The organization employs a formal sanctions process for individuals failing to comply with established information security policies and procedures.
No STIG checks reference this CCI.