A city HR director wants security staff to sign only the municipal employee handbook and skip any security-specific ethics acknowledgment. Why should leadership still require an organizational security code of ethics?
Select an answer to reveal the explanation.
Short Explanation
A city handbook is the employee rulebook for payroll and leave — useful, but it does not spell out how a security pro should handle conflicted findings or sensitive data. A security ethics code is the extra playbook for those gray-area moments. Skipping it leaves staff guessing when loyalty and duty collide.
Full Explanation
An organizational security code of ethics does work that a generic municipal employee handbook rarely covers. Handbooks typically address leave, conduct, harassment, and employment rules; they seldom define how security professionals should handle conflicts of interest, unauthorized disclosure pressure, competent practice expectations, or duties to protect sensitive civic data. Requiring a security-specific ethics acknowledgment reinforces expected security behavior and professional conduct beyond those generic employment rules, giving staff a shared reference when loyalty to a supervisor conflicts with duty to the public.
Assuming the handbook already lists every technical control and therefore makes ethics redundant confuses controls catalogs with behavioral standards. Technical baselines do not tell an analyst whether to soft-pedal a finding or whether to respect licensing and privacy obligations under pressure. Treating ISC2 membership as an automatic replacement for any local ethics document is also incorrect: professional membership can inform expectations, but city employees still need organizational clarity that applies to non-members and to local context. Waiting until after a breach investigation to collect ethics acknowledgments inverts the purpose of ethics—prevention and guidance before crisis, not paperwork after failure.
Exam caveat: CISSP governance items often contrast broad HR policy with security-specific governance artifacts. Choose the answer that adds professional security conduct expectations, not the one that claims a payroll handbook is sufficient.
Operational check: Publish a concise security ethics code, require acknowledgment at hire and annually, map it to incident and conflict-of-interest procedures, and verify through training scenarios that staff can apply it when political or vendor pressure appears.