Code of Professional Conduct and Ethics
Domain 4 - Code of Professional Conduct and Ethics
This domain tests judgment. The Cyber AB Code of Professional Conduct binds every credentialed individual and accredited organization, and the exam presents realistic pressure scenarios: a client who wants a favorable result, a schedule that rewards shortcuts, and evidence that is inconvenient.
Core obligations
- Integrity and honesty: no false statements, no altered or fabricated evidence, no misleading marketing.
- Objectivity and independence: do not assess your own work; disclose and avoid conflicts of interest.
- Confidentiality: protect CUI, SSPs, assessment evidence, and client information; do not reuse a client's documents without authorization.
- Competence: work within your credential's scope, keep current through continuing education, and decline work you cannot perform properly.
- Compliance and cooperation: follow applicable laws and program rules, cooperate with Cyber AB inquiries, and report known violations.
- No improper influence: refuse gifts, bonuses, or favors tied to outcomes; refuse to let a client dictate findings.
Credential boundaries
An RP is not an assessor. Describing yourself as a CMMC assessor, implying DoD endorsement, or offering to "certify" a client misrepresents your credential and misleads the public. Likewise, an assessor may not consult for an organization and later assess it within the conflict-of-interest period defined by the Cyber AB.
Worked example
A client's program manager offers a $20,000 bonus if the readiness review concludes "assessment-ready" by Friday, and asks the RP to remove two failing findings from the report. The correct response: decline the bonus and the deletion; report findings accurately; explain that the OSC can address gaps through remediation or an eligible POA&M. Removing findings would falsify a professional opinion, could lead the client into a failed assessment, and would be reportable to the Cyber AB.
Enforcement
The Cyber AB can investigate complaints and impose sanctions, up to suspension or revocation of credentials and removal of accreditation. "Everyone does it" is not a defense, and silence about a known violation can itself be a violation.
Traps
- Treating ethics as a soft topic: items hinge on specific prohibited acts, not general values.
- Assuming client pressure excuses a misleading deliverable.
- Confusing "confidential" with "I can share it with my other clients."
- Believing the ethics rules apply only to assessors, not to RPs and consultants.