risk
Missing security terms in contracts and no disciplinary process
Employment and supplier contracts omit security/confidentiality obligations, and there is no disciplinary process for security violations — removing legal recourse and the deterrent effect against repeat offenders.
In catalog since 2026-09-17T22:28:00Z · Last changed 2026-09-17T22:28:00Z (f368a6cce277)
Record JSON · Open in map · Data retrieval guide
Catalog revision: 791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4. A connection does not establish full coverage.
Attributes
- category
- compliance_regulatory
- domain
- Human Resources / Personnel Security
- Governance, Policy & Oversight
- Third-Party / Supply-Chain Risk
- taxonomy
- iso-27005-vulnerability
- inherent_rating
- medium
Details
- risk_id
- hr-missing-security-terms-discipline
- category
- compliance_regulatory
- likelihood
- medium
- impact
- medium
- inherent_rating
- medium
- treatment
- mitigate
- taxonomies
- iso-27005-vulnerability
Source
No record-specific source URL is provided.
Connections
- UC-TPRM-03 — Bind vendors to security and privacy terms by contract mitigates Missing security terms in contracts and no disciplinary process
- strength
- primary
- rationale
- Including required security and confidentiality obligations in supplier agreements directly fixes the missing-security-terms facet in supplier contracts.
- UC-GOV-07 — Hold individuals accountable for control responsibilities mitigates Missing security terms in contracts and no disciplinary process
- strength
- primary
- rationale
- Documented rules of behavior and disciplinary consequences for violations supply the deterrent and disciplinary process the risk lacks.
- UC-HR-05 — Hold third-party personnel to equivalent security terms mitigates Missing security terms in contracts and no disciplinary process
- strength
- primary
- rationale
- Requires equivalent security/confidentiality obligations in supplier contracts, directly closing the omitted-supplier-contract-terms gap.
- UC-HR-02 — Formalize security responsibilities in employment terms mitigates Missing security terms in contracts and no disciplinary process
- strength
- primary
- rationale
- Embeds infosec responsibilities, confidentiality/NDA and access agreements into employment terms, directly closing the missing-security-contract-terms gap.
- UC-HR-04 — Enforce a formal disciplinary process for violations mitigates Missing security terms in contracts and no disciplinary process
- strength
- primary
- rationale
- Supplies the formal, graduated disciplinary process the risk names as absent, restoring deterrence and recourse for security-policy violations.