Professional Conduct, Ethics, and Assessment Documentation
Conduct expectations
The Cyber AB's Code of Professional Conduct binds every credentialed individual. Core obligations: integrity and objectivity, competence within your scope, confidentiality, compliance with law and contract, accurate representation of credentials, and avoidance - including the appearance - of conflicts of interest.
The independence rule matters most in exam questions: a C3PAO or assessor may not consult on, design, or implement the controls it later assesses, and there is a defined cooling-off period before an organization it advised becomes an assessment client. Offering remediation help partway through an assessment is a conflict, not a courtesy.
Confidentiality extends to CUI: assessors use need-to-know access, store evidence securely, and return or destroy it per contract and NDA. Suspected ethical violations, loss of impartiality, or a CUI breach must be reported to The Cyber AB.
The documentation set
Know what each artifact is for:
- SSP - describes how every requirement is implemented, defines the boundary, and assigns responsibility. It is the backbone of the assessment, not an optional narrative.
- POA&M - identifies unmet requirements with milestones, resources, and completion dates; only permitted where the level's rules allow it.
- Asset inventory and network/data-flow diagrams - establish and defend scope.
- Assessment report and evidence records - the auditable record of what was examined, interviewed, and tested, retained per requirements.
Traps
"A CCP may sign the report" (false). "Assessors may accept verbal assurance without evidence" (false). "The SSP is only needed at Level 3" (false). "Findings can be quietly dropped if the client disagrees" (false - disagreements go through the defined challenge/appeal path).
Rule of thumb
If an action would make the assessor part of the solution, it violates independence. If it would leave no reproducible evidence behind, it violates documentation requirements.