Professional Ethics, Security Concepts, and Governance

Introduction

This first lesson opens Domain 1, Security and Risk Management, which carries the highest weight of the eight CISSP domains (16% of the exam, according to the ISC2 exam outline effective 15 April 2024). Everything else in the course rests on it. Domain 1 is where you learn the vocabulary, the mindset, and the decision framework that the exam expects from a security manager rather than a technician. Questions in later domains (access control, network design, software security) are routinely answered correctly only when you remember the Domain 1 principles: protect people first, align with the business, apply due care, and choose the answer that a risk-aware leader would choose.

In this lesson you will work through three clusters of the outline: professional ethics, the core security concepts (confidentiality, integrity, availability, authenticity, and nonrepudiation), and security governance (organizational structure, roles, frameworks, due care, due diligence, and the alignment of security with business goals, including acquisitions and divestitures).

By the end you will be able to apply the ISC2 Code of Ethics canons in order, classify a scenario against the security properties it threatens, explain who is accountable for what in a governance structure, distinguish due care from due diligence, and pick a control framework that fits an organization.

Learning objectives

After this lesson you can:

1. List the four ISC2 Code of Ethics canons in priority order and use them to resolve a conflict.
2. Define confidentiality, integrity, availability, authenticity, and nonrepudiation, and match controls to each.
3. Explain governance versus management and describe the duties of the board, executives, the CISO, data owners, custodians, and users.
4. Compare common frameworks and standards (ISO/IEC 27001 and 27002, NIST CSF, NIST SP 800-53, COBIT, ITIL, COSO, SABSA, TOGAF) and select one for a given need.
5. Differentiate due care and due diligence, with examples.
6. Describe how security decisions are aligned with strategy, goals, mission and objectives, and how mergers, acquisitions, and divestitures change the security picture.

1. Professional ethics

1.1 Why ethics is tested

CISSPs hold privileged positions. They see confidential data, can read employee mail, and can shut systems down. ISC2 therefore binds every member (and every candidate) to a Code of Ethics. The exam does not test whether you can recite a philosophy; it tests whether you pick the ethical, professional option when a scenario tempts you with a shortcut. Expect questions in which a manager asks you to conceal a breach, a friend asks for a favor, or a customer offers a gift.

1.2 The ISC2 Code of Ethics preamble and canons

The Code has a short preamble followed by four canons. The preamble says that the safety and welfare of society and the common good, duty to our principals, and duty to each other require that we adhere, and be seen to adhere, to the highest ethical standards of behavior, and that strict adherence to the Code is a condition of certification.

The canons, in priority order, are:

1. Protect society, the common good, necessary public trust and confidence, and the infrastructure.
2. Act honorably, honestly, justly, responsibly, and legally.
3. Provide diligent and competent service to principals.
4. Advance and protect the profession.

The order matters. When two canons collide, the earlier one wins. Society beats employer; legality and honesty beat a client's convenience; service to the principal beats the reputation of the profession.

A quick memory aid: Society, Honor, Service, Profession. Think of the sentence "Safe Hands Serve People."

1.3 Worked example: a conflict between canons

Scenario. You are the security manager of a regional payment processor. During a review you discover that a misconfigured storage bucket exposed the card data of about 40,000 customers for three weeks. Your CEO asks you to patch the bucket quietly and to avoid telling the regulator or customers because "nothing indicates anyone downloaded it" and a disclosure would damage an upcoming funding round.

Reasoning step by step.

1. Identify the stakeholders: customers (society), the regulator, the employer (your principal), the profession.
2. Identify applicable canons. Canon 1 (protect society and public trust) points to disclosure. Canon 2 (act legally and honestly) also points to disclosure, because most breach notification laws and card brand rules require it. Canon 3 (service to the principal) suggests loyalty to the CEO.
3. Apply the priority order. Canons 1 and 2 outrank canon 3.
4. Choose the action: fix the exposure immediately (that serves everyone), preserve evidence, escalate through the chain of command (general counsel, the audit committee or board if the CEO insists), and make the legally required notifications.
5. Why the other choices are weaker: complying silently violates canons 1 and 2; resigning without reporting leaves customers exposed and does not discharge your duty; anonymously leaking to the press skips the proper escalation and notification channels and may breach confidentiality duties.

Takeaway for the exam: the right answer is rarely "obey the boss" and rarely "go public first." It is usually "escalate internally through proper channels while complying with the law."

1.4 Exam tips for ethics questions

• If the answer set contains one option that follows the canon order and the law, choose it.
• "Report to the next level of management" or "to the ethics committee" beats confronting a colleague or publicly shaming them.
• Never pick an option that has you exceed your authorization, even to do good (for example, hacking a supplier to prove it is vulnerable).
• Conflicts of interest are disclosed, not hidden.
• Gifts: follow the organization's policy; when none is stated, decline or disclose.

2. Security concepts: the CIA triad and beyond

2.1 Confidentiality

Confidentiality means preventing unauthorized disclosure of information. Typical controls: encryption at rest and in transit, access control lists, need-to-know, data classification, tokenization and masking, secure disposal, and physical measures such as clean-desk rules.

Threats: eavesdropping, shoulder surfing, social engineering, misconfigured storage, insider disclosure, and traffic analysis.

2.2 Integrity

Integrity means that information and systems are accurate, complete, and changed only in authorized ways. There are three goals commonly cited: preventing unauthorized modification by unauthorized subjects, preventing unauthorized modification by authorized subjects (mistakes or abuse), and maintaining internal and external consistency (the data matches itself and matches the real world).

Controls: hashing and digital signatures, version control, change management, input validation, separation of duties, checksums, database constraints and transaction logging, write-once media, and file integrity monitoring.

2.3 Availability

Availability means authorized users can reach information and systems when they need them. Controls: redundancy (RAID, clustering, multiple data centers), load balancing, backups, DDoS protection, capacity planning, maintenance windows, patching, disaster recovery, and service level agreements.

Availability is often expressed as a percentage. "Five nines" (99.999%) allows about 5.26 minutes of downtime a year; "three nines" (99.9%) allows about 8.76 hours.

2.4 Authenticity

Authenticity is the property that data, a transaction, or a communicating party is genuine and can be verified as coming from its claimed source. It is closely tied to integrity and to identity. Digital signatures, certificates, message authentication codes, and mutual TLS support authenticity. The CISSP outline lists it separately from the triad, so expect a question that distinguishes it: confidentiality hides, integrity protects from change, authenticity proves origin and genuineness.

2.5 Nonrepudiation

Nonrepudiation prevents a party from credibly denying that it performed an action, such as sending a message or approving a payment. It requires that the origin and integrity of the action can be proven to a third party. Digital signatures backed by asymmetric keys, trusted timestamps, and protected audit logs provide it. Important nuance: a symmetric key or a shared password cannot provide nonrepudiation, because both parties know the secret and either could have produced the message. A message authentication code gives authenticity and integrity between two parties but not nonrepudiation.

2.6 Comparison table

2.7 Related concepts you must be able to use

• Identification, authentication, authorization, accountability (and auditing): identification claims an identity; authentication proves it; authorization grants rights; accountability ties actions to a unique identity through logs.
• Least privilege: only the access required for the task.
• Need-to-know: access only to the information required, even within a clearance level.
• Defense in depth: layered, independent controls so that one failure does not mean compromise.
• Privacy: a separate objective in many programs; it governs how personal information is collected, used, retained, and shared, and it relies on confidentiality controls.
• Safety: in operational technology, human safety may override other properties. If a scenario involves life and a security control, protecting life comes first.

2.9 Worked example: classify the incident

Scenario. A hospital's pharmacy system is attacked. The attacker (1) reads the medication list for patients, (2) changes a dosage field for one patient from 5 mg to 50 mg, and (3) later encrypts the database server. Which properties were violated, and which is the greatest concern?

Reasoning.

1. Reading the medication list: confidentiality (and privacy).
2. Changing the dosage: integrity. This is the greatest concern because it can directly cause patient harm, and the change might not be noticed. The safety principle also elevates this.
3. Encrypting the server: availability.
4. Which controls would have helped? Role-based access and encryption for (1); integrity monitoring, dual approval for dosage changes, and signed order records for (2); backups and tested restoration for (3).
5. Why not rank availability first? Downtime hurts, but staff can switch to paper; an undetected incorrect dosage could kill someone.

3. Security governance principles

3.1 Governance versus management

Governance sets direction, defines accountability, and ensures that the organization's activities support its objectives within acceptable risk. It is exercised by the board of directors and senior executives. Management plans, builds, runs, and monitors activities in line with that direction. A simple way to remember it: governance decides what and why; management carries out how.

Governance answers questions such as: what is our risk appetite? Who is accountable for information protection? How do we know the program is working? It uses policies, metrics, oversight committees, and independent assurance (internal audit).

3.2 Alignment with business strategy, goals, mission, and objectives

Security exists to support the mission, not to exist for itself. Alignment means:

• Security objectives are derived from business objectives. If the strategy is to expand into online retail, then payment security, fraud detection, and availability during peak season become security objectives.
• The security function is represented at executive level (commonly the CISO reports to the CEO, CIO, or CRO; reporting to the CEO or the board provides the most independence). The exam's preferred answer is that security should have enough independence and visibility to avoid conflict with IT operations.
• A strategic plan looks three to five years ahead; a tactical plan spans about a year and describes projects; an operational plan covers weeks to months and describes day-to-day tasks. All must trace back to the mission.
• Top-down approaches (management initiates, funds, and enforces) are preferred over bottom-up ones, because they carry authority and budget.
• Security metrics are expressed in business language (revenue protected, downtime avoided), not just technical counts.

Management support is the single most important success factor. A policy without executive sponsorship is a suggestion.

3.3 Organizational processes: acquisitions, divestitures, governance committees

Acquisitions and mergers. When your company buys another, you inherit its risks. Best practice: perform security due diligence before closing (review incidents, certifications, vulnerabilities, contracts, regulatory exposure); run a gap analysis between the two security programs; plan network integration carefully (do not connect flat networks immediately); consolidate identity and logging; reconcile policies; and manage culture. A frequent exam theme is interconnection risk: the acquired company's weaker controls can become an attack path into the parent.

Divestitures. When a business unit is sold or spun off, you must separate systems and data: identify which data belongs to the departing unit, revoke access of departing employees and of the buyer's staff to retained systems, transfer or destroy data under contract and legal retention rules, untangle shared services (identity provider, email tenant, network links), and protect intellectual property that stays behind. Transition service agreements (TSAs) temporarily share services under controlled terms.

Governance bodies. Typical bodies include the board risk committee, an information security steering committee (cross-functional: business, legal, HR, IT, audit), a change advisory board, and a data governance council.

3.4 Organizational roles and responsibilities

Know these roles well, because the exam asks who is accountable versus who performs.

Key point: accountability cannot be delegated; responsibility can. A CEO may delegate the task of patching but remains accountable for the risk decision.

Separation of duties and job rotation and mandatory vacations are governance-level controls to limit fraud and expose irregularities.

3.5 Control frameworks and standards

A framework is a structure of recommended practices; a standard is a set of required or certifiable specifications; a regulation is law. Organizations pick frameworks to avoid reinventing controls and to speak a common language with auditors.

Notice that NIST CSF 2.0 (published in February 2024) added a sixth function, Govern, which reinforces the topic of this lesson: governance is now a first-class part of the framework.

Tailoring and scoping. After picking a baseline, you scope it (decide which parts apply to which systems) and tailor it (adjust to the environment, add compensating controls). Never adopt a framework wholesale without risk context.

3.6 Due care and due diligence

These two terms are among the most tested in Domain 1, and they are easy to confuse.

• Due diligence is investigating and understanding risks before acting: researching, assessing, planning. It is the "think" part. Example: before signing with a cloud provider, you review its audit reports, penetration test summaries, and breach history.
• Due care is doing the right thing consistently based on that knowledge: implementing, maintaining, and following through. It is the "act" part. Example: you require MFA, encrypt data, and monitor the provider every quarter.

A frequently used summary: due diligence is knowing; due care is doing. Another: due diligence is the plan and due care is its execution. Both together demonstrate that a "prudent person" would have behaved the same way. Negligence is the failure to exercise due care, and it is what leads to liability.

Related terms:

• Prudent person rule: act as a reasonably careful person would in the same situation.
• Due process: fair legal procedure for people affected by a decision.
• Duty of loyalty: do not use the position for personal gain or against the organization's interest.
• Downstream liability: an organization may be liable when its failure to secure its systems harms others (for example, a compromised server used to attack a third party).

3.7 Worked example: due care or due diligence?

Scenario. A logistics company plans to outsource its warehouse management system. The security team sends a questionnaire to three vendors, reviews SOC 2 Type II reports, reads public breach records, and visits one data center. Later, after signing, the team requires contractual encryption, quarterly access reviews, and incident notification within 24 hours, and it checks compliance each quarter.

Analysis.

1. Questionnaires, report reviews, record checks, and the visit are due diligence (investigation before the decision).
2. The contractual requirements and the recurring checks are due care (acting on the knowledge and keeping up).
3. Which is worse to omit? Omitting diligence means signing blind. Omitting care means knowing the risk and then ignoring it, which is the stronger indicator of negligence in a court's eyes.

4. Putting it together: a mini case study

Case. Northwind Foods, a mid-sized food distributor with 2,400 employees and about €900 million in revenue, is acquiring Harbor Fresh, a regional competitor with 300 employees. Harbor Fresh runs its own flat network, shares an administrator password across stores, and recently had a ransomware scare that was never fully investigated. Northwind's CIO asks the new CISO to "connect Harbor Fresh's network to ours by the end of the month so we can share the ERP." The Northwind CEO has publicly promised investors synergies from this quarter. During the diligence review the CISO also learns that a Harbor Fresh manager asked an IT contractor to quietly delete logs from the ransomware scare.

Questions.

1. Which ethical canons apply to the log deletion request, and what should the CISO do?
2. How should the CISO respond to the connection deadline?
3. Which governance mechanisms and frameworks should the CISO use?
4. Classify the shared administrator password against the CIA triad, authenticity, and nonrepudiation.

Solution, commented.

1. Deleting logs of a possible incident destroys evidence and may be unlawful, and it hides risk from the new owner. Canon 2 (act honorably, honestly, legally) and canon 1 (public trust, since customer data may be involved) apply. The CISO must preserve the logs, stop the deletion, and escalate to general counsel and the Northwind executive sponsor. Keeping quiet to protect the deal would be a canon violation.
2. The CISO should not refuse outright, because security must support the business objective, and should not comply blindly, because unassessed interconnection exposes Northwind. The right approach is to present the risk in business terms (the cost of a ransomware event across both companies exceeds the synergy value), propose a staged plan: complete a security assessment of Harbor Fresh; segment and restrict the link to the ERP only through a proxy or DMZ with monitoring; replace the shared credentials; deploy Northwind's endpoint detection; then extend integration as findings are closed. This is due diligence followed by due care.
3. Governance: take the proposal to the information security steering committee and the executive sponsor, record the residual risk acceptance by the business owner if the executives still choose a faster timeline, and use ISO/IEC 27001 and NIST CSF 2.0 as the baseline for the gap analysis. A RACI chart assigns who remediates what.
4. The shared password breaks accountability and nonrepudiation (nobody can be tied to an action), weakens authenticity (the identity cannot be verified as a specific person), and endangers confidentiality, integrity, and availability because anyone who knows it can read, change, or delete data.

5. Common pitfalls and exam tips

Pitfalls

• Confusing accountability with responsibility. Executives remain accountable.
• Treating the IT department as the owner of data. The business owns the data; IT is the custodian.
• Mixing up due care and due diligence. Remember: diligence = discover, care = carry out.
• Believing symmetric encryption provides nonrepudiation. It does not.
• Choosing a technical fix when the question is about governance, ethics, or business alignment.
• Ranking availability above human safety in a scenario that involves life.

Exam tips

• Think like a risk advisor to the board: the best answer protects people, complies with law, supports the business, and is proportionate.
• When asked "what should the security professional do first," look for answers such as "understand the business requirement," "assess the risk," or "consult policy," unless there is an active emergency (then contain first).
• If a question stresses a framework, remember what it is for: ISO 27001 certifies an ISMS, ISO 27002 lists controls, NIST CSF communicates outcomes, NIST 800-53 details controls, COBIT governs IT, ITIL manages services, COSO is enterprise risk and internal control.
• Governance is top-down. Management support, funding, and enforcement come before technology.
• Remember the ISC2 canon order. It is a classic tie-breaker.

Key terms

• Authenticity: the quality of being genuine and verifiable as coming from the claimed source.
• Availability: reliable access for authorized users when needed.
• Confidentiality: prevention of unauthorized disclosure.
• Integrity: accuracy, completeness, and authorized change only.
• Nonrepudiation: proof of an action that its performer cannot credibly deny.
• Governance: direction, oversight, and accountability set by the board and executives.
• Due care: acting prudently and consistently to implement and maintain protections.
• Due diligence: investigating and understanding risk before and during decisions.
• Data owner / custodian: the decision-maker for an asset's classification and access versus the party that implements the controls.
• Framework / standard: a recommended structure versus a specification that can be certified against.
• ISMS: the management system defined by ISO/IEC 27001.
• Code of Ethics canons: protect society; act honorably; serve principals diligently; advance the profession.

Summary checklist

• I can recite the four ISC2 canons in order and use the order to settle a conflict.
• I can define confidentiality, integrity, availability, authenticity, and nonrepudiation and match each to controls.
• I know why a shared secret cannot provide nonrepudiation.
• I can distinguish governance from management, and accountability from responsibility.
• I can name the duties of the board, executives, CISO, data owner, custodian, and users.
• I can pick between ISO/IEC 27001, 27002, NIST CSF 2.0, NIST SP 800-53, COBIT, ITIL, COSO, SABSA, and TOGAF for a given need.
• I can separate due diligence (investigate) from due care (act) with examples.
• I can explain the security steps for an acquisition and a divestiture.
• I align security with business strategy and speak in business terms.

Official sources

• ISC2 CISSP certification: https://www.isc2.org/certifications/cissp (opens in a new tab)
• ISC2 CISSP exam outline (effective 15 April 2024): https://www.isc2.org/certifications/cissp/cissp-certification-exam-outline (opens in a new tab)
• ISC2 Code of Ethics: https://www.isc2.org/about/ethics (opens in a new tab)
• NIST Cybersecurity Framework 2.0: https://www.nist.gov/cyberframework (opens in a new tab)
• ISO/IEC 27001 overview: https://www.iso.org/standard/27001 (opens in a new tab)