The program shall contain a policy that employees are clearly told about on joining and again while they work there. In it the employer shall declare its commitment to a safe workplace, and it should lay down conduct rules forbidding all violence, threats and conduct reasonably taken as meaning to hurt someone, whether at the premises or elsewhere while working. The policy should: define prohibited behavior in line with the clause 4 definition; control or forbid weapons at the premises, on property the organization controls and while working, to the extent the law permits; require prompt reporting of any behavior or circumstance raising concern for safety or any possible breach; offer several reporting routes, including HR, security, anonymous reporting and members of the Threat Management Team; promise that reports will be handled with the utmost discretion, investigated promptly and notified to the right parties; commit to no retaliation against good-faith reporters; require employees to tell security or other designated staff about any protective or restraining order sought, applied for or granted for their protection; set discipline up to dismissal for breaches, including false or misleading reports; and avoid the phrase zero tolerance, which discourages reporting and lowers safety. Supporting policies should reinforce it and help incident management, such as anti-harassment and discrimination, substance abuse, business conduct or ethics, electronic communications and computer use, and an inspection policy giving the employer the right to access workplace computers, desks, lockers and other items and premises when an investigation needs it.
This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.