Employ a formal sanctions process for individuals failing to comply with established information security policies.
No STIG checks reference this CCI.