Does your organization have a documented process for notifying HR when malicious insider activity is detected?

This question assesses whether formal communication channels exist between security teams and HR when employees or contractors are found engaging in malicious activities. These activities might include data theft, unauthorized system access, sabotage, or other actions that violate security policies and potentially require disciplinary action. Evidence could include a documented incident response procedure that specifically addresses insider threats and includes HR notification steps, communication templates for HR notifications, or records of previous incidents where HR was properly notified (with sensitive details redacted).