Topics in this domain
- Exam Technique: Thinking Like a Security Manager
- Security Governance vs Security Management
- Organisational Culture and Tone at the Top
- Ethics, Codes of Conduct and Accountability
- Integrating Security into Corporate Governance
- Legal, Regulatory and Contractual Requirements
- Due Diligence, Due Care and Legal Liability
- Privacy and Data Protection Governance
- Governance Roles, the CISO and Reporting Lines
- The Security Steering Committee
- The Three Lines Model and Independent Assurance
- Aligning Security Strategy with Business Objectives
- Developing a Security Strategy and Roadmap
- Gaining and Keeping Executive Commitment
- Governing AI and Emerging Technology
- Security Frameworks Compared: NIST CSF, ISO 27001 and COBIT
- Selecting and Implementing a Framework
- Governance Models: BMIS and the Security Balanced Scorecard
- Resource Planning and Security Budgets
- Building a Business Case for Security Investment
- Demonstrating Value and Return on Security Investment
Ethics, Codes of Conduct and Accountability
Why ethics matters in security
Security managers see things others don’t: salaries, investigations, private messages, the weak spots in the business. They can read logs, block access and monitor activity. That power has to be used honestly and within the law. Ethics is what makes the rest of the organisation trust the security function, and trust is what lets it do its job.
The ISACA Code of Professional Ethics
Every CISM holder agrees to follow the ISACA Code of Professional Ethics. In summary, members:
- support good governance and controls, following standards and procedures
- act with diligence, objectivity and professional care
- serve stakeholders lawfully and with integrity, without discrediting the profession
- keep information private and confidential unless disclosure is legally required
- stay competent, and take on only work they can complete with the necessary skills
- inform appropriate parties of the results of their work, including significant facts
- support the professional education of stakeholders
Failing to comply can lead to an ISACA investigation and, ultimately, losing the certification.
The organisation’s own rules
Professional codes cover the individual. The organisation also needs its own rules for everybody:
| Document | Purpose |
|---|---|
| Code of conduct | Expected behaviour: honesty, conflicts of interest, handling confidential information |
| Acceptable use policy | What staff may and may not do with systems, email, internet and data |
| Acknowledgement | Signed when people join and reconfirmed periodically, proving they were told |
| Disciplinary process | Defined, fair and consistent, agreed with HR and legal |
What makes accountability real
Accountability means someone answers for an outcome. It needs every link in the chain:
- Clear expectations: people know the rules.
- Named owners: every asset, risk and control belongs to a person, not a department.
- Traceable actions: unique user IDs and logs show who did what. Shared accounts break this link.
- Review: someone independent checks.
- Fair consequences: applied consistently, including to senior staff.
Remember the difference: responsibility (doing the work) can be delegated; accountability (answering for the result) stays with the owner.
Ethical grey areas
Some security decisions touch privacy or employment law. Monitoring staff, investigating a suspected insider or reviewing personal devices all need a legal basis, a clear policy and HR and legal involvement.
Example. After a leak, a manager asks the CISO to quietly read one employee’s mailbox. The CISO checks that the acceptable use policy allows monitoring, involves HR and legal, documents the authorisation and limits the search to what the investigation needs.
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| What makes actions traceable to a person? | Unique user IDs plus logging |
| Best way to show staff were told the rules | Signed acknowledgement of policies |
| Can an owner delegate accountability? | No; only the work (responsibility) |
| A manager asks to monitor an employee | Check policy and law; involve HR and legal; document it |
| A CISM holder breaks the code of ethics | ISACA can investigate and revoke the certification |
In short
- CISM holders must follow the ISACA Code of Professional Ethics; breaching it can lead to losing the certification.
- A code of conduct and an acceptable use policy set clear expectations for everyone; staff should acknowledge them when they join and periodically after.
- Accountability needs clear expectations, named owners, traceable actions, review and fair consequences.
- Unique user IDs are what make actions traceable; shared accounts destroy accountability.
- Consequences must apply consistently, including to senior people, or the code loses credibility.
- Ethical dilemmas, such as monitoring staff, need legal and HR input and a documented basis.
Exam traps
- Responsibility can be delegated; accountability can't. The owner stays accountable even when someone else does the work.
- A code of conduct nobody has read or acknowledged doesn't create accountability.
- Ethics isn't only about not committing crimes: concealing a known risk from management is an ethical failure too.
- Monitoring employees without a legal basis and a clear policy can itself break laws and trust.
Slides
Click the slide and use the arrow keys. F toggles full screen.
What makes accountability real