Disciplinary process

frameworkISO/IEC 27001:2022 sectionA.6 People controls csf 2.0GV.PO-01 GV.RR-04 topicsInsider Threat frameworks5 4 2

Official text · not licensableTitle: Disciplinary process. The control text is ISO's copyright; see ISO/IEC 27001:2022.

Wrong or missing mapping? Report it

Equivalents of A.6.4 in other frameworks
Framework	Requirement	Title	Link	Source / reason
NIST CSF 2.0	DE.CM-03 GV.RR-04	Personnel activity and technology usage are monitored to find potentially adverse events; Cybersecurity is included in human resources practices	Crosswalk	Same topic: Insider Threat 1 loosely related (not mappings) GV.PO-01 Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced Loosely related Only shares CSF GV.PO-01: related, not a mapping
CIS v8.1	CIS 6.1 CIS 6.2	Establish an Access Granting Process; Establish an Access Revoking Process	Loosely related	No mapping. Only shares CSF GV.RR-04: related, not a mapping
SOC 2	CC1.1 CC1.5	Commitment to integrity and ethical values; Accountability for internal control responsibilities	Editorial	ControlMapping editorial: Tone at the top: ISO 27001 requires leadership commitment (5.1) and a disciplinary process that enforces policy (A.6.4); SOC 2 frames the same as commitment to integrity and ethical values.; ControlMapping editorial: Holding people accountable for their security responsibilities: assigned responsibilities (5.3) and a disciplinary process (A.6.4). 1 loosely related (not mappings) CC5.3 Control activities deployed through policies and procedures Loosely related Only shares CSF GV.PO-01: related, not a mapping
PCI DSS	10.2.1 12.7.1	Audit logs enabled and active; Personnel screened before hire	Crosswalk	Same topic: Insider Threat 9 loosely related (not mappings) 7.2.2 Access assigned by job function and least privilege Loosely related Only shares CSF GV.RR-04: related, not a mapping 8.2.5 Access revoked immediately on termination Loosely related Only shares CSF GV.RR-04: related, not a mapping 9.3.1.1 Sensitive-area access authorised and revoked promptly Loosely related Only shares CSF GV.RR-04: related, not a mapping 12.1.1 Information security policy established and published Loosely related Only shares CSF GV.PO-01: related, not a mapping 12.1.2 Security policy reviewed at least annually Loosely related Only shares CSF GV.PO-01: related, not a mapping 12.1.3 Security roles and responsibilities defined Loosely related Only shares CSF GV.PO-01: related, not a mapping 12.1.4 Executive responsibility for information security assigned Loosely related Only shares CSF GV.PO-01: related, not a mapping 12.6.1 Formal security awareness programme Loosely related Only shares CSF GV.PO-01: related, not a mapping …and 1 more in the downloads
CMMC	AT.L2-3.2.3 AU.L2-3.3.2 PS.L2-3.9.1	Insider Threat Awareness; User Accountability…	Editorial	Same topic: Insider Threat (editorial pick)
800-53	AC-2(12)AU-13 PM-12 PS-8	Account Monitoring for Atypical Usage; Monitoring for Information Disclosure…	Crosswalk	Same topic: Insider Threat NIST SP 800-53 → ISO 27001 mapping 23 loosely related (not mappings) PS-1 Policy and Procedures Loosely related Only shares CSF GV.PO-01, GV.RR-04: related, not a mapping AC-1 Policy and Procedures Loosely related Only shares CSF GV.PO-01: related, not a mapping AT-1 Policy and Procedures Loosely related Only shares CSF GV.PO-01: related, not a mapping AU-1 Policy and Procedures Loosely related Only shares CSF GV.PO-01: related, not a mapping CA-1 Policy and Procedures Loosely related Only shares CSF GV.PO-01: related, not a mapping CM-1 Policy and Procedures Loosely related Only shares CSF GV.PO-01: related, not a mapping CP-1 Policy and Procedures Loosely related Only shares CSF GV.PO-01: related, not a mapping IA-1 Policy and Procedures Loosely related Only shares CSF GV.PO-01: related, not a mapping …and 15 more in the downloads
HIPAA	§164.308(a)(3)(ii)(B)§164.308(a)(1)(ii)(C)	Workforce Clearance Procedure; Sanction Policy	Crosswalk	Same topic: Insider Threat 27 loosely related (not mappings) §164.308(a)(3)(ii)(A) Authorization and/or Supervision Loosely related Only shares CSF GV.PO-01, GV.RR-04: related, not a mapping §164.308(a)(3)(ii)(C) Termination Procedures Loosely related Only shares CSF GV.PO-01, GV.RR-04: related, not a mapping §164.308(a)(4)(ii)(B) Access Authorization Loosely related Only shares CSF GV.PO-01, GV.RR-04: related, not a mapping §164.316(b)(2)(ii) Availability Loosely related Only shares CSF GV.PO-01, GV.RR-04: related, not a mapping §164.316(b)(2)(iii) Updates Loosely related Only shares CSF GV.PO-01, GV.RR-04: related, not a mapping §164.308(a)(1) Security Management Process Loosely related Only shares CSF GV.PO-01: related, not a mapping §164.308(a)(3) Workforce Security Loosely related Only shares CSF GV.PO-01: related, not a mapping §164.308(a)(4) Information Access Management Loosely related Only shares CSF GV.PO-01: related, not a mapping …and 19 more in the downloads
GDPR	Art.29 Art.32(4)	Processing under the authority of the controller or processor; Security of processing	Editorial	Same topic: Insider Threat (editorial pick) 1 loosely related (not mappings) Art.24(2) Responsibility of the controller Loosely related Only shares CSF GV.PO-01: related, not a mapping
NIS2	10.2 10.4	Verification of Background; Disciplinary process	Crosswalk	Same topic: Insider Threat 3 loosely related (not mappings) 1.1 Policy on the security of network and information systems Loosely related Only shares CSF GV.PO-01: related, not a mapping 10.1 Human resources security Loosely related Only shares CSF GV.RR-04: related, not a mapping 10.3 Termination or change of employment procedures Loosely related Only shares CSF GV.RR-04: related, not a mapping
Essential Eight	—	No requirement	No mapping in our data	No mapping in our data (Essential Eight links are editorial only).
DORA	Art.10(3)	Detection	Editorial	Same topic: Insider Threat (editorial pick) 3 loosely related (not mappings) Art.5(2)(b) Governance and organisation Loosely related Only shares CSF GV.PO-01: related, not a mapping Art.6(5) ICT risk management framework Loosely related Only shares CSF GV.PO-01: related, not a mapping Art.9(4)(a) Protection and prevention Loosely related Only shares CSF GV.PO-01: related, not a mapping
CPS 234	Para 18 Para 19	Maintain an information security policy framework; Policies direct everyone with security obligations	Loosely related	No mapping. Only shares CSF GV.PO-01: related, not a mapping
Cyber Essentials	—	No requirement	No mapping in our data	No mapping in our data (Cyber Essentials covers five technical controls only).

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.