A county CISO is pressured by a council member to hide a ransomware disclosure from the public dashboard while still telling staff that the office follows ISC2 ethics. Which action best aligns with the ISC2 Code of Professional Ethics?
Select an answer to reveal the explanation.
Short Explanation
Ethics here is like a hard hat on a construction site — it stays on even when someone important says it ruins the photo. Hiding a real ransomware event to please a council member breaks the duty to protect society and to act honorably. The clean move is honest disclosure, not creative silence.
Full Explanation
The ISC2 Code of Professional Ethics places protection of society, the common good, public trust, and critical infrastructure ahead of personal or political convenience. In a county ransomware scenario, required disclosure and honorable conduct are not optional branding; they are canons that bind the security leader even when a council member prefers quiet optics. Transparent, timely disclosure that meets legal and policy notice duties is therefore the action that actually aligns with the code, because it prioritizes residents' safety and confidence over election-cycle messaging.
Delaying dashboard updates until after an election subordinates public protection to political fallout management. That choice treats ethics as a campaign accessory rather than a standing duty and erodes the trust the canons exist to preserve. Issuing a vague 'systems maintenance' notice while briefing only the pressuring official is still concealment dressed as communication: it misleads the public about the nature of the event and creates a privileged information channel that conflicts with honest, responsible practice. Stripping ethics references from staff communications so the code cannot be cited against the office is openly anti-professional; it attempts to escape accountability by hiding the standard rather than meeting it.
Exam caveat: ISC2 ethics questions often tempt candidates with 'minimize panic' or 'protect leadership' rationales. On the exam, when society protection and honorable conduct conflict with organizational politics, choose the canons—not the quieter narrative.
Operational check: Confirm statutory and policy disclosure triggers, document the decision trail that favored required notice over political preference, brief elected officials on why suppression is unethical and legally risky, and ensure the public dashboard reflects accurate incident status rather than euphemisms.