Security & Risk Management

1) Protect society, the common good, necessary public trust and confidence, and the infrastructure; 2) Act honorably, honestly, justly, responsibly, and legally; 3) Provide diligent and competent service to principals; 4) Advance and protect the profession.

Earlier Canons take precedence over later ones; the Canons are ranked in order of priority, so a conflict is resolved in favor of the lower-numbered (earlier-listed) Canon.

A substantiated ethics complaint can lead to sanctions including revocation of certification; adhering to the Code is a condition of holding and maintaining the credential, so ethics violations directly jeopardize certification.

They complement the ISC2 Code rather than replace it; a CISSP must adhere to the ISC2 Code in addition to any employer codes, and where employer rules are weaker the professional code still binds the individual.

RFC 1087, 'Ethics and the Internet,' published by the IAB; it characterizes unethical and unacceptable Internet behavior (e.g., gaining unauthorized access, disrupting use, wasting resources, destroying integrity, compromising privacy).

Confidentiality, Integrity, Availability, Authenticity, and Non-repudiation.