Security Principles · Topic 4 of 4
Professional and Ethical Conduct
The ISC2 Code of Ethics canons, professional codes of conduct, due care and due diligence, and ethical questions raised by AI, for the ISC2 CC exam.
- 3 min
- Four canons in order: society, honour and law, principals, profession.
- The higher canon wins when they conflict.
- Due diligence is investigating; due care is acting responsibly.
What it is
Security professionals are trusted with access and knowledge that could cause harm. Codes of conduct and ethics set the standard of behaviour. Every ISC2 member, including CC holders, agrees to the ISC2 Code of Ethics.
How it works
The ISC2 Code of Ethics
The code has a preamble and four canons, in order of priority:
- Protect society, the common good, necessary public trust and confidence, and the infrastructure.
- Act honorably, honestly, justly, responsibly, and legally.
- Provide diligent and competent service to principals.
- Advance and protect the profession.
When duties conflict, the higher canon comes first. For example, protecting the public outranks pleasing an employer.
In ethics questions, choose the option that is honest, legal and transparent, and that protects people. Hiding problems or bending rules is never the right answer.
Organizational codes of conduct
Most organizations have their own code of conduct covering honesty, conflicts of interest, acceptable use and confidentiality. Members of ISC2 follow both the ISC2 code and their employer's code.
Due care and due diligence
| Term | Meaning | Example |
|---|---|---|
| Due diligence | Researching and understanding risks before acting | Reviewing a cloud provider's audit reports before signing |
| Due care | Acting responsibly and doing what a reasonable person would do | Patching systems, enforcing policies, training staff |
Put simply: due diligence is investigating; due care is acting on what you know.
Ethics and AI
AI raises new ethical questions that the code still answers:
- Bias: an AI hiring tool that ranks equally qualified people lower because of the group they belong to is unfair.
- Transparency and honesty: do not present AI output as verified fact without checking it.
- Privacy: use personal data only for the purpose people agreed to.
- Accountability: a person, not the AI, remains responsible for decisions.
Conflicts of interest
If you have a personal interest that could affect your judgment, such as a relative working for a bidding vendor, disclose it and step back from the decision.
How the exam asks about this
- "Which canon has the highest priority?" Protect society, the common good and the infrastructure.
- "Reviewing a vendor's security before signing." Due diligence.
- "An AI tool treats one group of applicants unfairly." Unfair bias, an ethical concern.
What to remember for the exam
- Four canons in order: society, honour and law, principals, profession.
- The higher canon wins when they conflict.
- Due diligence is investigating; due care is acting responsibly.
- Disclose conflicts of interest.
- AI ethics: bias, transparency, privacy and human accountability.
Following an employer's instruction does not excuse an illegal or dishonest act. Acting legally is part of canon 2.
Common mistakes
Putting the employer before the public.
Mixing up due care and due diligence.
Treating AI decisions as nobody's responsibility.
Check yourself
What is the first canon of the ISC2 Code of Ethics?
Protect society, the common good, necessary public trust and confidence, and the infrastructure.
Is checking a provider's certifications before signing due care or due diligence?
Due diligence.
What should you do about a conflict of interest?
Disclose it and step away from the related decision.
Topic 4 of 4 in Security Principles
Test yourself on Security Principles
The full ISC2 CC question bank has 671 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by ISC2. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.