The ISC2 Code of Ethics and professional conduct

Every CISSP, and every Associate of ISC2, must agree to follow the ISC2 Code of Ethics. This is not a formality. Ethics is tested on the exam, it is part of the endorsement process, and breaches can lead to the loss of the credential. More importantly, security professionals are trusted with access, information and authority that could do serious harm if misused. An administrator can read anyone's email; a penetration tester is invited to break in; an investigator handles evidence that can end careers. The Code of Ethics sets out the standards that justify that trust. This lesson explains the structure of the Code, how to apply its canons when they conflict, how complaints and sanctions work, how the Code relates to law and to other ethical guidance, and how to reason through ethical scenarios of the kind the exam presents.

The structure of the Code

The ISC2 Code of Ethics is short. It consists of a preamble and four canons. The preamble explains why the Code exists. ISC2 states it this way: 'The safety and welfare of society and the common good, duty to our principals, and to each other, requires that we adhere, and be seen to adhere, to the highest ethical standards of behavior. Therefore, strict adherence to this Code is a condition of certification.' Two phrases deserve attention. 'Be seen to adhere' means appearances matter: conduct that looks improper damages trust even if no harm was intended. 'A condition of certification' means the Code is enforceable, not merely aspirational.

The four canons, as published by ISC2 (quoted in its own US spelling), are:

• Protect society, the common good, necessary public trust and confidence, and the infrastructure.
• Act honorably, honestly, justly, responsibly, and legally.
• Provide diligent and competent service to principals.
• Advance and protect the profession.

What each canon means in practice

The first canon puts society first. Security professionals protect not only their employer but also the public, the people whose data is stored and the critical infrastructure on which everyone depends. Promoting generally accepted good practice, discouraging unsafe practice and supporting public trust in information systems all fall under this canon. So does refusing to build or conceal systems designed to harm the public.

The second canon is about personal integrity. It asks you to tell the truth, keep your commitments, give fair advice, take responsibility for your actions and obey the law. It also covers honesty about your own qualifications and experience: inflating your experience on an endorsement application or claiming credentials you do not hold breaches this canon. Avoiding conflicts of interest, or disclosing them when they cannot be avoided, is part of acting justly and responsibly.

The third canon concerns your principals: employers, clients and anyone else you serve professionally. You owe them diligent and competent service, which means doing the work properly, within your competence, and protecting their confidential information. It also means giving honest advice even when it is unwelcome, and not taking on work you are not qualified to do without saying so.

The fourth canon looks to the profession as a whole. It asks you to support the development of the profession, help others learn, avoid bringing the profession into disrepute and not associate professionally with people whose conduct would damage it. Sharing knowledge through mentoring, volunteering or writing is a positive way to honour this canon. Discussing real exam questions, or helping someone cheat, harms the profession and breaches it.

When canons conflict

Real situations sometimes pit one canon against another. An employer may want you to keep quiet about a flaw that endangers customers. A client may want you to cut corners on testing. The canons are listed in order of precedence: when they genuinely conflict, the earlier canon generally takes priority over the later one. Society comes before personal conduct, which comes before principals, which come before the profession.

In practice, most apparent conflicts can be resolved without abandoning any canon. You can raise concerns through proper channels, document your advice, escalate within the organization, seek legal or ethics advice and, if necessary, decline to continue. The order of precedence matters most when these routes are exhausted. Even then, ethical action rarely means dramatic public disclosure as a first step; it usually means following lawful, proportionate processes, such as reporting to a regulator when the law provides for it.

Complaints, investigations and sanctions

ISC2 enforces the Code through an ethics complaint process overseen by its Ethics Committee and board of directors. A complaint must be made in writing, supported by evidence, and the complainant must show standing: generally, anyone can complain about breaches of the first two canons, only principals can complain about breaches of the third canon, and only other credential holders can complain about breaches of the fourth canon. The process is designed to stop the Code being used for personal disputes or trivial grievances.

When a complaint is accepted, the member is notified and given an opportunity to respond. The Ethics Committee reviews the evidence and recommends a decision to the board. Possible outcomes include dismissal of the complaint, a reprimand, suspension or revocation of the credential. Members who are convicted of serious crimes or found to have misrepresented their experience can also lose their credentials. The fact that ISC2 has revoked credentials in the past is one reason employers take the Code seriously.

Ethics and the law

Ethics and law overlap but are not the same. Some actions are legal but unethical, such as exploiting a loophole to collect personal information that customers would not expect you to collect. Some actions might be ethical but illegal in a particular place, such as testing a system for vulnerabilities without permission in the belief that you are helping. The Code requires you to act legally, so unauthorized testing breaches the Code even if your intentions are good. A CISSP should always get written authorization, with a defined scope, before testing anyone's systems.

In Canada, the main criminal offences relating to computers are in the Criminal Code: unauthorized use of a computer (section 342.1) and mischief in relation to computer data (subsection 430(1.1)). Privacy obligations arise under the Personal Information Protection and Electronic Documents Act (PIPEDA) for private-sector organizations in most provinces, under substantially similar provincial laws in Quebec, Alberta and British Columbia, and under the federal Privacy Act and provincial public-sector laws for government bodies. Quebec's Law 25 has added strong duties around privacy impact assessments and breach reporting. Ethical practice means knowing which of these apply to your work and respecting them.

Ethical obligations also often exceed legal ones. The law may not require you to tell a client about a risk outside the scope of your engagement, but competent service and honesty suggest you should at least mention it. The law may allow you to monitor employees' internet use, but fairness suggests you should tell them, through a clear acceptable use policy, that monitoring takes place.

Other sources of ethical guidance

The CISSP common body of knowledge also refers to other ethical guidance that you may see mentioned in study materials. The Internet Architecture Board's RFC 1087, 'Ethics and the Internet' (1989), described as unethical any activity that seeks unauthorized access, disrupts the intended use of the internet, wastes resources, destroys the integrity of information or compromises users' privacy. The Computer Ethics Institute published the 'Ten Commandments of Computer Ethics', which include not using a computer to harm others, not snooping in other people's files and thinking about the social consequences of the programs you write. Many organizations also have their own codes of conduct, which employees are expected to follow alongside professional codes.

Organizations should support ethical behaviour through policy and culture: a code of conduct, an acceptable use policy, training, a safe way to raise concerns, and leaders who model the behaviour they expect. Security professionals often help write and enforce these policies, which gives them a particular responsibility to follow them.

Reasoning through ethics questions

Exam questions on ethics usually present a dilemma and ask what you should do, or which canon applies. A useful approach is to work through a few steps. First, identify the people affected and what is at stake for each. Second, identify which canons are engaged. Third, check for legal requirements. Fourth, consider the options from least to most drastic, starting with proper channels. Fifth, choose the option that best satisfies the higher-priority canons while respecting the others.

Ethics also applies to everyday decisions that seem small. Using a company tool for a personal side project, accepting an expensive gift from a vendor during a procurement, browsing a colleague's files out of curiosity while troubleshooting or quietly overstating your involvement in a project can all raise ethical questions. The canons give a way to think them through: who could be harmed, whether you are being honest and fair, what your principals would reasonably expect and how the conduct would reflect on the profession if it became known.

Finally, ethics is not only about avoiding wrongdoing. The Code also encourages positive action: mentoring newcomers, sharing knowledge with the community, speaking up when a practice is unsafe and helping the public understand how to protect itself.