Technical expertise may show cybersecurity professionals what they can do, but ethical and professional judgment helps them decide what they should do. ISC2 members explain how realistic case studies can prepare practitioners to navigate competing responsibilities, incomplete information and decisions without easy answers.
Cybersecurity professionals make decisions that can affect sensitive information, individual privacy, organizational resilience and public trust. Although policies, standards and regulations establish important boundaries, they cannot anticipate every situation a practitioner may encounter.
To help cybersecurity professionals navigate these complex situations, in 2025, ISC2 convened a member Task Force as part of its Code of Professional Conduct initiative. Task Force members contribute their experience and perspectives to various Code program resources, including the development of realistic case studies designed to help practitioners examine difficult decisions, challenge their assumptions and consider the consequences of their choices before facing similar pressures in the workplace.
Task Force members Jennifer Blacker, CISSP; Srija Reddy Allam, CISSP; Austin Orumwense, CC; and Bogdan Nedelcu, CISSP, shared what makes scenario-based learning valuable and what they hope other practitioners take from the experience. Their responses reveal a common theme: The most useful ethical questions rarely have simple answers.
Effective Ethics Scenarios Create Productive Discomfort
A valuable ethics scenario does not present an obvious hero, villain or correct answer. Instead, it asks practitioners to weigh legitimate but competing responsibilities and explain how they reached their decision.
“A good ethics scenario doesn’t hand you a villain and a hero,” said Jennifer Blacker, CISSP. “It hands you two people who both believe they’re doing the right thing, and lets you sit in that discomfort for a while.”
That discomfort reflects the reality cybersecurity professionals face. A practitioner might need to protect confidential information while considering public safety, support an organization while communicating risk honestly, or act quickly without having all the relevant facts. Several options may appear reasonable, but each can carry different consequences.
According to Austin Orumwense, CC, a scenario becomes useful when participants can understand why another professional might choose a different approach. Pressure to resolve an incident, incomplete information or differing interpretations of responsibility can all affect a decision. Explaining that decision to others can also reveal assumptions that might otherwise remain unexamined.
“A strong ethics scenario puts professionals in situations where the technically possible, the procedurally correct, and the ethically responsible course of action may not perfectly align,” said Bogdan Nedelcu, CISSP.
The goal, therefore, is not simply to identify the “correct” response. It is to examine the reasoning behind a choice, the interests affected by it and whether the decision can be justified.
Experienced Professionals Can Reach Different Conclusions
One of the most notable lessons from developing the case studies was how differently experienced, well-intentioned professionals could interpret the same situation
Participants often agreed on the principles involved but differed on how those principles should be applied or prioritized. Questions included how much evidence is needed before escalating a concern, when protecting the public may outweigh confidentiality and how long an organization should have to address a vulnerability before disclosure becomes necessary.
“What has surprised me most is how differently experienced and well-intentioned professionals can interpret the same situation,” said Srija Reddy Allam, CISSP. “Respectful disagreement is often where the most meaningful learning happens.”
These discussions demonstrate why ethical decision-making cannot always be reduced to applying a rule. Context, proportionality, potential harm and the interests of different stakeholders can all influence what a professional considers responsible.
The case studies create a structured environment in which practitioners can listen to other perspectives, test their own reasoning, and become more comfortable engaging in constructive disagreement. Consensus can be useful, but understanding why professionals reach different conclusions may be even more valuable.
Ethical Decisions Often Look Like Routine Work
Ethical dilemmas do not always announce themselves as extraordinary, high-stakes events. More often, they appear within ordinary technical and business decisions.
A professional may be asked to approve an architecture with unresolved security risks, delay the disclosure of a vulnerability, collect additional user information for monitoring or communicate about an incident before all the facts are known. These decisions may occur amid deadlines, outages, financial pressure or concerns about organizational reputation.
“Most ethical dilemmas in this field don’t arrive with sirens attached,” said Blacker. “They show up as a vague request to ‘just check’ something you weren’t authorized to touch, a finding someone asks you to soften in a report, a client relationship that makes you hesitate before flagging a gap.”
Security operations provide another example. An alert may justify an investigation, but practitioners must still consider what information they need to access and why. Access to messages or activity logs does not necessarily justify reviewing every available detail.
Professionals must also communicate findings carefully. Suspicious activity is not automatically proof of wrongdoing, and the language used in a report can affect how another person is treated. Scenario-based learning helps practitioners recognize these ethical dimensions before urgency, convenience or organizational pressure unduly influences their judgment.
Technical Ability Must Be Matched by Professional Judgment
Cybersecurity professionals regularly have privileged access to systems, communications, vulnerabilities and sensitive information. They may also recommend actions that affect an individual’s work, privacy or reputation.
“Technical skills tell you what’s possible. Ethical judgment tells you what’s warranted,” said Blacker. “A practitioner who can breach a system, pull data, or bypass a control without a strong internal compass is more dangerous with that skill, not less.”
A technically valid decision may still create avoidable harm, intrude unnecessarily on privacy or leave stakeholders without an honest account of the risk. Ethical judgment helps professionals decide when an action is justified, how far it should go and what safeguards should accompany it. This ability becomes particularly important as technology develops faster than policies and regulations. Artificial intelligence, autonomous agents and expanding uses of personal data can present situations for which detailed guidance does not yet exist. Practitioners must be prepared to apply established ethical principles even when no rule addresses the precise circumstances before them.
“Policies, standards, and regulations provide essential boundaries, but they cannot anticipate every situation a professional may encounter,” said Nedelcu. “Ethical judgment becomes particularly important in those grey areas, where there may be several technically or legally permissible options, but not all of them are equally responsible.”
Practicing How to Pause, Question and Speak Up
The purpose of an ethics case study is not to make every participant reach the same conclusion. It is to help practitioners develop a thoughtful and repeatable process for making decisions. That process begins by asking better questions:
- Who could be affected by this decision?
- Whose perspective might be missing?
- What professional responsibilities are in conflict?
- Is pressure influencing how the risk is being evaluated?
- Has the issue been communicated honestly?
- Have the right people been involved?
- Could the decision and its reasoning be clearly justified to others?
These questions encourage practitioners to move beyond their first instinct and identify consequences they might not initially have considered.
“I hope they walk away a little less certain, in a good way,” said Blacker. “Not paralyzed, just aware that the ‘obvious’ choice often carries a cost they hadn’t priced in yet.”
Case studies can also help professionals become more comfortable speaking up. Raising issues and ethical concerns does not necessarily mean stopping a project. It may mean pausing to clarify a risk, suggesting an alternative or making sure the person accepting the risk fully understands its potential consequences.
Access Is Not the Same as Entitlement
The contributors’ professional experiences also illustrate how ethical and professional judgment develops throughout a career.
For Reddy Allam, one enduring lesson is that remaining silent is itself a decision. Recognizing a concern privately is not enough. Professionals must communicate it in a way that can lead to informed action, whether that means being direct, listening first, building support or finding the appropriate audience.
“Ethical leadership is having the courage to speak up while still respecting the people involved,” she said. “We may not control the final decision, but we are responsible for making sure it is informed, honest and worthy of the trust placed in us.”
For Nedelcu, an equally important distinction is that access and authority should not be confused with entitlement. Having legitimate access to information does not automatically mean that accessing, using or sharing it is appropriate in every circumstance.
“Permissions define what you are allowed to do from a technical or organizational perspective,” he said. “Professional judgment determines what you actually need to do, for what purpose, and with what consequences.”
Together, these lessons show that cybersecurity ethics and professional conduct is not limited to compliance or extraordinary dilemmas. It is practiced through everyday decisions about access, disclosure, communication, proportionality and accountability.
Ethics in Practice case studies will begin to be published later this year.
Code of Professional Conduct Resources
The Code of Professional Conduct provides a shared ethical foundation to help cybersecurity professionals protect society, act responsibly and uphold the trust placed in the profession. Yet the Code is most effective when practitioners know how to apply its principles to the complex situations they encounter at work. If you are not already familiar with the Code, explore the Code of Professional Conduct, along with the supporting practice guides, Ethical Decision-Making Guide and Express Course, to strengthen your ethical judgment and put its principles into practice.
