User's not following the rules

[James Farr '05' <jfarr () UTICA EDU>]

We are currently evaluating what to do when a user does not follow the
Information Security Policies adopted by the institution.


Currently our policies are handled on a case by case basis.  There are no
set forth policies that clearly state if you provide your password to
another user x,y,z, will happen.



Does anyone have a guideline they can share on what happens when a user does
not follow the established rules.

Do you test users on their understanding of the security policies?

If so are penalties more sever if the user demonstrated knowledge in the
area?

Do sanction change based on the number of times they do not follow the
policy?



Thank you for your time

James Farr

Utica College

Information Security Officer