Code of Conduct & Ethics
1. Introduction
1.1 A profession is distinguished by certain characteristics, including:
- Mastery of a particular intellectual skill, acquired by training, education and experience
- Adherence by its members to a defined professional code of conduct and ethical behaviour
- Acceptance of a duty to society as a whole.
2. Objectives
2.1 This code of conduct and ethics recognises that the objectives of the cyber, digital, engineering and information security profession are that members at all levels should work to the highest standards of professionalism and ethical behaviour and that their work should fully satisfy the needs of all stakeholders and those of society as a whole. These objectives require that three basic needs are satisfied, namely:
- Trust – for employers, clients, regulators, other interested parties and for society as a whole; there is a need for trust in cyber, digital, information and information systems and in the practitioners working in those fields
- Quality – there is a need for assurance that all services obtained from a cyber, digital and information security professional are carried out to the highest levels of performance and ethical conduct
- Standards – users of the services of cyber, digital, engineering and information security professionals should be confident that members of CIISec and those holding a professional registration have been accredited for their knowledge, skills and competence and ethical behaviour, which governs the provision of those services.
3. Values
3.1 In order to achieve the objectives of the cyber, digital, engineering and information security profession, there are five core values that all members shall observe:
- Honesty – communicate truthfully and openly, ensuring accuracy and sincerity in all professional interactions
- Diligence – apply consistent effort, care and attention to detail in fulfilling professional responsibilities, delivering high-quality outcomes
- Objectivity – base decisions and advice on impartial assessment of facts, free from bias or undue influence, ensuring fairness in all professional judgements
- Integrity – hold the highest ethical standards by acting honestly, transparently and in accordance with the values and code of conduct of the professional body
- Inclusion – foster a respectful and welcoming environment that values diversity, ensures equitable opportunities and encourages participation from all individuals.
4. Code of Conduct and Ethics
4.1 This code of conduct and ethics is intended to guide members in their professional and personal conduct. CIISec members and professional registrants shall:
4.1.1 Maintain Professionalism
- Maintain professional knowledge and competence for their business function as their relevant sector evolves through Continuing Professional Development (CPD). To ensure the provision of a professional, up to date service in their respective fields of cyber, digital, engineering and information security
- Accept responsibility for their own professional actions and decisions, taking time to consider actions and language
- Accept appropriate responsibility for work carried out under their supervision
- Assess relevant liability for work done by them or under their supervision, and if appropriate hold professional indemnity insurance
- Support a colleague or any other person to whom they have a duty of care who in good faith raises any concern about a danger, risk, malpractice or wrongdoing which affects others (‘blows the whistle’)
- Maintain high professional standards and act only within their level of competence
- Promote and carry out professional services in accordance with the relevant technical and professional standards
- Ensure that their professional judgement is not compromised nor could be perceived as being compromised because of bias, or the undue influence of others
- Promote honesty and transparency in all operations, ensuring information is not withheld and all statements are truthful and well-founded
- Notify CIISec if they have:
- received a criminal conviction, or an adverse civil court judgement, related to any aspect of this Code of Conduct and Ethics (whether in the UK or overseas)
- been declared bankrupt or disqualified as a Company Director or Charity Trustee
- had membership of another professional body terminated as a result of a disciplinary procedure
4.1.2 Act in an Ethical Manner
- Act at all times in accordance with the Institute’s values and those of the organisation whom they represent
- Conduct business with integrity, ensuring fair competition, accurate representation of competitors, and adherence to antitrust principles
- Members shall not make any statement on behalf of CIISec or purport to represent CIISec through any public medium, including digital social media, unless authorised to do so by CIISec
- Act in accordance with legislation and respect the confidentiality of information acquired during the course of their duties. Do not use or disclose any such information without proper and specific authority, unless there is a legal or professional requirement to do so
- Respect other members and colleagues and recognise the potential for any conflict of interests and, where appropriate, take steps to resolve or avoid any such conflict
- Report when risks, vulnerabilities and threats are identified, mishandled, or when systems lack adequate protection, and use acquired skills and knowledge to safeguard systems and data—not to cause harm or disruption
4.1.3 Promote Best Practice
- Support the professional education and development of other members of the profession and other individuals involved in cyber, digital, engineering and information security
- Demonstrate and promote fair and reasonable standards in the treatment of people who are operating within their sphere of influence
- Recognise and promote the benefits of diversity and equality in the professional environment.
5. Inappropriate Behaviour
5.1 The Institute will take action in accordance with the disciplinary process against members who repeatedly or intentionally fail to follow the Code of Conduct and Ethics.
5.2 Members have a responsibility to notify CIISec of any significant violation of the CIISec Code of Conduct and Ethics by another member.
5.3 Disciplinary actions will vary depending on the violation. Possible consequences include:
- Formal warning
- Suspension or termination of membership of the Institute for a definite or indefinite time.
- Suspension or termination of a professional registration
6. Changes to the Code of Conduct and Ethics
6.1 Any changes to the Code of Conduct and Ethics and the associated disciplinary process must be agreed by the Board of CIISec. The Disciplinary and Ethics Committee can make recommendations to the Board in this regard.