CertiGuide to Security+  9  Chapter 5:  Operational/Organizational Security (Domain 5.0; 15%)       9  5.4  Policy and Procedures            9  5.4.1  Security Policy                 9  5.4.1.9  HR (Human Resources) Policy

5.4.1.9.2  Hiring 1 5.4.2  Incident Response Policy

While there is no industry-wide code of ethics to which all computer security professionals must subscribe, several associations have created their own codes of ethics for members, with the aim of promoting certain standards of behavior.

The Information System Security Association⁴⁴¹ is a non-profit organization for security professionals. The association has a code of ethics for its members and looks like good guidelines for anyone working in the computer industry.

The code of ethics from ISSA:

• Perform all professional activities and duties in accordance with the law and the highest ethical principles.
  
  
• Promote good information security concepts and practices.
  
  
• Maintain the confidentiality of all proprietary or otherwise sensitive information encountered in the course of professional activities.
  
  
• Discharge professional responsibilities with diligence and honesty.
  
  
• Refrain from any activities which might constitute a conflict of interest or otherwise damage the reputation of employers, the information security profession, or the Association.
  
  
• Not intentionally injure or impugn the professional reputation or practice of colleagues, clients, or employers.

The International Information Systems Security Certification Consortium (ISC)2 also sets forth a more involved Code of Ethics⁴⁴² to be followed by computer security professionals.

5.4.1.9.2  Hiring 1 5.4.2  Incident Response Policy