PS-8: Personnel Sanctions

a formal sanctions process is employed for individuals failing to comply with established information security and privacy policies and procedures;

personnel or roles is/are notified within time period when a formal employee sanctions process is initiated, identifying the individual sanctioned and the reason for the sanction.

Personnel security policy

personnel security procedures

procedures addressing personnel sanctions

access agreements (including non-disclosure agreements, acceptable use agreements, rules of behavior, and conflict-of-interest agreements)

list of personnel or roles to be notified of formal employee sanctions

records or notifications of formal employee sanctions

system security plan

privacy plan

personally identifiable information processing policy

other relevant documents or records

Organizational personnel with personnel security responsibilities

legal counsel

organizational personnel with information security and privacy responsibilities

Organizational processes for managing formal employee sanctions

mechanisms supporting and/or implementing formal employee sanctions notifications