{"catalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","kind":"record","record":{"attributes":{"category":"administrative","domain":"Human Resources / Personnel Security","type":"corrective"},"canonicalUrl":"https://controlsmap.com/?v=1&node=uc%3AUC-HR-04","description":"A formal, communicated disciplinary process is applied to personnel who violate information security policies, providing graduated, consistent sanctions proportional to severity and intent. Violations, sanctions applied, and notifications to defined roles are documented and retained, and outcomes feed back into awareness and control improvements.","details":{"control_category":"administrative","control_type":"corrective","domain":"Human Resources / Personnel Security","guidance":[],"members":[{"control_id":"PS-8","coverage":"full","framework":"nist-800-53","relationship":"superset_of"},{"control_id":"A.6.4","coverage":"full","framework":"iso-27001","relationship":"superset_of"}],"statement":"A formal, communicated disciplinary process is applied to personnel who violate information security policies, providing graduated, consistent sanctions proportional to severity and intent. Violations, sanctions applied, and notifications to defined roles are documented and retained, and outcomes feed back into awareness and control improvements.","title":"Enforce a formal disciplinary process for violations","unified_id":"UC-HR-04"},"id":"uc:UC-HR-04","mapUrl":"https://controlsmap.com/?v=1&node=uc%3AUC-HR-04","sourceIds":["iso-27001","nist-800-53"],"sourceUrl":null,"title":"UC-HR-04 — Enforce a formal disciplinary process for violations","type":"unified"},"relationships":[{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:2f35b186e99e3d1d93077a1fd7c80e76dd3d42cbc0038827587f7071d699e86b","properties":{"rationale":"Consistent, proportional sanctions deter personnel, including potential malicious or negligent insiders, from misusing access or violating policy.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-hr-04-a71cf995.json","sourceId":"uc:UC-HR-04","targetDetailPath":"/data/v1/records/risk-hr-insufficient-screening-bdce1f80.json","targetId":"risk:hr-insufficient-screening","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:4f2a2276a11febbf649ac592a98f96d4e1ae1e06d197656be5e201c6f77cd12c","properties":{"control_id":"A.6.4","coverage":"full","delta":null,"framework":"iso-27001","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2022"},"sourceDetailPath":"/data/v1/records/uc-uc-hr-04-a71cf995.json","sourceId":"uc:UC-HR-04","targetDetailPath":"/data/v1/records/ctrl-iso-27001-a-6-4-33939a57.json","targetId":"ctrl:iso-27001:A.6.4","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:5e0afeab6362df9c737d6bef36b76b9da66c04e21815e825f630d26c035373a3","properties":{"control_id":"PS-8","coverage":"full","delta":null,"framework":"nist-800-53","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"Rev. 5"},"sourceDetailPath":"/data/v1/records/uc-uc-hr-04-a71cf995.json","sourceId":"uc:UC-HR-04","targetDetailPath":"/data/v1/records/ctrl-nist-800-53-ps-8-d821aed5.json","targetId":"ctrl:nist-800-53:PS-8","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:7f72a220fa0637feb3665f43040ddc32906179a20c3444d75758ec9e4a11748a","properties":{},"sourceDetailPath":"/data/v1/records/wf-c7-acbef2ee.json","sourceId":"wf:C7","targetDetailPath":"/data/v1/records/uc-uc-hr-04-a71cf995.json","targetId":"uc:UC-HR-04","type":"oversees"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:90225dbd1a1f346169202ca63ecea367326d62c4e1a905b1d501ab959d3b0a9f","properties":{},"sourceDetailPath":"/data/v1/records/wf-d06-c9616fb8.json","sourceId":"wf:D06","targetDetailPath":"/data/v1/records/uc-uc-hr-04-a71cf995.json","targetId":"uc:UC-HR-04","type":"tests"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:acabc74a32952d1b5c24634210a06e7d69456a7db677a9f45b168fab31f1cae6","properties":{},"sourceDetailPath":"/data/v1/records/wf-c9-75fb1752.json","sourceId":"wf:C9","targetDetailPath":"/data/v1/records/uc-uc-hr-04-a71cf995.json","targetId":"uc:UC-HR-04","type":"tests"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:e3b0736dbbee585a3efb5354435c34dbb8d89994a4fdfa7ee62bb70b1bfacb9d","properties":{},"sourceDetailPath":"/data/v1/records/wf-g25-fdd65bfd.json","sourceId":"wf:G25","targetDetailPath":"/data/v1/records/uc-uc-hr-04-a71cf995.json","targetId":"uc:UC-HR-04","type":"operates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:efe2a5558fa200feaff47313de936c522ad0ca07a476ea9ce5856855e5b1db2d","properties":{"rationale":"Supplies the formal, graduated disciplinary process the risk names as absent, restoring deterrence and recourse for security-policy violations.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-hr-04-a71cf995.json","sourceId":"uc:UC-HR-04","targetDetailPath":"/data/v1/records/risk-hr-missing-security-terms-discipline-0a47163d.json","targetId":"risk:hr-missing-security-terms-discipline","type":"mitigates"}],"schemaVersion":1}