Ethics, Code of Professional Conduct, and Program Integrity
The Ethics, Code of Professional Conduct, and Program Integrity domain tests whether you protect the credibility of the credential: honest representation, protected exam content, guarded confidential information, managed conflicts, and correct use of CMMC branding.
Core obligations
- Integrity and honesty: represent your credentials, your course, and the CMMC program accurately; never promise a pass, a certification, or an assessment outcome.
- Objectivity and conflicts of interest: disclose relationships with C3PAOs, vendors, or client organizations and recuse yourself where your judgment could be bought or appear bought.
- Confidentiality: protect learner records and any organizational information that surfaces in class; do not use client material in slides without written permission.
- Competence: teach within the authorized courseware and your demonstrated expertise; keep current as the model and rule change.
- Compliance: follow your training license, intellectual-property terms, and Cyber AB requirements.
Exam and credential integrity
Never request, memorize, reproduce, or coach to live exam items, and never endorse "brain dumps," leaked question sets, or unauthorized practice exams. Do not help anyone misrepresent test results, take a test for another person, or claim a credential they have not earned. If a learner discloses cheating or a colleague distributes protected content, report it through the proper channel rather than handling it informally.
Brand and claims
Do not state or imply that you, your course, or your organization is endorsed by DoD or the Cyber AB beyond the license you hold. Describe attendees as course completers, not as certified professionals, unless they independently earned the credential. Avoid unverifiable marketing such as guaranteed pass rates or "official" status, and use CMMC marks only as your license permits.
Worked example
A learner asks you to photograph the exam interface "just for the cohort," and a client later asks you to confirm in writing that their organization is "basically Level 2." Reasoning: both requests damage program integrity - the first compromises exam security, the second misrepresents certification authority you do not have. Response: decline clearly, explain why, offer the legitimate alternative (authorized practice material; a readiness review by a qualified provider), document the exchange, and escalate repeated pressure.
Traps that cost marks
- Sharing recalled exam questions as "study tips."
- Accepting gifts or favors from an organization whose staff you train or assess.
- Teaching outside your licensed courseware or claiming official affiliation.
- Using real client CUI in examples without authorization.
- Advertising guaranteed outcomes or inflated pass rates.