6.4

Disciplinary Process

Establish and communicate a formal disciplinary process to address information security policy violations by personnel and relevant parties.