The ISC2 Code of Ethics for CISSP Candidates: The Four Canons, How Complaints Work, and How to Reason Through Ethics Questions

The ISC2 Code of Ethics matters to a CISSP candidate twice. It's tested: objective 1.1 of the outline, "Understand, adhere to, and promote professional ethics," lists the ISC2 Code of Professional Ethics and organizational codes of ethics, in both the 2024 and 2027 outlines. And it's binding: committing to the Code is part of the certification application, and ISC2 can act on breaches after you're certified. This guide explains both sides from ISC2's Code of Ethics page and its published complaint procedures, as checked on October 27, 2026. The canon wording below is quoted exactly from that page.

The ISC2 Code: a preamble and four canons

The preamble names three duties: to the safety and welfare of society and the common good, to principals, and to each other. Together, it says, they "require that we adhere, and be seen to adhere, to the highest ethical standards of behavior," and "strict adherence to this Code is a condition of certification."

ISC2 calls these the only four mandatory canons and says such high-level guidance is "not intended to be a substitute for the ethical judgment of the professional." The Examination Agreement adds that ISC2 provides further guidance for each canon, which its board may consider when judging behavior but which is advisory rather than mandatory.

One wording note: the Examination Agreement still prints an older version of the preamble and first canon, with "commonwealth" where the Ethics page now says the common good and public trust. The canons appear in the same order in both.

What committing to the Code means for a CISSP

From ISC2's Ethics page and the Candidate Information Bulletin:

• It's a condition of certification. All ISC2 members must commit to fully support the Code, and the application includes that commitment.
• Knowing violations have consequences. Members who intentionally or knowingly violate any provision face action by a peer review panel, which may result in revocation of certification.
• Silence can be a breach. Members who observe another member breaching the Code are obligated to follow the ethics complaint procedure, and ISC2 says failing to do so may be considered a breach under Canon IV.

That third point is easy to overlook, and it makes a natural scenario: seeing a colleague's misconduct and doing nothing isn't neutral under the Code.

Does the order of the canons matter?

Many CISSP study sources teach that the canons are ranked, so that in a conflict the earlier canon wins. On the ISC2 pages checked for this guide (the Ethics page, the Candidate Information Bulletin and the Examination Agreement), ISC2 lists the canons in a fixed order but doesn't state in words that the order is a ranking or a rule for resolving conflicts.

What ISC2's text does support, in Passy's reading:

• The preamble names the duties in a matching order: society and the common good, then principals, then each other.
• The complaint procedures treat the canons differently, by who can complain under each (see the next section).
• An instruction from a principal never justifies illegal or dishonest conduct, because that would breach Canon II regardless of any ranking.

For exam purposes, a practical approach is to check first whether two canons really conflict in the scenario; usually one option satisfies all four. If they do conflict, the listed order, with the public ahead of the employer and the employer ahead of the profession, is the tie-breaker most study materials use.

Ethics items are part of Domain 1, the heaviest domain under the 2024 outline, and you'll be able to practice Domain 1 ethics and governance items with the CISSP prep planned for launch.

How ISC2 ethics complaints work

ISC2's Ethical Complaint Procedures, published on its Ethics page, set out a formal process. ISC2 stresses that by publishing them it doesn't expect, invite, solicit or encourage complaints, and that their sole purpose is protecting the profession's reputation, not coercing or punishing members.

Who can complain under each canon. Complaints are accepted only from people who claim to be injured by the behavior:

What a complaint must contain. It must be in writing, as a sworn affidavit, submitted in two copies (one written, one PDF). At a minimum it names the respondent, the behavior, the canon breached, the complainant's standing and any corroborating evidence. The committee only considers complaints that specify a canon.

How it's judged:

1. The Professional Conduct (Ethics) Committee isn't an investigative body and can't compel testimony; it considers only evidence submitted to it, and proceeds only if a prima facie case is made.
2. ISC2 intends to notify the respondent within 30 days of receiving the complaint. The respondent can see all documents and has 30 days to respond, also by sworn affidavit; silence can be taken as not disputing the allegations.
3. Where facts remain disputed, the benefit of the doubt goes to the respondent, and the burden of proof is on the complainant.
4. The committee recommends action to the board, preferring the most limited and conservative action consistent with its findings. Both parties get 14 days to comment.
5. Discipline is at the board's sole discretion, its decisions are final, and parties are told the outcome within 30 days of board action.

ISC2 keeps the identities of the parties confidential from the general public, though a complainant's identity may be disclosed to the respondent where needed for due process.

Recall-heavy details like the standing rules suit short, repeated review, and 93 Domain 1 flashcards are planned for full CISSP prep.

The ISC2 Code and your organization's code of ethics

Objective 1.1 lists organizational codes of ethics alongside the ISC2 Code. On the exam, expect both to apply at once: an employer's code governs conduct at work, and the ISC2 Code governs you as a certified professional. In Passy's reading, conflicts are rarer than they look. Most scenarios that seem to pit the employer against the Code involve an instruction to do something illegal, dishonest or unsafe, which the employer's own code is unlikely to allow either.

From April 15, 2027, the outline also lists ethics in artificial intelligence (AI) in Domain 1. The 2027 outline doesn't define the topic further; the CISSP 2027 outline guide covers the other AI additions.

Ethics scenarios written by Passy

These are original items, not ISC2 questions.

1. The audit. A day before an external audit, your manager asks you to disable logging on a system so a misconfiguration won't show up. What should you do?

Keyed answer: decline and raise it through the appropriate channel, such as the organization's ethics or compliance function. Hiding evidence from auditors is dishonest and may be illegal (Canon II). Diligent service to your employer (Canon III) doesn't include deceiving an auditor on its behalf.

2. The false credential. You learn that another ISC2 member is advertising a certification they don't hold. What does the Code expect of you?

Keyed answer: follow ISC2's ethics complaint procedure. ISC2 says members who observe a breach are obligated to use it, and that failing to do so may itself breach Canon IV. Claiming a credential you don't hold is dishonest, which points to Canon II, a canon any member of the public can complain under. Check the facts first: a complaint must be a sworn affidavit that names the canon breached and includes any corroborating evidence.

3. The flaw in a vendor's product. During a paid assessment, you find a serious vulnerability in a widely used commercial product. Your client wants the finding kept internal. What's the BEST course of action?

Keyed answer: report it to the client and recommend coordinated, responsible disclosure to the vendor, within your contract. Publishing it yourself would breach your duty to the client (Canon III); burying it indefinitely leaves the public exposed (Canon I). Coordinated disclosure serves both. "Responsible disclosure" is the 2027 outline's wording for this idea in Domain 6.

4. The curious friend. A friend preparing for the CISSP asks which topics came up on your exam and how many questions you got. What should you say?

Keyed answer: decline, and offer to talk about how you studied instead. The Examination Agreement treats exam content, and even the number of questions, as confidential. Disclosing it would breach your agreement and the honorable conduct Canon II asks for.

Your next step with the ISC2 Code of Ethics

Read the canons on ISC2's Ethics page once in full, then write each one from memory in your own words with one example of a breach. When you meet an ethics item in practice, name the canon each option serves or violates before choosing. The think like a manager guide shows where ethics sits in a wider decision order, the CISSP endorsement guide covers the application step where you commit to the Code, and you can compare the free CISSP resources with what full prep will include at launch.