorded. It is $99 as a one-time purchase, and the people-controls documents are the fastest part of the pack to adapt.

The short version: write the categories, cover contractors in the contract, tell people the process exists, keep an anonymized case log, and feed what you learn back into awareness. The ISO 27001 disciplinary process is a cheap control to get right and an expensive one to be caught without.