Some organizations create a specific consequence model for information security policy.
Violations can replace and absorb the broader HR polices that deal with disciplining individuals. A consequence model is intended to be punitive for the individual.

a. True
b. False

a. True

Explanation:

As some organization create a specific set of consequences model for their information security policy and is due to the violation that takes place and can be replaced and resolved and being absorbed with a broader aspects of the HR policies.these tend to deal with the disciplinary actions and the individuals and a consequence of this model is intended to treat the person that has broken a set of rules and thus action needs to be taken against.