What it asks for. This control expects a disciplinary process to be formalised and communicated, so that action can be taken against personnel and other relevant parties who have committed an information security policy violation. Its purpose is to make sure people understand the consequences of policy violations, to deter them and to deal with violations appropriately.
In practice. Good practice means a process, agreed with HR and legal, that sets out how suspected violations are investigated and how sanctions are decided proportionately, taking into account intent and impact. Staff are informed about it. Auditors expect the documented process, evidence it was communicated and records showing it is applied fairly when needed.
Common gaps. Typical gaps are no link between security policy and HR procedures, inconsistent treatment of violations and a process that discourages people from reporting mistakes.