[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:iso-27001\u002Fa-6-4":3},{"item":4,"lessons":16,"controls":46,"related":72},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"iso-27001","a-6-4","Annex A 6.4","ISO\u002FIEC 27001:2022 Annex A 6.4: Disciplinary process",7,"International Organization for Standardization (ISO) and IEC","**What it asks for.** This control expects a disciplinary process to be formalised and communicated, so that action can be taken against personnel and other relevant parties who have committed an information security policy violation. Its purpose is to make sure people understand the consequences of policy violations, to deter them and to deal with violations appropriately.\n\n**In practice.** Good practice means a process, agreed with HR and legal, that sets out how suspected violations are investigated and how sanctions are decided proportionately, taking into account intent and impact. Staff are informed about it. Auditors expect the documented process, evidence it was communicated and records showing it is applied fairly when needed.\n\n**Common gaps.** Typical gaps are no link between security policy and HR procedures, inconsistent treatment of violations and a process that discourages people from reporting mistakes.",null,"https:\u002F\u002Fwww.iso.org\u002Fstandard\u002F27001","See the standard at ISO","2026-10-18T15:18:43.663+00:00",{"total":9,"list":17},[18,22,26,30,34,38,42],{"slug":19,"title":20,"published_at":21},"openai-engineer-plants-hidden-recording-device-in-executive-conference-room","OpenAI Engineer Plants Hidden Recording Device in Executive Conference Room","2026-10-14T00:21:06.926+00:00",{"slug":23,"title":24,"published_at":25},"german-court-upholds-gdpr-fine-for-unlawful-employee-video-surveillance","German Court Upholds GDPR Fine for Unlawful Employee Video Surveillance","2026-09-15T18:20:24.885+00:00",{"slug":27,"title":28,"published_at":29},"german-court-upholds-8000-gdpr-fine-for-unlawful-employee-surveillance","German Court Upholds €8,000 GDPR Fine for Unlawful Employee Surveillance","2026-09-09T14:21:38.927+00:00",{"slug":31,"title":32,"published_at":33},"german-court-fines-kebab-firm-8000-for-unlawful-employee-video-surveillance","German Court Fines Kebab Firm €8,000 for Unlawful Employee Video Surveillance","2026-09-09T14:21:23.709+00:00",{"slug":35,"title":36,"published_at":37},"italian-dpa-rules-employee-locker-search-violates-gdpr-personal-data-rights","Italian DPA Rules Employee Locker Search Violates GDPR Personal Data Rights","2026-08-04T16:20:54.765+00:00",{"slug":39,"title":40,"published_at":41},"polish-dpa-fines-individual-for-unlawful-cctv-surveillance-beyond-property-boundaries","Polish DPA Fines Individual for Unlawful CCTV Surveillance Beyond Property Boundaries","2026-07-14T10:21:26.762+00:00",{"slug":43,"title":44,"published_at":45},"mayor-unlawfully-accessed-ex-employees-facebook-account-via-work-computer","Mayor Unlawfully Accessed Ex-Employee's Facebook Account via Work Computer","2026-06-22T14:21:22.566+00:00",[47,52,56,60,64,68],{"slug":48,"name":49,"problem":50,"stories":51},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",1,{"slug":53,"name":54,"problem":55,"stories":51},"deception","Deception and honeypots","An attacker who gets in quietly can explore the network for weeks before any alarm goes off.",{"slug":57,"name":58,"problem":59,"stories":51},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",{"slug":61,"name":62,"problem":63,"stories":51},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",{"slug":65,"name":66,"problem":67,"stories":51},"identity-governance","Identity governance and single sign-on","People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.",{"slug":69,"name":70,"problem":71,"stories":51},"security-monitoring-siem","Security monitoring (SIEM)","Logs from everywhere end up in one place, with alerts that someone actually sees.",[73,79,84,88,93,99,103,108],{"family":74,"item":75,"code":76,"title":77,"together":78},"gdpr","6","Article 6","Lawfulness of processing",6,{"family":80,"item":81,"code":82,"title":83,"together":78},"cis","3","Control 3","Data Protection",{"family":74,"item":85,"code":86,"title":87,"together":78},"5","Article 5(1)(f)","Principles relating to processing of personal data",{"family":74,"item":89,"code":90,"title":91,"together":92},"35","Article 35","Data protection impact assessment",4,{"family":94,"item":95,"code":96,"title":97,"together":98},"nist-800-53","ac-2","AC-2","Account Management",3,{"family":100,"item":101,"code":102,"title":102,"together":98},"itil","overview","ITIL",{"family":74,"item":104,"code":105,"title":106,"together":107},"9","Article 9","Processing of special categories of personal data",2,{"family":109,"item":110,"code":111,"title":112,"together":107},"iso","27701","ISO\u002FIEC 27701","ISO\u002FIEC 27701: Privacy information management systems"]