1.9 KiB
| implementation-status | control-origination | |||||
|---|---|---|---|---|---|---|
|
|
ps-8 - [catalog] Personnel Sanctions
Control Statement
-
[a] Employ a formal sanctions process for individuals failing to comply with established information security and privacy policies and procedures; and
-
[b] Notify personnel or roles within time period when a formal employee sanctions process is initiated, identifying the individual sanctioned and the reason for the sanction.
Control guidance
Organizational sanctions reflect applicable laws, executive orders, directives, regulations, policies, standards, and guidelines. Sanctions processes are described in access agreements and can be included as part of general personnel policies for organizations and/or specified in security and privacy policies. Organizations consult with the Office of the General Counsel regarding matters of employee sanctions.
Control assessment-objective
a formal sanctions process is employed for individuals failing to comply with established information security and privacy policies and procedures; personnel or roles is/are notified within time period when a formal employee sanctions process is initiated, identifying the individual sanctioned and the reason for the sanction.
What is the solution and how is it implemented?
Implementation a.
Add control implementation description here for item ps-8_smt.a
Implementation b.
Add control implementation description here for item ps-8_smt.b