What A.6.4 disciplinary process requires and why auditors test it
An auditor who asks how your organization responds when someone breaks the security policy is testing A.6.4 Disciplinary process. The control asks for a formalized disciplinary process, communicated to personnel in advance, for taking action against people who have violated the information security policy. The standard also reaches other relevant interested parties, such as contractors or temporary staff, so the process cannot assume that only employees will ever be involved. The risk it addresses is simple to describe: without a known process, responses to the same breach vary by manager, by mood or by who the person is, and an organization that cannot show consistent consequences has little ground to enforce its policy at all. The control lineage runs back to control A.7.2.3 in the 2013 edition, and ISO/IEC 27002:2022 traces A.6.4 to that earlier control, so organizations that already had a disciplinary procedure under the old standard should not assume they are finished.
The difficulty is that the process has to satisfy three conditions at once. It must be written down, it must be known in advance to the people it applies to, and it must actually be used when a breach occurs. Many organizations have a generic HR disciplinary policy that never mentions information security, so the first decision is whether to extend the existing procedure or to create a security-specific annex that maps breach types, such as sharing credentials or mishandling customer data, to proportionate responses. The process also has to sit alongside local employment law, union agreements where they apply, and the contracts and acknowledgments covered by A.6.2 and the training covered by A.6.3. An auditor will look for those links. If the policy says staff were told about consequences but the signed acknowledgment or training record does not show it, the control is weak regardless of how good the written text is.
For evidence, confirm with your HR and legal advisers which records you will keep and for how long, then prepare a short list of what an auditor will sample: the approved process document with version history, proof of communication to staff and relevant third parties, the links to acknowledgments and training completions, and a register of past cases with the breach, the decision, the approver and the reason. Recording cases where no action was taken is as important as recording sanctions, because it shows the process is applied consistently and not only when it suits the organization. Ask your certification body early how it expects a case log to be sampled, since the answer shapes how you retain and redact records. Note that NIST maps the related sanctions control PS-8 to A.6.4 but cautions that mapped controls are not always equivalent, so treat any crosswalk as a starting point rather than proof of coverage.
Who and what the disciplinary process covers
The disciplinary process only works if it reaches the people who can breach the information security policy. Each card below is one scoping decision that determines who falls under the process, which breaches trigger it, and which local rules shape it. Settle these in writing before the first case arises.
Employees and permanent staff
Permanent employees are the core population, and the process should name them plainly with no ambiguity about rank or seniority. Executives and administrators with privileged access often carry the highest impact, so confirm the process applies to them in the same terms. Check that the policy text, the employment contract wording and the HR handbook all describe the same population. Where your contracts reference A.6.2 terms, the link between the two should be easy to trace.
Contractors and temporary staff
Contractors and agency workers often hold the same access as employees but sit outside your HR records. Your disciplinary process may not reach them directly, so the enforcement route is usually the contract or the agency agreement. Confirm which party can remove access, who investigates, and who decides the outcome. Without this, an auditor will ask how a contractor breach is handled and the answer may be unclear.
Other relevant interested parties
A.6.4 extends beyond staff to other relevant interested parties who violate the policy. Typical examples include board members, volunteers, and partner personnel with system access. Decide which groups are in scope and document the route for each, since some cannot be disciplined in the employment sense. Your list should be specific enough that an auditor can see every category of access holder has an outcome defined.
Which breaches trigger the process
Define the breach categories that start the process, from careless handling of a document to deliberate data theft. Map each category to the policy clause it violates and to a severity level. Make clear which breaches go directly to a formal process and which are handled through coaching or retraining. Ambiguous triggers lead to inconsistent outcomes, which is the first thing an assessor tests for fairness.
Local HR, legal and works-council rules
Employment law, data protection rules and works-council agreements vary by jurisdiction and can limit monitoring, investigation and sanctions. Some countries require consultation before a policy with disciplinary effect takes effect. Engage employment counsel in each operating country before finalizing the process. Keep a register of which rules apply to which population so that the process can be applied lawfully in each location.
Third-party contract interaction
When a supplier's personnel breach your policy, the outcome usually flows through the contract, not your internal process. Check whether the supplier agreement requires the supplier to discipline its staff, to remove access on request, and to report breaches. Write the escalation path into the contract template so that the process is enforceable against the supplier. Confirm this with your legal team, since contract terms vary widely.
How the process differs for employees, contractors and third parties
For employees, the main lever is the employment relationship itself. The organization can apply graduated responses such as a documented warning, retraining, restricted access, suspension or dismissal, provided the process is written down, communicated in advance and applied consistently. The policy acknowledgment and the terms of employment are what connect a breach to a consequence, so the disciplinary process should reference them directly.
- Graduated responses: Define the steps, from informal correction to formal action, and state which breaches fall at which level.
- Advance communication: Staff should know the process exists before an incident, typically through the policy, onboarding and the employment terms.
- Access during investigation: Decide when access is restricted while facts are established, and document who approved it.
- Records of each step: Keep the warning, the investigation notes and the outcome with dates and signatures where the process requires them.
- Legal review point: Dismissal, suspension without pay, monitoring of staff and the handling of personal data during an investigation all depend on local employment and data protection law.
Confirm with employment counsel in each jurisdiction how warnings, dismissal and investigations must be run, and which records must be kept and for how long.
Contractors and supplier staff are usually not employees, so the organization cannot rely on its internal disciplinary steps. The levers sit in the contract with the contracting company, the individual's access rights and the organization's right to end the engagement. The disciplinary process should therefore state how a breach by a non-employee is handled and which contract clauses apply.
- Contract remedies: Confirm that the services or supplier agreement sets out security obligations, breach notice, and remedies such as removal of individuals or termination.
- Immediate access revocation: Account disablement, badge withdrawal and removal from shared systems are often the fastest and most within the organization's control.
- Supplier-side action: Ask the supplying company to take its own employment action against its staff and to confirm the outcome in writing.
- Evidence of notice: Keep the notice of breach, the access change record and the supplier's response.
- Legal review point: Termination clauses, liability and any action against an individual employed by a supplier should be reviewed by counsel before a dispute arises.
Check that your contracts name the disciplinary and access-removal obligations, and confirm with counsel how they apply under the governing law of each contract.
The standard's wording extends the process to other relevant interested parties, which can include consultants, temporary staff, partners and visitors with system access. These parties often have no direct employment or contract tie to the organization, so the lever is usually access and the agreement under which they receive it. Where no contract exists, the organization's options narrow and the risk shifts to how access was granted.
- Access as the primary lever: Limit access to what is needed, and remove it promptly when a breach occurs.
- Agreements that bind them: Use confidentiality or acceptable use terms signed before access is granted, so a breach has a stated consequence.
- Partner and reseller arrangements: Where a partner's staff use your systems, the partnership terms should name the remedies and the notice process.
- Visitor and temporary access: Record who was given access, for what purpose and for how long, so the response to a breach can be traced.
- Legal review point: Any claim beyond access removal, such as legal action or referral to authorities, needs counsel's review before it is taken.
Review which interested parties have access to your systems and confirm with counsel which remedies are enforceable against each group.
An auditor will expect the process to cover each group that can breach policy, and will sample records for each. A single formal process that describes the levers for each person type is easier to show than separate informal practices. The evidence should make clear which route applied to a given case and that the route was followed.
- Scope statement: The process should name employees, contractors and other interested parties, and say how each is treated.
- Route selection record: For each case, record which group the person belongs to and which process applied.
- Contract and agreement samples: Keep the signed terms that carry the disciplinary obligations, and show they cover current personnel.
- Access change logs: Show that revocation happened in the timeframe the process sets.
- Consistency review: Periodically compare outcomes across groups to confirm the process is applied fairly.
Ask your auditor early which records they will sample for each group, so the evidence is collected as work happens rather than reconstructed later.
How an assessor tests A.6.4 in practice
This table sets out each step an assessor takes to test the A.6.4 disciplinary process, the evidence requested for it, and the findings that most often delay certification. Read it as a preparation checklist: each row names what the assessor will ask to see and where organizations usually fall short.
| Assessor step | What the assessor looks for | Common finding |
|---|---|---|
| Inspect the written process | A documented, formalized disciplinary process that names the information security policy as the trigger and states the range of possible actions | The process exists only in HR practice and was never written down or approved |
| Check it is communicated in advance | Evidence that personnel were told the process applies before any action was taken, such as policy text, onboarding material or training records | No record showing staff were informed, so the process cannot be enforced against them |
| Confirm coverage of other interested parties | Whether contractors and other relevant parties are covered by contract terms that point to the same process | Contractors are not mentioned, leaving breaches by them outside the process |
| Sample breach cases | Real or simulated cases, with the trigger, investigation notes, decision, sanction and date for each | No case file exists, or the file cannot show who decided and why |
| Test consistency of outcomes | Comparable breaches handled in comparable ways across teams, locations and seniority levels | Outcomes differ between teams, with unexplained leniency for senior staff |
| Confirm acknowledgment records | Signed or electronically recorded acknowledgment that each sampled person received the process | Acknowledgments are missing for some staff or were collected only once at hire |
| Review management review inputs | Records showing that disciplinary trends and open cases reached leadership and fed into policy or training updates | No review record, so the process is never checked for fairness or effectiveness |
Steps to build a disciplinary process an auditor can test
This sequence turns A.6.4 from a policy sentence into a process with agreed scope, reviewed wording, communicated rules, recorded acknowledgments and case records that show the process runs as written. Each step leaves a document or record that an auditor can sample.
Agree the policy breaches in scope
Start by listing the information security policy breaches the process will cover, such as unauthorized access, sharing credentials, mishandling customer data, bypassing controls or failing to report an incident. HR, legal and the security lead agree the list together, and each breach is mapped to the policy clause it violates. The output is a signed breach register that the later steps reference. Ask whether the process also reaches contractors and other interested parties, since A.6.4 covers them too.
Draft a proportionate process with graded responses
Write the process document with graded responses that scale from informal correction to formal action, and state which factors decide the grade, such as intent, severity, repetition and the data or systems affected. Define who decides, who is informed and how the person can respond before a decision is made. The output is a draft procedure with a responsibilities table and a decision flow. Keep sanction wording factual so it can be applied consistently.
Complete legal and HR review
Send the draft to employment counsel and HR to check it against local employment law, works council or collective agreement requirements where they apply, and the organization's existing disciplinary policy. Record each change request and the decision taken on it, so the reviewed version can be traced back to its comments. The output is an approved version with a review record and an effective date. Confirm with counsel which local requirements apply in each country where staff work.
Communicate the process and record acknowledgment
Publish the approved process where staff and contractors can find it, and tell them it applies before any breach occurs. Ask each person in scope to acknowledge it in the organization's HR or learning system, and keep the acknowledgment with the date and the version they accepted. The output is a communication record and an acknowledgment log that shows coverage across the population in scope. Re-issue the process when its version changes.
Link the process to onboarding and training
Connect the process to the terms and conditions signed at hiring, to the security awareness content and to the policy acknowledgments that set the expectations being enforced. New joiners should see the process during onboarding, and training should explain the expected behavior it refers to. The output is a documented link in the onboarding checklist and the training curriculum, so an auditor can follow the chain from expectation to consequence.
Test the process in a tabletop exercise
Run a tabletop exercise with HR, legal, the security lead and a line manager using two or three illustrative scenarios, such as a policy breach by a privileged user and a contractor sharing data. Check that the decision owners, grades and notifications work as written, and record gaps in a findings list. The output is an exercise record with findings, assigned owners and an updated version of the process where the findings required it.
Keep a case log for every matter
Open a case record for each suspected breach, logging the facts, evidence reviewed, the person's response, the grade applied, the decision maker and the outcome. Restrict access to the log because it holds personal data, and link each case to the related incident or access review where one exists. The output is a case log that an auditor can sample, along with proof that the process was followed even where no action was taken. Ask your HR and legal teams how long records are kept under local rules.
Evidence that passes an A.6.4 audit
An auditor testing A.6.4 looks for a written procedure, proof that people were told about it, and records showing it was applied consistently. The cards below cover the documents and records that connect the policy to real decisions, and the upkeep that keeps them current between audits.
Written disciplinary procedure
The procedure is the anchor document. It should name its owner, carry a version number and approval date, state which breaches it covers, and describe the steps from initial report to outcome. Auditors check that the document in use matches the approved version, so keep one controlled copy with a change history. Ask whether the procedure names the other interested parties it reaches, such as contractors and temporary staff, because A.6.4 is not limited to employees.
Communication records and acknowledgments
A process that was never communicated cannot be enforced. Keep records showing when the procedure was published, to whom, and how. Signed or electronically recorded acknowledgments from staff, collected at onboarding and after material changes, are the strongest proof. Track who has not acknowledged and what follow-up was done, since auditors sample both the population and the exceptions.
Link to the information security policy
The disciplinary procedure should point back to the information security policy it enforces and to the terms of employment that bind staff to it. Auditors trace the chain: policy requirement, communicated expectation, breach, then action. Keep a cross-reference table that maps each policy section to the breach categories in the procedure, and review it whenever either document changes.
Anonymized case records and rationale
Case records show the process working in practice. For each matter, record the facts, the policy clause breached, the investigation steps, the decision, and the reasoning behind its severity. Anonymize names and personal details, restrict access to HR and security leads, and keep the rationale even when no action was taken. Consistency across cases is what an assessor looks for, so note comparable prior decisions where relevant.
HR and legal sign-off
Human resources and legal review should be visible in the record. Keep approval evidence for the procedure, confirmation that it fits local employment law and works council obligations where they apply, and sign-off on any sanction that affects employment status. Ask legal to confirm the retention period for case records, since data protection rules limit how long personal information can be held.
Periodic review and upkeep
Set a review cycle for the procedure and record each review, even when nothing changes. Tie reviews to the access review cycle, so that when access rights are recertified, managers also confirm that departures and breaches were handled under the procedure. Define retention rules for case files and acknowledgments, and check them against the review schedule so evidence is available for the auditor's sample period. Confirm the exact cycle and retention periods with your own legal and records team.
What meeting A.6.4 costs in money and effort
This table breaks the cost of running a disciplinary process into components, showing who is paid for each, whether it is one-time or recurring, and what moves it up or down. No fee figures are published for this control, so use the table to build the scope for a quote and to decide which items your own staff can absorb. The main takeaway is that most of the recurring effort comes from joiners, movers and case records rather than from the initial drafting.
| Cost component | Who carries it | One-time or recurring | What drives it up or down |
|---|---|---|---|
| Drafting the disciplinary procedure | Internal HR and legal staff, or an implementation partner if scoped | One-time, revised on change | Number of jurisdictions, existing HR policy quality, and how many related policies must be aligned |
| Legal review of the procedure | Employment counsel in each relevant jurisdiction | One-time, repeated on material change | Local labor law complexity, works council or union consultation needs, and number of employing entities |
| Communication and acknowledgment | HR and security staff, plus line managers | Recurring with each joiner and each policy update | Headcount turnover, number of contractor populations, and whether acknowledgment is embedded in onboarding |
| Building the escalation path and tooling | Security engineers or platform staff, often with an implementation partner | One-time setup, with periodic maintenance | Whether the HR system and ticketing tool already hold the case workflow, and how many approvers are involved |
| Recording cases and outcomes | HR case owners and security reviewers | Recurring, per incident | Frequency of breaches, depth of documentation required, and how cleanly records link to the incident record |
| Management review of cases | Senior HR, legal and security leads | Recurring, periodic | Volume of cases, cadence of management review, and whether trends are reported to leadership |
| Auditor sampling time | Your team provides records; the independent certification body charges for its audit | Recurring each audit cycle | Number of sites and personnel groups in scope, and how quickly records can be produced for sampling |
| Outside help | Implementation partner or consultant, if engaged | Usually one-time build, with optional retainer | Scope of work agreed in writing, amount of internal capacity available, and whether the partner also prepares evidence |
Where self-hosted tools help and where they do not
A.6.4 is mostly a people and policy control, so tooling supports it indirectly. No platform can decide that a breach is serious, hold a fair hearing or choose a sanction, and an assessor will not accept software as the disciplinary process itself. What a self-hosted stack can do is keep the records that show the process was followed: a case-tracking or HR workflow that logs each allegation, the investigator, the decision and the date; a policy acknowledgment record that ties each person to the version of the information security policy they accepted; and access revocation logs that show when privileges were removed while a case was open. Organizations usually build these from existing HR, identity and ticketing systems rather than buying new ones.
Before choosing any tool, confirm three capabilities with the vendor or in your own test environment. First, can the workflow hold confidential case records with restricted access, so that only HR, legal and the named investigators see them? Second, can it retain records for the period your own policy and local employment law require, and export them in a form an auditor can sample? Third, can access changes be exported with timestamps and the identity of the approver, and can they be linked to the case reference? If a product cannot answer yes to these, the evidence will rest on manual notes, which are harder to defend. Ask the vendor for documentation of each capability rather than relying on marketing claims, and test the export before you rely on it.
The limits matter as much as the gains. Tooling cannot make a disciplinary policy communicated in advance, cannot confirm that employment contracts and training reference the sanctions, and cannot judge proportionality. Those remain governance decisions owned by the organization, with HR and legal input and management sign-off. Implementation partners can configure workflows, set retention and access rules, and document how the records map to the process, but they cannot decide outcomes or stand in for the independent certification body that audits the result. Plan for the human side first, then add tooling only where it produces records you would otherwise have to reconstruct by hand.
Who writes the process, who applies it, and who tests it
Your organization owns the disciplinary process and every decision made under it. Leadership approves the procedure, HR and line management apply it to individual cases, and the information security function defines which policy breaches fall under it. Control A.6.4 asks for a formalized process that is communicated in advance, so the people who must enforce it are also the people who must be able to show it was followed.
- Policy ownership: Named owners approve the disciplinary procedure and review it when the information security policy or employment law changes.
- HR and legal decisions: HR, and legal where needed, decide outcomes case by case, taking local employment law and contracts into account.
- Case records: The organization keeps the file for each case, including the alleged breach, the investigation, the decision and its rationale.
- Communication: Staff and relevant third parties receive the process before it is needed, and acknowledgment is recorded.
- Consistency: Managers apply the same standards across teams so that outcomes can be explained to an assessor.
Confirm with your HR and legal advisers which employment rules govern investigations and sanctions in each country where you employ staff.
An implementation partner helps prepare the systems and evidence that show the process exists and works. It can draft the procedure for your review, set up the records that the process generates, and organize the sample file an auditor will select from. The partner does not decide outcomes, does not hold the investigation on your behalf, and does not sign off that the control is effective.
- Procedure drafting: The partner drafts the written procedure, the escalation path and the case template, which your leadership then approves.
- Evidence trail: It configures ticketing, document control and acknowledgment tracking so that every step of a case is recorded with a date and owner.
- Dry run: The partner can walk a hypothetical breach through the process, labeled as illustrative, to find gaps before an audit.
- Sample file preparation: It helps assemble the policy versions, communications and closed cases an auditor will request.
- Scope limits: Work is agreed in writing, and the partner's role stays on preparation, not on operating discipline or claiming compliance.
Ask any partner to state in writing which steps it performs and which remain with your staff.
The auditor tests whether the disciplinary process is documented, communicated and applied as written. An accredited certification body or an independent assessor issues any report or certificate, and only in its own name. Because of that independence, the auditor cannot design the process it then tests, and an implementation partner should not perform the internal audit that the auditor relies on.
- Design review: The auditor reads the procedure and checks that it covers breach types, investigation, decision and appeal.
- Communication check: It samples staff and third parties to confirm they received and acknowledged the process.
- Operating evidence: It selects closed cases, or confirms that none exist, and tests whether steps were followed and recorded.
- Consistency testing: It compares outcomes for similar breaches to judge whether the process is applied proportionately.
- Independence limits: The auditor's findings reflect its own testing, so partner involvement must stay in preparation.
Before engaging an auditor, confirm its accreditation and how it handles conflicts with advisers you have already used.
Where organizations usually fall short on A.6.4
A.6.4 is easy to write down and hard to run. The gaps below are the ones assessors most often find when they move from the written policy to what actually happened. Each card pairs a gap with the fix an auditor is likely to accept.
Process sits only in the HR handbook
The disciplinary procedure exists, but it reads as an employment matter and never mentions the information security policy. Breaches of security rules then get handled as conduct issues with no link to the ISMS. Fix this by adding a security section to the disciplinary procedure that names the information security policy, lists the breach types it covers (for example, sharing credentials or bypassing access controls), and states who decides on action with security input. Check that HR and the security function both own the document.
No proof staff saw the process
Many organizations publish the procedure but cannot show that personnel received it before they could be disciplined. A.6.4 expects the process to be communicated in advance, so an auditor will ask for evidence of that, not just the policy text. Keep dated acknowledgments tied to onboarding and policy updates, and record when the procedure was last communicated to all staff. Confirm that contractors and other relevant parties in scope are covered by the same notice, through their contracts where needed.
Outcomes are not documented
Warnings, retraining and dismissals are often agreed in conversation and never written down. When an auditor samples a breach, the file may show the incident but not what was decided, by whom, or why. Record each case with the breach, the facts established, the action taken, the approver and the date. Store these records with the access controls used for HR files, and confirm the retention period with your legal team before you set one.
Inconsistent treatment across managers
Two managers can respond to the same breach in very different ways, and that is hard to defend as proportionate. Assessors look for a consistent approach, including how severity is judged and who must be consulted before action. Set a severity scale linked to the breach type, define which cases go to HR and security jointly, and review a sample of closed cases each year for variation. Illustrative example: a first accidental policy breach and a deliberate data copy should not follow the same path.
No review after security incidents
Incidents often end with technical fixes and no check on whether personnel behavior contributed. Without that review, the disciplinary process never learns from the breaches that actually happened. Add a step to incident closure that asks whether a policy breach occurred, whether the process was applied, and whether awareness or access changes are needed. Link the outcome to the A.6.3 training records so that repeat causes are addressed through education as well as sanction.
Questions buyers ask about A.6.4 disciplinary process
How much effort does a disciplinary process take to set up?
For most organizations the effort is moderate and front-loaded: a policy document, a short procedure, and a communication plan. The work scales with the number of workforce groups covered, how many existing HR and legal documents must be aligned, and whether the organization already has a conduct or misconduct procedure to extend. Recurring effort is smaller but real: keeping the process current when roles or policies change, recording each case consistently, and confirming that new joiners receive the process at onboarding. Ask any provider to break the effort into drafting, review, communication and ongoing upkeep so you can see where your own team's time goes.
Can we write an A.6.4 disciplinary process in-house?
Yes, many organizations do. The process must be formalized, communicated in advance, and linked to the information security policy, so the information security lead, HR and the policy owner usually draft it together. The areas that most often need outside input are employment law in each jurisdiction where staff work, works council or union obligations in some countries, and consistency with existing HR discipline. An internal team can own the document, while legal counsel confirms it is enforceable. An implementation partner can help structure the evidence and the communication record, but the organization decides the content and owns the outcome.
How long do drafting and legal review usually take?
No duration is supplied for this, and it depends on scope. The main drivers are the number of countries and employment regimes involved, whether works council or collective agreements apply, how many existing policies must be reconciled, and how quickly internal stakeholders can approve drafts. A single-jurisdiction organization with a clean policy set will typically move faster than a multinational with contractors in several legal systems. Ask your counsel and any provider to state assumptions about jurisdictions, approval steps and review rounds, and to show how those assumptions change the timeline.
Will an auditor reject a disciplinary process that has not had legal review?
An auditor tests whether the process exists, is formalized, is communicated in advance, and is applied to personnel who breach the information security policy. The standard does not ask for legal sign-off as such, so an auditor is unlikely to reject a process only because counsel did not review it. However, a process that cannot be enforced, conflicts with employment contracts or local law, or has never been applied consistently creates risk that an auditor will examine through nonconformities or sampling. Legal review is therefore a practical safeguard rather than an audit checkbox. Confirm your certification body's expectations early in the audit planning stage.
What must our team provide to show the process works?
Auditors typically look for a few concrete items:
- The approved disciplinary process document, with version history and owner
- Evidence that it was communicated before any action, such as policy acknowledgments, onboarding records or training completion
- Links to the information security policy and to the employment terms that set expectations
- A case log or record showing how breaches were reviewed, decided and recorded, with dates and outcomes, where cases exist
- Records showing consistent treatment, including how decisions were reviewed when a case was escalated
If no cases have occurred, be ready to explain how the process would be triggered and to show the communication record. Confirm the sample sizes and format with your auditor.
Can an implementation partner replace our legal counsel?
No. An implementation partner can help prepare the process, structure the evidence, set up records and support the communication workflow, but it cannot give legal advice or take responsibility for employment decisions. DeployOpen plans, implements and documents systems and evidence for compliance assessments, and does not issue audit reports or certifications. Legal review of the disciplinary wording, the jurisdictional requirements and any works council obligations must come from qualified counsel the organization engages. Ask any provider to state in writing which parts of the work are technical or documentary and which parts require a lawyer.
What should a written scope for this work include?
A clear written scope prevents disagreement later. It should name the personnel groups covered, including contractors and other relevant interested parties, the jurisdictions in scope, the documents to be drafted or updated, who approves each draft, and the evidence records to be set up. It should also state what the provider will not do, such as legal drafting or case decisions. Most engagements are fixed-scope and agreed in writing before work starts, so ask for deliverables, dependencies on your legal and HR teams, and the assumptions behind any timeline.
How DeployOpen prepares the A.6.4 evidence trail
DeployOpen works on A.6.4 Disciplinary process as an implementation partner. We help you build the formal process, the systems that record it and the evidence an auditor will sample, inside your own infrastructure. Your organization owns the process and its decisions, and only an independent auditor or certification body can assess conformity or issue a certificate.
How we scope
- We agree a written scope for the disciplinary process before any work starts, naming systems, teams and personnel groups it covers.
- We confirm with your HR, legal and security leads which policy breaches the process must address and which other interested parties apply.
- We list the records your auditor will ask for, such as communicated versions, acknowledgments and case logs, and agree who owns each one.
How we build
- We help draft the procedure and map it to your information security policy, role definitions and existing HR workflows.
- We configure self-hosted ticketing or case tools in your environment so each disciplinary case is logged with dates, decisions and approvals.
- We set up retention and access controls so case records stay confidential and can be produced when an auditor requests them.
How we hand over
- We deliver the procedure, configuration notes and an evidence index that points to where each record is stored and who maintains it.
- We walk your team through a sample case from first report to closure so the workflow is repeatable without us.
- We document open items and the decisions your organization still needs to make before an assessment begins.
How we support
- Ongoing support, upgrades and continuous testing of the platforms that hold these records are available as a retainer.
- We can run a readiness review of the evidence trail before your auditor visits, and report gaps for your team to close.
- Your auditor or certification body makes the assessment. We help answer their questions about how the systems and evidence were prepared.
