HR-04 Disciplinary Measures
Changed since C5:2020
Basic criterion
Added requirement that policies and instructions concerning disciplinary measures need toreflect applicable legal and regulatory requirements.
Bullet points are now sorted to ease discussions about specific list items.
Wording in C5:2020
Basic criterion
In the event of violations of policies and instructions or applicable legal and regulatory requirements, actions are taken in accordance with a defined policy that includes the following aspects:
- Verifying whether a violation has occurred; and
- Consideration of the nature and severity of the violation and its impact.
The internal and external employees of the Cloud Service Provider are informed about possible disciplinary measures.
The use of disciplinary measures is appropriately documented.
Basic criterion
The cloud service provider ensures that the policies and procedures concerning disciplinary measures reflect applicable legal and regulatory requirements in accordance with SP-01.
In the event of violations of policies and procedures or applicable legal and regulatory requirements, actions are taken in accordance with a defined policy that includes the following aspects:
- Verifying whether a violation has occurred; and
- Consideration of the nature and severity of the violation and its impact.
The internal and external personnel of the cloud service provider is informed about possible disciplinary measures.
The use of disciplinary measures is appropriately documented.
Supplementary information
With regards to the use of disciplinary measures, the submission of anonymised evidence is acceptable and does not imply that the basic criterion is not fully fulfilled.
Related criteria
BSI text from C5:2026 and its changelog: © Federal Office for Information Security 2026, reproduced unchanged under CC BY-ND 4.0. Unofficial site, not affiliated with BSI. Licence and sources