Review the following information about executive management, IT security policy enforcement monitoring, and human resources, all of which must have a unified front regarding disciplinary treatment of policy violations: •Executive Management: Policy commitment and implementation must come from the chief executive officer (CEO) and the president’s executive order for the entire organization with policy monitoring and disciplinary action taken for policy violations.
•IT Security Policy Enforcement Monitoring: Policy monitoring can be conducted via system logging, content filtering logging, and e-mail filtering logging with automated reporting to IT security personnel for monthly or quarterly policy compliance reviews.
•Human Resources: Employees, contractors, and consultants must conform to all organization-wide policies. Violations of policies are considered to be an employer-employee issue upon which proper disciplinary actions must be taken. Repeat or continued violations of organization-wide policies might be grounds for termination of employment, depending on the violation’s severity. Nonemployees should be provided with limited access and connectivity as per policy definition.