Information Security Disciplinary Process

Information Security Disciplinary Process

Document Name: Information Security Disciplinary Process
Version: 1.0
Approved by: Directors, Immercial Limited
Review Frequency: Annual or upon material change

Immercial Limited maintains a proportionate disciplinary process for breaches of information-security policies, procedures and controls.

Where a suspected breach occurs, Immercial will:

• establish the facts and circumstances;
• assess the seriousness, intent, impact and any previous relevant conduct;
• preserve relevant evidence where appropriate;
• give the individual an opportunity to explain the circumstances;
• determine proportionate action;
• record material outcomes where appropriate;
• apply corrective or improvement action where the breach indicates a wider control weakness.

Depending on severity, action may include:

• informal guidance or retraining;
• formal warning;
• restriction or removal of system access;
• contractual action;
• termination of employment or engagement;
• referral to relevant authorities where legally or contractually required.

Serious or deliberate breaches involving confidentiality, unauthorised access, misuse of systems, disclosure of credentials, client information, personal data or cryptographic assets may justify immediate restriction of access while the matter is investigated.

Employment-related disciplinary action will be undertaken fairly and in accordance with applicable UK employment law and the employee’s contractual arrangements.

Contractors, suppliers or other authorised persons may instead be subject to access removal, suspension, contractual remedies or termination of engagement.

The Directors are responsible for oversight of the process.