ISC2-CC - Security Principles - Section 1.4

Understand the ISC2 Code of Ethics canons and the governance elements of policies, procedures, standards, regulations, and laws.

State the four mandatory canons of the ISC2 Code of Ethics in their order of precedence, beginning with protecting society and the common good. Distinguish the governance documents - policies (high-level intent), standards (mandatory specifics), procedures (step-by-step), and guidelines (recommended) - and recognise how regulations and laws impose external compliance obligations.

ISC2 Code of EthicsCanonsPolicies and proceduresStandardsGovernance

Practice question for this objective

Free sampleSecurity Principlesmedium

The ISC2 Code of Ethics is arranged around four canons that are listed in a deliberate order. When two of those canons appear to pull in different directions in a given situation, how are members expected to treat that ordering?

  • AThe canons are listed in order of precedence, so a canon nearer the top is intended to be resolved in favour of one appearing lower in the list. Correct
  • BThe canons carry equal weight, and any apparent conflict must be referred to ISC2 for a binding ruling before the member may act.
  • CThe canon a member cites first in any dispute automatically governs, because the member chooses which canon applies.
  • DThe last canon listed governs, on the principle that later provisions supersede earlier ones as in statutory interpretation.
The four ISC2 canons are ranked by priority, with protection of society taking precedence when canons conflict. ISC2 presents the four canons in a fixed order of precedence so that when duties collide, the higher-listed canon, beginning with protecting society and the common good, resolves the conflict rather than being weighed as an equal.

Why A is correct: ISC2 states the canons are ordered by priority, so protecting society and the common good ranks ahead of duties to principals or to individuals when they genuinely conflict.

Why B is wrong: Treating the four canons as equal is a common assumption, but ISC2 explicitly presents them in priority order, and there is no requirement to seek a binding ruling before acting.

Why C is wrong: Letting the member pick the governing canon sounds flexible, yet the ordering is fixed by ISC2, not selected case by case by the individual.

Why D is wrong: The last-in-time rule is borrowed from statutory drafting and does not apply here; the first canon, not the last, carries the highest priority.

See more ISC2-CC practice questions with worked answers.

More in this domain

Back to all Security Principles objectives, or the ISC2-CC cert hub.

Examworthy is not affiliated with or endorsed by ISC2. Original, blueprint-aligned practice material only.