17th December 2025 | The UK Cyber Security Council

Cyber security professionals operate in a rapidly changing environment. It is essential that they have the relevant skills, expertise, and ethical judgement to undertake their roles effectively.

To become professionally registered, individuals are required to commit to a code of ethics (our Ethical Principles for Individuals) that demonstrates their commitment to promote credibility, integrity and professionalism in everything they do.

In November 2025, we consulted on several minor updates to the Principles. The updates were designed to expand on, and provide clarification around a number of key points.

Below, you can find our full and updated code of ethics for cyber security professionals.

🔗 If you’d like to dive into the changes in more detail, you can also view a document here which breaks down the updates and the rationale behind them.

If you have any questions about these updates, please feel free to get in touch and if you’d like to find out more about joining the UK Cyber Security Professional register, take a look here.

Updated Code of Ethics for Individuals

We require individuals to whom we award professional titles to commit to:

Professionalism  

I will conduct myself in a professional and respectful manner, being thoughtful with my actions and language

I will act with objectivity and fairness, and treat others with dignity and respect

I will represent the profession well and consider the impact of my actions on individuals, society, and the profession

I will offer constructive guidance where appropriate

Fair Business Practices 

I will not make false or misleading comparisons with other providers when carrying out my business

I will not misrepresent the functionality of products or staff of my own organisation or my competitors

I will not engage in fraudulent or anticompetitive practices, and I will challenge and report such if I witness them

I will be transparent with clients and act in their interest while upholding my responsibilities to my employer, my profession and society

Honesty 

I will balance the need for honesty and confidentiality and neither inappropriately conceal nor reveal information

Only when required for a legitimate cyber security purpose will I mislead others

I will challenge inappropriate dishonesty where I see it

Inclusion  

I will treat people equitably and judge them by their actions, competence, and character, not their immutable characteristics

I will respect the diversity of the cyber security profession, showing consideration, respect, and support for others

I will challenge discrimination, exclusion and disrespectful behaviour when I witness it

Integrity  

I will be accountable for my actions

I will be objective and handle conflicts of interest with objectivity and integrity

I will not cause wilful or negligent detriment to people, organisations, or systems

Lawful Behaviour 

I will comply with applicable laws, legislation, and regulations and seek advice when I am unsure how to do so

Competence  

I will maintain and grow my knowledge, skills, and competence

I will be honest about my knowledge, skills, and not misrepresent my competence, especially where it could put others at risk

I will seek guidance and support where I need it, especially when trying new things

Reporting  

I will practice responsible reporting* to appropriate authorities when cyber security risks, vulnerabilities and threats are identified; or when unlawful activity is witnessed or suspected

I will report breaches of these Principles by other registered cyber security professionals to the UK Cyber Security Council

I will support others to responsibly report, and will contribute to an environment where people feel able to report concerns

*Responsible reporting is timely, accurate, and proportionate reporting in good faith to the appropriate authorities. 