Employ a formal sanctions process for individuals failing to comply with established information security procedures.
No STIG checks reference this CCI.