# HR-04 Disciplinary Measures

- Domain: HR – Personnel
- Since C5:2020: changed
- Web page: https://c5.patrickscheid.de/en/hr-04/

## Basic criterion

### HR-04.01B

The cloud service provider ensures that the policies and procedures concerning disciplinary measures reflect applicable legal and regulatory requirements in accordance with SP-01.

### HR-04.02B

In the event of violations of policies and procedures or applicable legal and regulatory requirements, actions are taken in accordance with a defined policy that includes the following aspects:

1. Verifying whether a violation has occurred; and
2. Consideration of the nature and severity of the violation and its impact.

### HR-04.03B

The internal and external personnel of the cloud service provider is informed about possible disciplinary measures.

### HR-04.04B

The use of disciplinary measures is appropriately documented.

**Supplementary information:**

With regards to the use of disciplinary measures, the submission of anonymised evidence is acceptable and does not imply that the basic criterion is not fully fulfilled.

## Changes since C5:2020

From BSI's C5:2026 changelog.

**Basic criterion:**

Added requirement that  policies and instructions concerning disciplinary measures need toreflect applicable legal and regulatory requirements.

Bullet points are now sorted to ease discussions about specific list items.

---

Source: BSI C5:2026, machine-readable edition v1.0.1, © Federal Office for Information Security (BSI) 2026, reproduced unchanged under CC BY-ND 4.0 (https://creativecommons.org/licenses/by-nd/4.0/). Change notes: BSI C5:2026 Changelog, © BSI 2026, CC BY-ND 4.0. Unofficial presentation, not affiliated with BSI.