Let's take a look at the ISC squared Code of Ethics,
the final part of our Security Principles for the
Certified in Cybersecurity certification.
We've looked at a lot of parts of good governance and one of those is to ensure
we also have professional ethics we are expected to follow.
The idea of the ISC squared code of ethics is that it guides our behavior.
It helps us to know what is ethical, and remember,
ethics is not the same as law.
Law can influence ethics,
but law says this is what you're allowed or not allowed to do,
but ethics are more what do you believe to be right or wrong?
And one of the reasons that ISC squared, like most professional
organizations, must have a code of ethics is because everybody can
have a different idea of right and wrong.
And we want, as members of this consortium,
to all have a similar baseline for what is acceptable or unacceptable behaviors.
So the ISC squared code quite simply says,
all information security professionals who are certified by ISC squared
recognize that such certification is a privilege.
It must be both earned and maintained.
In support of this principle,
all ISC squared members are required to commit to
fully support this code of ethics, the code.
ISC squared members who intentionally or knowingly violate any provision of
the code will be subject to action by a peer review panel.
This may result in the revocation of certification.
If you observe any actions by an ISC squared member that breach the code,
you are obligated as an ISC squared member to follow
the ethical complaint procedure.
Failure to do so may be considered a breach of the code pursuant to Canon IV.
There are only four mandatory canons in the code described.
By necessity,
such high‑level guidance is not intended to be a substitute for
the ethical judgment of the professional.
This is testable on the exam and it's good for us to be familiar
with what ISC squared code of ethics require.
We start off with a preamble and introduction,
and it says here the safety and welfare of society and the common good,
duty to our principles and duty to each other requires that we adhere and be
seen to adhere to the highest ethical standards of behavior.
Therefore, strict adherence to this code is a condition of certification.
The four canons are in order of importance.
The most important says that you will protect society,
the common good, necessary public trust and confidence,
and the infrastructure.
The second most important is that you will act honorably,
honestly, justly, responsibly, and legally.
The third is that we will provide diligent and
competent service to our principles, to principles,
our employers, our customers, for example.
And we will advance and protect the profession.
The idea, of course,
is that these guide our behaviors in a way that can help
us to make good judgment decisions.
The idea of ethics has often been based on this concept of do no harm.
I shouldn't do something that harms another person.
In security, we often do have to harm another person.
If we find a breach of some type of, should we say,
policy,
it could be that we have to report that person and that is difficult for us.
But we also know that in order to protect society,
we must address the things where a person doesn't
follow the standards of society.
So that complaint would go before an ethics committee.
The ethics committee will advise the board of directors,
and the board of directors would make a final decision on whether or
not any form of disciplinary action should be taken,
such as the removal of the person's certification.
The key points review.
The core concept of ethics is do no harm and all certification holders should
be familiar with a content and intent of the code of ethics.