Governance, Compliance, and Professional Ethics
The document hierarchy
A policy is management's mandatory statement of intent - high-level, rarely technical, and slow to change. Standards are mandatory specifics (AES-256, 12-character minimum). Procedures are step-by-step instructions for a task. Guidelines are recommended, non-binding advice. Baselines are the minimum secure configuration applied to a system class. A common trap is calling a technical specification a "policy".
Roles and accountability
The board and senior management own risk and are ultimately accountable. Data owners (business managers) classify data and approve access; data custodians/stewards implement and maintain controls; users comply. The CISO advises and operates the program but usually does not own the data. Tasks can be delegated; accountability cannot.
Due care vs due diligence
Due care is doing what a reasonable, prudent organization would do - acting on identified risk. Due diligence is the ongoing effort of verifying, assessing and monitoring. An audit or risk assessment is diligence; implementing the resulting fix is care.
Compliance and ethics
Know the shape of major regimes: GDPR (EU personal data, breach notification), HIPAA (US health data), SOX (financial reporting controls), PCI DSS (card data - contractual, not law), ISO/IEC 27001 (certifiable ISMS). Ethics codes such as ISC2 and ISACA put public safety and the profession first. Disclose conflicts of interest and recuse yourself; stay within authorization and competence; escalate concerns internally before any external disclosure.
Worked example
You find a colleague storing customer data on a personal cloud drive. This is not a debate about policy interpretation: a standard is violated and real risk exists. Report through the chain of command, preserve evidence, and do not quietly delete or "fix" the data yourself.