PS-8—Personnel Sanctions

Employ a formal sanctions process for individuals failing to comply with established information security and privacy policies and procedures; and

Notify ⚙organization-defined personnel or roles within ⚙organization-defined time period when a formal employee sanctions process is initiated, identifying the individual sanctioned and the reason for the sanction.