164.308(a)(1)(ii)(C) Sanction Policy (Required)
Administrative safeguard · Required
The requirement as we hold it
Sanction Policy (Required). Apply appropriate sanctions against workforce members who fail to comply with security policies. NIST recommends graduated sanctions, HR coordination, and documentation of each sanction action.
The examiner asks
- Show me the sanction policy and a record of it being applied to a workforce member who did not follow it.
- How is the sanction tied to the HR process?
Evidence to bring
- the sanction policy
- an applied-sanction record
Source: 164.308(a)(1)(ii)(C) at eCFR. Our statement of the clause, not the instrument verbatim.