What are the four canons of the ISC2 Code of Ethics?

What the code requires of ISC2 members

Committing to the code is a condition of certification, and ISC2 can revoke a certification for a knowing breach.

ISC2 requires all members to commit to fully support the code. Members who intentionally or knowingly violate it face a peer review panel, which may revoke their certification. The preamble ends: strict adherence to this Code is a condition of certification.

Members must also follow ISC2's ethics complaint procedure when they see another member breach the code, and ISC2 says that failing to do so may itself breach Canon IV. In every case, a complainant must claim to be injured by the behaviour. ISC2's candidate bulletin lists agreeing to the Code of Ethics as a step on the path to certification, after passing the exam and applying.

ISC2 calls these the only four mandatory canons, and says such high-level guidance is not a substitute for the professional's own ethical judgment.

Is there an order to the canons?

ISC2's current code lists the canons in a fixed order but no longer says how to settle a conflict between them; an earlier version told members to follow the order of the canons.

An archived copy of ISC2's ethics page from January 2009 says: Conflicts between the canons should be resolved in the order of the canons. The canons are not equal and conflicts between them are not intended to create ethical binds. That version also carried guidance for each canon, which it called advisory rather than mandatory. By January 2013 the sentence was no longer on ISC2's page.

The current preamble still names the duties in the canons' order: the safety and welfare of society and the common good, duty to our principals, and duty to each other. Study guides teach the same order, so settle an exam conflict in favour of the earlier canon, such as public safety over an employer's wishes. Just don't quote it as a current ISC2 rule: neither ISC2's ethics page nor its candidate bulletin states it.

The newer Code of Professional Conduct

ISC2's newer Code of Professional Conduct expands on the Code of Ethics for the whole cybersecurity profession; it does not replace it.

ISC2 says the Code of Professional Conduct builds upon the existing Code of Ethics, which all ISC2-certified members and Associates are required to follow. The conduct code describes its principles as grounded in the canons and developed to enhance - not replace - that foundation. It was reviewed by the ISC2 Ethics Committee and approved by the ISC2 Board of Directors.

The CISSP outline still names the ISC2 Code of Professional Ethics under objective 1.1, in the 2024 outline and in the one effective 15 April 2027, so learn the four canons first. The conduct code adds detail, including:

• Conflicts of interest: recognize and disclose actual or potential conflicts promptly.
• Privileged access: use it only for authorized and legal purposes, and report misuse.
• Honesty about yourself: misleading claims about qualifications, certifications or experience are unethical, and cheating and other fraudulent exam practices are strictly prohibited.
• Confidentiality, data security and privacy, respect for laws and your organization's code of conduct, and public safety, including securing emerging technologies responsibly.

What objective 1.1 covers

Objective 1.1, understand, adhere to, and promote professional ethics, lists the ISC2 code and organizational codes of ethics.

The 2024 outline lists two items: the ISC2 Code of Professional Ethics and an organizational code of ethics. The outline effective 15 April 2027 keeps both and adds Ethics in Artificial Intelligence (AI). Expect scenarios where an employer's code, a client's instructions and the ISC2 canons point different ways.

The mistakes that make a wrong answer look right

Most wrong answers protect the employer, the client or the candidate at the expense of the public or the truth.

• Putting the employer first: when keeping a client happy would put the public or critical infrastructure at risk, the answer that protects society usually wins.
• Staying silent: seeing another member breach the code and doing nothing can itself breach Canon IV.
• Overstating yourself: claiming experience or certifications you do not hold conflicts with Canon II's duty to act honestly and breaks the conduct code's honesty rules.
• Taking a shortcut on the exam: sharing or using recalled exam questions breaks ISC2's exam non-disclosure agreement, which ISC2 can enforce by cancelling results or revoking certifications, and the conduct code calls cheating and other fraudulent exam practices strictly prohibited.
• Quoting old wording: some study pages still show earlier canon text, such as protect society, the commonwealth, and the infrastructure. Use ISC2's current wording.

Check the rule on a changed scenario

Change who is asking and what is at stake, and check which canon decides.

• A manager asks you to delete a log that shows a breach before the auditors arrive: refuse, because Canon II requires acting honestly and legally.
• A client wants a quick fix you know leaves customers' data exposed: tell them so in writing, because Canon III asks for diligent and competent service and Canon I covers the public's exposure.
• A colleague who holds the CISSP posts live exam questions online: report it to ISC2, through its exam-fraud report page or an ethics complaint that names the canon breached; staying silent may itself breach Canon IV.
• You are asked to evaluate a vendor your relative works for: disclose the conflict of interest, as the Code of Professional Conduct expects.