Code of Conduct & Ethics
1. Introduction
1.1 A profession is distinguished by certain characteristics, including:
- Mastery of a particular intellectual skill, acquired by training, education and experience
- Adherence by its members to a defined professional code of conduct and ethical behaviour
- Acceptance of a duty to society as a whole.
2. Objectives
2.1 This code of conduct and ethics recognises that the objectives of the cyber, digital and information security profession are that its members should work to the highest standards of professionalism and ethical behaviour and that their work should fully satisfy the needs of all stakeholders and those of society as a whole. These objectives require that three basic needs are satisfied, namely:
- Trust – for employers, clients, regulators, other interested parties and for society as a whole; there is a need for trust in cyber, digital, information and information systems and in the practitioners working in those fields
- Quality – there is a need for assurance that all services obtained from a cyber, digital and information security professional are carried out to the highest levels of performance and ethical conduct
- Standards – users of the services of cyber, digital and information security professionals should be confident that members of CIISec have been accredited for their knowledge, skills and competence and ethical behaviour, which governs the provision of those services.
3. Values
3.1 In order to achieve the objectives of the cyber, digital and information security profession, CIISec has identified four core values that all members shall be required to observe:
- Honesty – members are expected to conduct themselves in accordance with the legislation and standards to the best of their ability, and to report their findings fully and accurately
- Diligence – members are expected to conduct their work thoroughly, carefully and with persistence
- Objectivity – members are expected to conduct their work without being influenced by personal feelings or opinions
- Integrity – members are expected to conduct their work in a fair and ethical manner.
4. Code of Conduct
4.1 This code of conduct and ethics is intended to guide members in their professional and personal conduct. Members of CIISec shall:
4.1.1 Maintain Professionalism
- Maintain professional knowledge and competency through Continuing Professional Development (CPD), to ensure they provide a professional, up to date service in their respective fields
- Accept responsibility for their own professional actions and decisions
- Act only within their level of competence
- Promote and carry out professional services in accordance with the relevant technical and professional standards
- Ensure that their professional judgement is not compromised nor could be perceived as being compromised because of bias, or the undue influence of others.
4.1.2 Act in an Ethical Manner
- Act at all times in accordance with the Institute’s values and those of the organisation whom they represent
- Members shall not make any statement on behalf of CIISec or purport to represent CIISec through any public medium, including digital social media, unless authorised to do so by CIISec
- Act in accordance with legislation and respect the confidentiality of information acquired during the course of their duties. Do not use or disclose any such information without proper and specific authority, unless there is a legal or professional requirement to do so
- Respect other members and colleagues and recognise the potential for any conflict of interests and, where appropriate, take steps to resolve or avoid any such conflict
- Speak up when data is exposed, mishandled, or when systems lack adequate protection, and use acquired skills and knowledge to safeguard systems and data—not to cause harm or disruption.
4.1.3 Promote Best Practice
- Support the professional education and development of other members of the profession and other individuals involved in cyber, digital and information security
- Demonstrate and promote fair and reasonable standards in the treatment of people who are operating within their sphere of influence
- Recognise and promote the benefits of diversity and equality in the professional environment.
5. Inappropriate Behaviour
5.1 The Institute may have to take action in accordance with the disciplinary process against members who repeatedly or intentionally fail to follow the Code of Conduct and Ethics. Disciplinary actions will vary depending on the violation. Possible consequences include:
- Formal warning
- Suspension or termination of membership of the Institute for a definite or indefinite time.
6. Changes to the Code of Conduct and Ethics
6.1 Any changes to the Code of Conduct and Ethics and the associated disciplinary process must be agreed by the Board of CIISec. The Disciplinary and Ethics Committee can make recommendations to the Board in this regard.