ISC2-CC - Security Principles (26% of the exam) - Section 1.4

Understand the ISC2 Code of Ethics canons and the governance elements of policies, procedures, standards, regulations, and laws.

State the four mandatory canons of the ISC2 Code of Ethics in their order of precedence, beginning with protecting society and the common good. Distinguish the governance documents - policies (high-level intent), standards (mandatory specifics), procedures (step-by-step), and guidelines (recommended) - and recognise how regulations and laws impose external compliance obligations.

ISC2 Code of EthicsCanonsPolicies and proceduresStandardsGovernance

Practice question for this objective

Free sampleSecurity Principlesmedium

The ISC2 Code of Ethics is arranged around four canons that are listed in a deliberate order. When two of those canons appear to pull in different directions in a given situation, how are members expected to treat that ordering?

  • AThe canons are listed in order of precedence, so a canon nearer the top is intended to be resolved in favour of one appearing lower in the list. Correct
  • BThe canons carry equal weight, and any apparent conflict must be referred to ISC2 for a binding ruling before the member may act.
  • CThe canon a member cites first in any dispute automatically governs, because the member chooses which canon applies.
  • DThe last canon listed governs, on the principle that later provisions supersede earlier ones as in statutory interpretation.
The four ISC2 canons are ranked by priority, with protection of society taking precedence when canons conflict. ISC2 presents the four canons in a fixed order of precedence so that when duties collide, the higher-listed canon, beginning with protecting society and the common good, resolves the conflict rather than being weighed as an equal.

Why A is correct: ISC2 states the canons are ordered by priority, so protecting society and the common good ranks ahead of duties to principals or to individuals when they genuinely conflict.

Why B is wrong: Treating the four canons as equal is a common assumption, but ISC2 explicitly presents them in priority order, and there is no requirement to seek a binding ruling before acting.

Why C is wrong: Letting the member pick the governing canon sounds flexible, yet the ordering is fixed by ISC2, not selected case by case by the individual.

Why D is wrong: The last-in-time rule is borrowed from statutory drafting and does not apply here; the first canon, not the last, carries the highest priority.

See more ISC2-CC practice questions, answers explained.

Exam traps in Security Principles

Answers that look right on this material and are not. Each one is a distractor from a different question in the ISC2-CC bank for this domain.

  • A policy is a mandatory step-by-step set of instructions describing exactly how a specific task is to be carried out.

    Why it is wrong: Step-by-step task instructions describe a procedure, not a policy; the confusion arises because both can be mandatory, but a policy states intent rather than detailed steps.

  • The member should follow whichever canon best protects their current employer's commercial interests.

    Why it is wrong: Loyalty to an employer can feel like a professional duty, but the canons place protection of society and the profession above any single employer's commercial gain, so this misreads their purpose.

  • Protecting the personal loyalty owed to a colleague who helped Devi settle into the team

    Why it is wrong: Loyalty to a friend is a real human pressure, which is why it is tempting, but the canons place duty to society and the principals above personal relationships, so it cannot be the deciding factor.

Examworthy is not affiliated with or endorsed by ISC2. Original, blueprint-aligned practice material only.