Professional Practice and Ethics
This domain tests judgement under ambiguity: scope, authorization, confidentiality, conflicts of interest, and disclosure. Answers are graded on the process you follow, not only the technical outcome.
Core duties
- Written authorization and defined scope before any testing. Rules of engagement, named targets, excluded systems, emergency contacts, and a signed get-out-of-jail letter.
- Competence: accept only work within your skill set and disclose limits rather than improvising on critical systems.
- Confidentiality and data minimisation: collect only what the engagement needs, encrypt it, delete it per contract.
- Conflicts of interest: disclose them, recuse where required, and refuse payment structures tied to findings.
- Honest reporting: state findings, severity, and limitations; never suppress or inflate.
- Responsible disclosure: coordinate with the vendor, agree a remediation timeline (90 days is common), and hold public detail until a fix is available.
Codes of ethics
ISC2 canons: protect society and infrastructure; act honorably, honestly, justly, responsibly, and legally; provide diligent and competent service; advance and protect the profession. Other bodies impose equivalent duties.
Worked example
You are authorized to test one client tenant on a shared SaaS platform. During testing you discover an authorization flaw in the platform itself that affects other tenants. Reasoning: do not pivot into other tenants - that is out of scope and likely unlawful. Document the flaw using your own single test account as minimal proof. Report to the client immediately, offer to coordinate disclosure with the vendor under written permission, keep evidence encrypted, and publish nothing until a fix or agreed timeline exists.
Traps
Verbal scope approval; scope creep justified by curiosity; testing with real customer data; disclosing before remediation; hiding an embarrassing finding; claiming certifications or clearances you do not hold.