{"catalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","kind":"record","record":{"attributes":{"category":"compliance_regulatory","domain":["Human Resources / Personnel Security","Governance, Policy & Oversight","Third-Party / Supply-Chain Risk"],"inherent_rating":"medium","taxonomy":["iso-27005-vulnerability"]},"canonicalUrl":"https://controlsmap.com/?v=1&node=risk%3Ahr-missing-security-terms-discipline","description":"Employment and supplier contracts omit security/confidentiality obligations, and there is no disciplinary process for security violations — removing legal recourse and the deterrent effect against repeat offenders.","details":{"category":"compliance_regulatory","impact":"medium","inherent_rating":"medium","likelihood":"medium","risk_id":"hr-missing-security-terms-discipline","taxonomies":["iso-27005-vulnerability"],"treatment":"mitigate"},"id":"risk:hr-missing-security-terms-discipline","mapUrl":"https://controlsmap.com/?v=1&node=risk%3Ahr-missing-security-terms-discipline","sourceIds":["ccpa","coso-ic","gdpr","hipaa","iso-27001","nist-800-53","nist-csf-2","soc2"],"sourceUrl":null,"title":"Missing security terms in contracts and no disciplinary process","type":"risk"},"relationships":[{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:6fd598b196e61c1753b0491a313d783c4e6647f9346bee365fd94eca69bf0ba5","properties":{"rationale":"Including required security and confidentiality obligations in supplier agreements directly fixes the missing-security-terms facet in supplier contracts.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-tprm-03-c9edcf93.json","sourceId":"uc:UC-TPRM-03","targetDetailPath":"/data/v1/records/risk-hr-missing-security-terms-discipline-0a47163d.json","targetId":"risk:hr-missing-security-terms-discipline","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:7d9b46f4ba37a47597f9c40d452679ab297a9578396b2d0fbd5ed75390fc7366","properties":{"rationale":"Documented rules of behavior and disciplinary consequences for violations supply the deterrent and disciplinary process the risk lacks.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-gov-07-2a8998f7.json","sourceId":"uc:UC-GOV-07","targetDetailPath":"/data/v1/records/risk-hr-missing-security-terms-discipline-0a47163d.json","targetId":"risk:hr-missing-security-terms-discipline","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:917c47e526cb5662e593df9df444dad343279359310bfda427da1993e5cc6a36","properties":{"rationale":"Requires equivalent security/confidentiality obligations in supplier contracts, directly closing the omitted-supplier-contract-terms gap.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-hr-05-4049a32e.json","sourceId":"uc:UC-HR-05","targetDetailPath":"/data/v1/records/risk-hr-missing-security-terms-discipline-0a47163d.json","targetId":"risk:hr-missing-security-terms-discipline","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:eb6ffdc2557ad76361ef72397aedaed3b295cdf5a147e754afbe01d963ee4abd","properties":{"rationale":"Embeds infosec responsibilities, confidentiality/NDA and access agreements into employment terms, directly closing the missing-security-contract-terms gap.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-hr-02-a54c8912.json","sourceId":"uc:UC-HR-02","targetDetailPath":"/data/v1/records/risk-hr-missing-security-terms-discipline-0a47163d.json","targetId":"risk:hr-missing-security-terms-discipline","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:efe2a5558fa200feaff47313de936c522ad0ca07a476ea9ce5856855e5b1db2d","properties":{"rationale":"Supplies the formal, graduated disciplinary process the risk names as absent, restoring deterrence and recourse for security-policy violations.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-hr-04-a71cf995.json","sourceId":"uc:UC-HR-04","targetDetailPath":"/data/v1/records/risk-hr-missing-security-terms-discipline-0a47163d.json","targetId":"risk:hr-missing-security-terms-discipline","type":"mitigates"}],"schemaVersion":1}