NIST SP 800-66 Rev 2
Administrative

NIST SP 800-66 Rev 2 164.308(a)(1)(ii)(C): Sanction Policy (Required)

Apply appropriate sanctions against workforce members who fail to comply with security policies. NIST recommends graduated sanctions, HR coordination, and documentation of each sanction action.

Maintained by Gerard BlokdykVerified against the published standard Control text last updated

What else in your programme already covers this

This control maps to 25 controls across 16 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

SOC 2 · 3 controls

  • SOC2-CC1.1 CC1.1 Commitment to integrity and ethical values (COSO principle 1)
  • SOC2-CC1.5 CC1.5 Accountability for internal control responsibilities (COSO principle 5)
  • SOC2-CC5.1 CC5.1 Selecting control activities that mitigate risk (COSO principle 10)

Australia My Health Records Act 2012 · 2 controls

C5 (Germany) · 2 controls

  • C5-AM-05 Commitment to Permissible Use, Safe Handling and Return of Assets
  • C5-HR-04 Disciplinary measures

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 · 2 controls

ISO 27001:2022 · 2 controls

  • 5.4 Management responsibilities
  • 6.4 Disciplinary process

ISO 27002:2022 · 2 controls

  • 5.4 Management responsibilities
  • 6.4 Disciplinary process

NIST Cybersecurity Framework 2.0 · 2 controls

  • NIST-CSF-GV.PO-02 Policy for managing cybersecurity risks is reviewed, updated, communicated, and enforced to reflect changes in requirements, threats, technology, and organizational mission
  • NIST-CSF-GV.RR-04 Cybersecurity is included in human resources practices

NIST SP 800-161 Rev 1 · 2 controls

APPI · 1 control

APRA CPS 230 Operational Risk Management · 1 control

  • CPS230-P12 Key Principles for Operational Risk, Resilience and Service Providers

ASD Strategies to Mitigate Cyber Security Incidents · 1 control

  • ASD37-37 Personnel management (Very Good)

FedRAMP High · 1 control

  • PS-8 Personnel Sanctions

FedRAMP Moderate · 1 control

  • PS-8 Personnel Sanctions

ISO 27701:2019 · 1 control

NIST SP 800-172 · 1 control

NIST SP 800-53 Rev 5 · 1 control

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Other controls in Administrative

Query this from an agent

The graph holds this control, the 25 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll NIST SP 800-66 Rev 2 controls