Every SSCP holder agrees to follow the ISC2 Code of Ethics, and breaking it can cost you the certification. The exam does not ask you to recite it word for word, but it does give you short workplace dilemmas and asks what the certified professional should do. To answer those well you need to know what the code says and, more importantly, the order in which its parts apply when they pull in different directions.
The code opens with a preamble. In plain terms it says that the safety and welfare of society and the common good, duty to our principals, and duty to each other require that members adhere, and be seen to adhere, to the highest ethical standards of behavior. It then says that strict adherence to the code is a condition of certification. Two ideas matter here: appearance counts as well as conduct ('be seen to adhere'), and following the code is not optional once you are certified.
The four canons follow, and they are listed in priority order. First: protect society, the common good, necessary public trust and confidence, and the infrastructure. Second: act honorably, honestly, justly, responsibly and legally. Third: provide diligent and competent service to principals. Fourth: advance and protect the profession. A principal is whoever you work for: your employer, a client or a customer.
The ordering is the key exam skill. When two canons conflict, the higher one wins. If your employer (canon three) asks you to hide a safety-critical flaw from the public (canon one), protecting society comes first. If a client wants you to cut a legal corner, acting legally (canon two) beats serving the client. Loyalty to the profession (canon four) is real, but it never outranks honesty or public safety. A handy memory aid is 'society, self (your own honest conduct), boss, profession'.
The code also shapes how complaints work. ISC2 accepts formal ethics complaints, and the right to file one is tied to the canons: broadly, anyone may complain about violations of the first two canons, principals about the third, and other certified professionals about the fourth. Complaints must be specific and are reviewed by an ethics committee, not settled informally. Knowing that a violation you witness can and sometimes should be reported is part of the professional duty.
In practice, most ethical questions on the exam have one answer that is legal, honest and protects people, and several distractors that are expedient, loyal to a boss, or quietly helpful to a peer. Pick the option that a reasonable, honest professional could defend in public. Avoid answers that involve deception, even well-intended deception, and avoid answers where you take action outside your authority when a proper reporting channel exists.
Key terms
- Preamble
- The opening statement of the ISC2 Code of Ethics explaining why high ethical standards are required and that adherence is a condition of certification.
- Canon
- One of the four ordered principles of the code; when they conflict, the earlier canon takes priority.
- Principal
- The person or organization you provide professional services to, such as an employer or client.
- Ethics complaint
- A formal, specific allegation filed with ISC2 that a member violated the code, reviewed by an ethics committee.
A manager asks an SSCP-certified administrator to leave a known flaw in a hospital's patient-monitoring network unreported until after a product launch. Serving the employer is canon three, but protecting society and the infrastructure is canon one, so the administrator escalates the issue through proper channels rather than staying silent.
Check yourself
Which canon takes priority if serving your employer would require breaking the law?
Canon two, act honorably, honestly, justly, responsibly and legally, outranks canon three, service to principals, so you must not break the law for the employer.
What does the preamble say about adherence to the code?
That members must adhere, and be seen to adhere, to the highest ethical standards, and that strict adherence is a condition of certification.
What is canon four?
Advance and protect the profession, which is the lowest of the four in priority.