Professional ethics and the ISC2 Code of Ethics

Ethics sits formally inside Domain 1, but it reaches across the whole exam. Every CISSP candidate agrees to follow the ISC2 Code of Ethics, and the exam tests whether candidates can apply it to real dilemmas: a manager who asks for evidence to be overlooked, a friend who wants help passing an exam, a client who wants a vulnerability kept quiet, a vendor who offers a gift. Ethics items are often short and feel easy, which makes them dangerous. The intuitive answer is not always the one the Code supports.

This lesson explains the structure of the Code, how its parts rank against each other when duties conflict, how organizational ethics and law relate to it, and how to approach ethics items. It finishes with practice items that combine ethics with legal and investigation topics from Domain 1, because the exam often puts them together.

The structure of the Code

The ISC2 Code of Ethics is short. It has a preamble and four canons. The preamble says, in substance, that the safety and welfare of society and the common good, duty to principals and duty to each other require that members adhere, and be seen to adhere, to the highest ethical standards of behaviour. It adds that strict adherence to the Code is a condition of certification. The four canons then set out the duties in a fixed order. In paraphrase, members should:

• Protect society, the common good, the necessary public trust and confidence, and the infrastructure.
• Act honourably, honestly, justly, responsibly and legally.
• Provide diligent and competent service to principals, meaning employers, clients and others who rely on their work.
• Advance and protect the profession.

Read the full text on the ISC2 website before your exam; it fits on one page and is worth knowing closely. The order matters. When duties conflict, the earlier canon generally takes precedence over the later ones. Duty to society comes before duty to an employer or client, and duty to an employer comes before duty to the profession. Many ethics items are built around exactly this ranking.

Applying the ranking

Suppose a client asks a consultant to keep quiet about a serious safety flaw in a medical device so that a product launch is not delayed. Duty to the client is canon three; protecting society and the public is canon one. Canon one prevails, so the consultant should not simply stay silent. In practice, the consultant would raise the issue with the client first, through the agreed channels, and escalate appropriately if the client refuses to act on a genuine risk to the public. The answer is rarely 'go straight to the media', which can breach confidentiality and canon two's duty to act responsibly.

The ranking does not mean that the higher canon licenses any action. Every canon applies at once. A professional protecting society must still act legally and honestly, and must still respect legitimate confidentiality. The ranking helps decide which duty wins when they truly conflict; it does not cancel the others.

Complaints and enforcement

ISC2 has a process for complaints about members who may have breached the Code. Published descriptions say that a complaint must be supported by an affidavit and that the complainant must have standing for the canon involved: broadly, anyone may complain under the first two canons, principals under the third, and other professionals under the fourth. A committee investigates, and outcomes can include revocation of certification. Candidates do not need the procedural details, but they should know that the Code is enforced and that members have a duty not to ignore serious breaches.

A related point appears in items about exam integrity. Candidates agree not to disclose exam content. Sharing remembered questions, buying so-called brain dumps or helping someone cheat breaches both the candidate agreement and the Code, and can lead to revocation. The ethical answer in such items is always to refuse and, where appropriate, report.

Organizational ethics and older codes

The ISC2 Code is not the only ethical framework on the exam. Organizations have their own codes of conduct, and the security professional is expected to support them, including through training, reporting channels and protection for people who report concerns in good faith. Where an organization's code is stricter than the law, staff should follow the stricter standard. Where an instruction from management conflicts with the law or the ISC2 Code, the professional should raise the conflict rather than comply silently.

Older study materials also mention the Internet Architecture Board's 1989 statement on ethics and the Internet, published as RFC 1087, which called unethical any activity that seeks unauthorized access, disrupts the intended use of the Internet, wastes resources, destroys the integrity of information or compromises users' privacy. The Computer Ethics Institute's Ten Commandments of Computer Ethics, from the early 1990s, express similar ideas. They appear less often today, but the principles are the same ones the canons protect.

Ethics, law and investigations

Ethics items frequently sit alongside legal topics. The exam expects candidates to recognize the main categories of law and how they affect investigations: criminal law, where the state prosecutes and the standard of proof is beyond reasonable doubt; civil law, where parties sue for remedies and the standard is the balance of probabilities, also called the preponderance of the evidence; administrative or regulatory law, where agencies enforce rules; and contract law, which governs obligations between parties. An investigation's type shapes how evidence must be handled.

A practical rule follows: treat any investigation as if it might end in court, because internal matters sometimes become criminal or civil cases. That means preserving evidence, documenting custody, involving legal counsel early and avoiding actions, such as accessing private accounts without authority, that could make evidence inadmissible or expose the organization to liability.

In Canada, privacy commissioners, both federal and provincial, oversee privacy law, and organizations that suffer a breach of security safeguards involving a real risk of significant harm must report it under PIPEDA or the applicable provincial law, such as Quebec's Law 25. Criminal offences involving computers are found in the Criminal Code, and police services lead criminal investigations. For exam purposes, the principles matter more than the statute names.

How to approach ethics items

Ethics items reward a short routine of their own. First, identify every party the decision affects: the public, the employer or client, colleagues, the profession. Second, ask whether any option breaks the law or requires dishonesty; if so, eliminate it. Third, if duties still conflict, apply the canon order. Fourth, prefer the option that raises the issue through proper channels before escalating outside them, unless there is immediate danger to people.

A scoring exercise for ethics practice

Hannah and Tomás write their own ethics scenarios and score each option against the four canons, giving a large weight to the higher canons and treating any illegal or dishonest option as disqualified. The exercise is not how the exam is scored, but it builds the habit of checking every party and every canon before choosing.

# Score options in an ethics scenario against the canons (study aid, not exam scoring)
weights = {"society": 8, "honest_legal": 4, "principal": 2, "profession": 1}
options = {
    "Stay silent":            {"society": -1, "honest_legal": -1, "principal": 1,  "profession": -1, "illegal": False},
    "Raise internally first": {"society": 1,  "honest_legal": 1,  "principal": 1,  "profession": 1,  "illegal": False},
    "Leak to the press":      {"society": 1,  "honest_legal": -1, "principal": -1, "profession": -1, "illegal": False},
    "Alter the report":       {"society": -1, "honest_legal": -1, "principal": 1,  "profession": -1, "illegal": True},
}
for name, o in options.items():
    if o["illegal"]:
        print(f"{name:<24} disqualified (illegal or dishonest)")
        continue
    score = sum(weights[c] * o[c] for c in weights)
    print(f"{name:<24} score {score:+d}")

Stay silent              score -11
Raise internally first   score +15
Leak to the press        score +1
Alter the report         disqualified (illegal or dishonest)

Raising the issue internally first scores highest because it serves every canon. Leaking to the press scores better than staying silent, because it protects the public, but it loses points for breaching confidentiality and acting irresponsibly before using proper channels. Altering the report is disqualified outright. The weights are invented for practice; the real lesson is the order of the canons and the refusal to cross legal and ethical lines.