ISC2 Code of Ethics, Due Care, and Due Diligence for the CC Exam

Security professionals are held to a code of conduct because their work depends on privileged, hard-to-verify access that would be easy to abuse. To do the job at all, you are handed access that ordinary employees never get: administrator credentials, unfiltered views of network traffic, personal data about employees and customers, knowledge of unpatched vulnerabilities, and details of how the organization's defenses work. Every one of those privileges could be abused, and most abuse would be invisible to the people it harms.

That is the core problem a professional code of conduct solves. Employers, customers, and the public cannot personally verify that each security practitioner is trustworthy, so the profession publishes a shared standard of behavior and holds every certified member to it. The code turns trust from a personal gamble into an institutional guarantee: if someone holds the certification, they have formally committed to a known set of ethical rules and can lose the credential for breaking them.

A code of conduct also protects you as a practitioner. When a manager pressures you to hide a breach, snoop on a colleague, or overstate a product's security, the code gives you an external standard to point to. The answer is not merely that you personally feel uncomfortable; it is that the action would violate the ethical obligations of your profession.

It helps to be clear about what a professional code is not:

• It does not replace the law. Laws still apply in full. A code sets standards of conduct that can go beyond what the law requires: something can be perfectly legal and still dishonest or irresponsible.
• It is not the employer's basis for dismissal. An employer disciplines or dismisses staff under its own policies and employment contracts, not under a professional body's code.
• It does not set technical control minimums. Required configurations and control levels come from standards and baselines, not from a code of ethics.

For ISC2 certification holders the professional standard is the ISC2 Code of Ethics. Agreeing to it is a condition of certification, which means it applies to you from the moment you earn the CC credential, not only once you reach a senior role.

An organizational code of conduct is the set of behavior rules an employer issues to its own staff, and it applies alongside, not instead of, the ISC2 Code of Ethics. The most common example in security is the acceptable use policy (AUP): a document new employees typically read and sign that states how company computers, email, internet and network access may and may not be used. Employer codes of conduct, AUPs and similar policies are written by the organization, apply to everyone it employs whether certified or not, and are enforced by the organization through its own HR and disciplinary process.

The ISC2 Code works differently. It is written and enforced by ISC2, and it binds only the people who commit to it by certifying, from CC through CISSP, in any sector and any role. A practitioner who holds no ISC2 credential is not bound by the ISC2 Code at all; their conduct at work is governed by their employer's codes and policies, and by the law. A certified professional answers to both: break the employer's AUP and the employer disciplines you; breach the ISC2 Code and ISC2 can act on your certification.

An AUP is defined by its subject: acceptable use of the organization's systems and data by its people. Other agreements staff may sign have different jobs. A non-disclosure agreement protects specific confidential information, and a service level agreement records service commitments between a provider and its customer; both are contracts about obligations, not a rulebook for day-to-day behaviour on company systems.

Due care is the practice of taking the reasonable precautions that a sensible, careful person would take in the same situation. It is often summarized by the prudent person rule: ask what a prudent professional with the same responsibilities would do, and then do that. Due care is about action. It is the doing of the right thing at the right time.

In a security context, due care looks like concrete, visible steps: applying security patches on a sensible schedule, enabling multifactor authentication for privileged accounts, enforcing password and encryption standards, backing up critical data, training staff on phishing, and responding promptly when an incident is detected. None of these actions require heroics. They are simply what a reasonable organization is expected to do to protect the assets in its charge.

Due care matters legally as well as ethically. The opposite of due care is negligence: falling below the prudent person standard by failing to take precautions that any reasonable professional would recognize as necessary. An organization that knew about a critical vulnerability for months and left it open with no compensating control, or a professional who ignored an obvious warning sign, has failed the prudent person test. Knowing about a risk does not count in your favour if you do nothing about it; it makes the failure to act harder to excuse.

If an organization is accused of negligence after a breach, its defence is evidence that it exercised both halves of the pair: records showing it assessed its risks (due diligence) and proof that the controls those assessments called for were actually put in place and checked (due care). The test for any piece of evidence is whether it shows that the identified risks were actually reduced. Documents that show only awareness, intention or spending (a plan never carried out, a budget line, a policy nobody enforced) do not show that reasonable precautions were in place when the incident happened. Records and audit logs are valuable as evidence that care was taken, but keeping records is not itself the protective action.

Anchor due care to two triggers: the word care maps to action, and the phrase prudent person signals due care. When a scenario describes someone actually implementing safeguards or correcting a known problem, that is due care.

Due diligence is the ongoing work of investigation, research, and verification that tells you what reasonable care actually requires and whether the care you are taking is working. Before you can take the right precautions, you have to find out what the risks are, what the standards say, and whether your current measures are effective. That fact-finding and checking activity is due diligence. It is about knowledge. Due care is then the action you take based on that knowledge.

Examples of due diligence include performing risk assessments, researching threats that target your industry, evaluating a vendor's certifications, breach history and audit reports before signing a contract, reviewing access logs, commissioning independent audits, and verifying that policies are actually being followed. Notice that due diligence is continuous, not a one-time checkbox: threats change, so the research that informs your precautions must keep running. Periodic reviews and audits of controls that are already in place are due diligence, because they verify rather than add protection.

The two concepts form a cycle. Due diligence identifies what needs to be done; due care does it; further due diligence confirms the action worked and looks for the next gap. One without the other fails. An organization that commissions a thorough assessment, approves its recommendations and then never deploys them has shown due diligence but not due care. Precautions taken without investigation may be aimed at the wrong risks, and research that never leads to action protects nobody.

Keep these two terms apart from the risk-treatment vocabulary that often sits beside them. Risk transference shifts financial impact to someone else, such as an insurer; risk avoidance stops the risky activity altogether; risk acceptance is a deliberate, documented decision to live with a risk; and residual risk is what remains after controls are applied. None of these describes the prudent action (care) or the investigation (diligence), and an unpatched known flaw left through inaction is negligence, not a considered acceptance decision. Risk treatment itself is taught in the risk management lesson for Task 1.2.

Classification rule of thumb: if the scenario describes researching, assessing, evaluating, or verifying, it is due diligence. If it describes implementing, fixing, or taking precautions, it is due care.

The ISC2 Code of Ethics consists of a preamble and four canons. It is short by design: there is no long rulebook of specific dos and don'ts; instead, the Code states broad principles that certified professionals are expected to apply with judgment to whatever situation they face.

The preamble establishes two ideas. First, the safety and welfare of society and the common good, duty to our principals, and duty to each other require that ISC2 members adhere, and be seen to adhere, to the highest ethical standards of behavior. Second, strict adherence to the Code is a condition of certification. Ethics is not a recommendation members may adapt, nor a duty an employer can waive by contract; it is part of what the credential certifies, for as long as you hold it.

The phrase be seen to adhere matters: the profession's credibility depends on visibly ethical conduct, not just private good intentions. It applies directly to gifts and hospitality. Suppose a supplier whose contract renewal you will help assess offers you free tickets to a high-profile industry conference, travel included. Even if you are confident your judgement would stay independent, colleagues, competitors and the public cannot see inside your head; what they can see is a decision-maker taking something of value from an interested party. That appearance alone damages trust in you and in the profession. The same gift also touches canon three, because ISC2 guidance has long tied conflicts of interest, and their appearance, to the duty to serve principals faithfully. The ethical course is to decline, or disclose the offer and step back from the decision under your employer's rules.

Who must follow the Code? Everyone who commits to it by certifying: every holder of an ISC2 certification, from the entry-level CC to the CISSP, in any sector and any job role. It does not bind practitioners who hold no ISC2 credential; they answer to their employer's codes and to the law. You commit to the Code when you certify, and the commitment covers your professional conduct from that point on, regardless of title or seniority.

Two terms deserve definition before you read the canons. Principals are the people you serve and answer to in a professional capacity, such as your employer or your clients. The profession means the community of security practitioners as a whole, whose collective reputation every member either strengthens or damages.

The heart of the Code is four canons, each owed to a different party. Learn them, and learn them in order:

1. Protect society, the common good, necessary public trust and confidence, and the infrastructure. Owed to society.
2. Act honorably, honestly, justly, responsibly, and legally. Your own integrity, owed to everyone you deal with.
3. Provide diligent and competent service to principals. Owed to employers and clients.
4. Advance and protect the profession. Owed to the security profession and fellow practitioners.

Why the order matters: ISC2 has long taught that the canons are applied in order of precedence, so that when they conflict the higher-listed canon prevails. Earlier versions of the Code stated this outright; the current Code published on isc2.org lists the canons in this order without restating the rule, and the precedence remains how ISC2 guidance and training resolve conflicts. Either way, the priority chain is society first, integrity second, principals third, profession fourth.

Your first obligation is to society at large: the public, the shared trust that makes digital life possible, and the critical infrastructure everyone depends on. Your second is personal integrity in everything you do, including public statements: making public statements you know to be untrue, whether about your own qualifications or about another person or organization, is dishonest conduct under canon two. Only third comes your duty to your principals: they deserve diligent and competent service, but never at the expense of society or your integrity. Fourth is your duty to the profession: mentoring newcomers, contributing to professional bodies and guidance, and refusing to associate the credential with wrongdoing.

Notice the vocabulary inside canon three: diligent and competent service. Diligence here means careful, sustained, well-informed effort on behalf of your principals, and competence means maintaining the skills the work requires; careless or incompetent work for a client is a canon three matter. Also notice that canon two makes legality an ethical floor: an unlawful act is automatically a Code violation, but the canon demands more than mere legality, because it also requires honor, honesty, justice, and responsibility.

When two canons point in different directions, the higher-listed canon prevails, and the way you act on it must itself be responsible. Both halves matter: precedence tells you whose interests win, and canon two tells you how to pursue them.

Work through a scenario. You support the software a regional water utility uses to control its treatment plants, and you find a flaw that could let an outsider change chemical dosing levels. Your account manager, keen to protect a contract renewal, asks you to keep it out of the next status report and raise it informally later. What does the Code require?

Map the pressures to canons. Keeping quiet arguably serves the principal's commercial interest, which sounds like canon three. But leaving a water supply exposed endangers the public and critical infrastructure, which is canon one, and knowingly concealing a serious risk is neither honest nor responsible, which is canon two. Both outrank canon three, so going along with the request is not ethical.

The protective action must also be responsible. That means raising the risk through proper channels (above the person applying the pressure if necessary), documenting what you found and what you reported, and, if the organization still refuses to act, pursuing coordinated disclosure that gives the affected party a chance to fix the flaw before details become public. Two kinds of response fail this second test even when the motive is good:

• Uncontrolled disclosure, such as releasing working attack details before a fix exists, aims at canon one but in practice equips attackers, which is not responsible conduct.
• Disengaging, walking away without ever raising the issue, leaves the public exactly as exposed as before; the duty to society is not discharged by removing yourself.

The same reasoning covers pressure to misrepresent findings. Any report, audit or attestation you produce must be accurate and complete: a report that inflates control strength, or that is technically true but leaves out material weaknesses, misleads the people who rely on it. Honesty (canon two) outranks pleasing the principal (canon three), even when an accurate report is unwelcome or costs business.

The ISC2 Code is enforced through a formal complaint procedure that can end in revocation of the certification. Because strict adherence is a condition of certification, a proven violation can cost you the credential, and with it any role that requires it.

The procedure published on isc2.org works like this:

1. Written, sworn complaint. A complaint must be submitted in writing in the form of a sworn affidavit, identifying the certified person and the canon alleged to have been breached. The committee considers only complaints that specify the canon allegedly violated, so an informal or unsworn allegation is not a complaint under the procedure.
2. Standing. The complainant must have standing for the canon involved (see the table below).
3. Ethics Committee review. The Professional Conduct (Ethics) Committee, a standing committee of ISC2, reviews the complaint and the evidence submitted with it. It is not an investigative body and cannot compel testimony, so the complainant must make a prima facie case; where none is made, the complaint is closed without prejudice to either party. Where there is a case, the committee makes a recommendation.
4. Board decision. The ISC2 Board of Directors decides whether and how to discipline, at its discretion, up to and including revocation of the certification.

Several distinctions follow from this. The sanction is ISC2's decision, made by its Board; it is not handed to the professional's employer to decide, and the Ethics Committee recommends rather than decides. The sanctions concern the person's standing as a certified member, up to revocation of the credential, rather than penalties such as fines. A stranger who sees a certified professional lie publicly can complain under canon two, but only a client or employer can complain that the work done for them was careless or incompetent under canon three. The procedure also has to be used honestly: filing a baseless complaint to harass or damage a colleague would itself be dishonest, unjust conduct under canon two.

Ethical conduct also has a daily, preventive dimension: declining conflicts of interest and their appearance, protecting confidential information even after you change jobs, being truthful about your qualifications, and giving honest assessments even when they are unwelcome. Practicing these habits keeps the Code from ever becoming a disciplinary matter.

The ISC2 Code of Ethics does not mention artificial intelligence, but its canons apply to AI exactly as they apply to any other tool: a certified professional remains accountable for work produced with AI, for decisions an AI system makes about people, and for raising problems with those systems responsibly. ISC2 treats foundational AI security concepts as woven across the CC domains, and ethical use of AI fits naturally under the Code of Ethics.

Responsible use: AI does not move accountability

Work you deliver is your work, however it was drafted. Canon three (diligent and competent service) means AI-generated output is reviewed and verified before anyone relies on it, because generated text and analysis can be confidently wrong. Canon two (act honorably, honestly, justly, responsibly and legally) means being honest with principals about how work was produced when that matters to them, rather than presenting it as something it is not. Treating unverified output as finished, or disguising how it was made, fails both canons.

Bias and fairness: raise it, do not hide it

Harmful bias is when an AI system treats a group of people unfairly, for example flagging, scoring or rejecting one group far more often without a real difference to justify it. When a professional finds evidence of this, the ethical response follows the same responsible-method rule as any other conflict: report the evidence to the people who decide and to the vendor through proper channels, and recommend keeping the system out of decisions about people until the cause is understood and fixed. Changing the tool's behaviour without telling decision makers hides a material finding; going public before responsible channels have had a chance to act is uncontrolled disclosure; and treating a bought-in system as someone else's problem ignores that the organization answers for the decisions it makes with it.

Transparency, explainability and accountability

Automated decisions that affect people should be explainable and interpretable (someone can say how the system works and what a particular result means), transparent (people know an automated system is involved and can get appropriate information about how it works) and accountable (a named human or function owns the outcome and can review or overturn it). These are distinct from other qualities that are also good but answer different questions:

A useful reference is the NIST AI Risk Management Framework (AI RMF 1.0), which lists the characteristics of trustworthy AI: valid and reliable; safe; secure and resilient; accountable and transparent; explainable and interpretable; privacy-enhanced; and fair with harmful bias managed. A system can be highly secure and still fail the fairness or explainability tests; the characteristics must be balanced against one another for the context, and none can be ignored because another is strong.

Ethics questions on the CC exam are mostly scenarios: they describe a situation and ask which concept applies, what you should do, or who acts. A reliable method has three steps.

First, classify the concept being tested. Research, assessment, evaluation, or verification points to due diligence. Taking reasonable precautions or fixing a known problem points to due care, and prudent person is a strong cue; a known risk left unaddressed points to negligence. A broken employer rule such as an AUP is the employer's to enforce. Professional behavior, conflicting loyalties, or misconduct by a certified person points to the ISC2 Code.

Second, when the Code applies, identify which canons are in play and rank them. Is society, public trust, or infrastructure at risk? That is canon one. Is honesty, legality, or responsibility at stake? Canon two outranks duties to employers and clients. Is this about serving an employer or client well? Canon three. Is it about the reputation or advancement of the security field? Canon four. If the issue is about how conduct looks, such as accepting a gift from a vendor you are evaluating, remember the preamble's duty to be seen to adhere.

Third, check the method and the mechanics. Prefer actions that are responsible as well as correctly prioritized: escalate through proper channels, document concerns, follow responsible disclosure, and decline unethical instructions without a rash act of your own. For enforcement, remember the sequence: sworn written complaint by someone with standing, Ethics Committee review, Board decision.