"A disciplinary process shall be formalized and communicated to take actions against personnel and other relevant interested parties who have committed an information security policy violation."[1]

Without disciplinary sanctions for information security violations committed by personnel the organization's information security policy will not be effective. The type of disciplinary action will depend on the security policy violation as well as factors such as the user's intentions. Disciplinary actions should be documented in the IT acceptable use policy information security policy and employee handbook.