Domain 1 · Objective reference 1.5 · Chapter 5 of 19
Professional ethics, due care and due diligence
About 5 minutes · ISC2 CC outline effective 1 September 2026
Session only. Enable saving or download a backup from this course’s hub.
Completion is self-reported and does not certify understanding.
See it · Try it · Recall it
Picture the topic
Remember this: Diligence investigates; care acts prudently.
Explore the anchors
Investigate obligations and exposure.
Concept matching activity
Match this task or description to its concept:
Take reasonable protective action.
Choose a concept before checking the explanation.
A quick way to study this topic
- Hide the explanation and redraw these three anchors from memory.
- Explain the difference between the anchors in your own words.
- Apply the distinction to the worked example below. Check the full lesson for assumptions and exceptions.
- Recall it again tomorrow, then after a few days. A memory hint is a retrieval cue, not a replacement for understanding.
Original academy illustrations and fictional exercises. These are learning simulations, not a real virtual machine, network assessment or measure of job readiness. Activities reset when you leave or reload; they do not change quiz scores.
What this chapter explains
- Distinguish prudent action from investigation
- Apply ethics when the answer is inconvenient
Distinguish prudent action from investigation
Due diligence involves the inquiry and evaluation needed to understand responsibilities and exposure. Due care involves acting prudently on that understanding. Before using a supplier, evaluating security and data handling is diligence; applying the agreed safeguards and monitoring the relationship supports care. These concepts work together and should not be reduced to a universal rule about which word always comes first in an exam question.
Professional conduct includes protecting people and legitimate interests, acting honestly and lawfully, performing work competently and supporting the profession. Consult the actual ISC2 Code of Ethics for its authoritative wording. A job title or certification does not authorize activity outside a contract, policy or delegated role.
Apply ethics when the answer is inconvenient
Use only authorized systems and evidence. Do not test an unrelated service because it appears technically reachable. Do not upload confidential workplace records to an unapproved AI tool to improve a report. Describe findings and uncertainty accurately, including limitations that weaken your preferred recommendation. If you lack the competence or authority needed for a decision, escalate or seek appropriate support rather than concealing that limitation.
A conflict of interest should be disclosed through the approved process. An assessor who also designed a control may provide useful internal review, but should not represent that work as independent assurance. Preserve evidence responsibly and share only what the recipient needs for the authorized purpose.
Worked example
An analyst finds an exposed document on an approved test system. They record the minimum evidence needed, stop before collecting unrelated personal records and report through the agreed contact. They do not publish the document as proof of their skill.
Check your understanding
An executive asks you to remove a confirmed material finding because it may delay a launch. How should you respond?
Show explanation
Preserve an accurate record, explain the consequence and use the authorized escalation and risk-decision process. Leadership may make an informed decision within its authority, but that does not justify falsifying the assessment.
Source and study boundary
Official syllabus source. The reference identifies the topic being taught. Explanations and examples are original academy material; a topic link does not establish independent approval or sufficient exam mastery.