Code of Ethics and Professional Conduct
Professional Responsibilities
A computing professional should...
1. Strive to achieve high quality in both the processes and products of professional work.
Computing professionals should insist on and support high quality work from themselves and
from colleagues. The dignity of employers, employees, colleagues, clients, users, and anyone
else affected either directly or indirectly by the work should be respected throughout the
process. Computing professionals should respect the right of those involved to transparent
communication about the project. Professionals should be cognizant of any serious negative
consequences affecting any stakeholder that may result from poor quality work and should
resist inducements to neglect this responsibility.
2. Maintain high standards of professional competence, conduct, and ethical practice.
High quality computing depends on individuals and teams who take personal and group
responsibility for acquiring and maintaining professional competence. Professional competence
starts with technical knowledge and with awareness of the social context in which their work
may be deployed. Professional competence also requires skill in communication, in reflective
analysis, and in recognizing and navigating ethical challenges. Upgrading skills should be an
ongoing process and might include independent study, attending conferences or seminars, and
other informal or formal education. Professional organizations and employers should encourage
and facilitate these activities.
3. Know and respect existing rules pertaining to professional work.
"Rules" here include local, regional, national, and international laws and regulations, as well as
any policies and procedures of the organizations to which the professional belongs. Computing
professionals must abide by these rules unless there is a compelling ethical justification to do
otherwise. Rules that are judged unethical should be challenged. A rule may be unethical when
it has an inadequate moral basis or causes recognizable harm. A computing professional should
consider challenging the rule through existing channels before violating the rule. A computing
professional who decides to violate a rule because it is unethical, or for any other reason, must
consider potential consequences and accept responsibility for that action.
4. Accept and provide appropriate professional review.
High quality professional work in computing depends on professional review at all stages.
Whenever appropriate, computing professionals should seek and utilize peer and stakeholder
review. Computing professionals should also provide constructive, critical reviews of others'
work.
5. Give comprehensive and thorough evaluations of computer systems and their impacts, including analysis of possible risks.
Computing professionals are in a position of trust, and therefore have a special responsibility to
provide objective, credible evaluations and testimony to employers, employees, clients, users,
and the public. Computing professionals should strive to be perceptive, thorough, and objective
when evaluating, recommending, and presenting system descriptions and alternatives.
Extraordinary care should be taken to identify and mitigate potential risks in machine learning
systems. A system for which future risks cannot be reliably predicted requires frequent
reassessment of risk as the system evolves in use, or it should not be deployed. Any issues that
might result in major risk must be reported to appropriate parties.
6. Perform work only in areas of competence.
A computing professional is responsible for evaluating potential work assignments. This
includes evaluating the work's feasibility and advisability, and making a judgment about whether
the work assignment is within the professional's areas of competence. If at any time before or
during the work assignment the professional identifies a lack of a necessary expertise, they
must disclose this to the employer or client. The client or employer may decide to pursue the
assignment with the professional after additional time to acquire the necessary competencies, to
pursue the assignment with someone else who has the required expertise, or to forgo the
assignment. A computing professional's ethical judgment should be the final guide in deciding
whether to work on the assignment.
7. Foster public awareness and understanding of computing, related technologies, and their consequences.
As appropriate to the context and one's abilities, computing professionals should share
technical knowledge with the public, foster awareness of computing, and encourage
understanding of computing. These communications with the public should be clear, respectful,
and welcoming. Important issues include the impacts of computer systems, their limitations,
their vulnerabilities, and the opportunities that they present. Additionally, a computing
professional should respectfully address inaccurate or misleading information related to
computing.
8. Access computing and communication resources only when authorized or when compelled by the public good.
Individuals and organizations have the right to restrict access to their systems and data so long
as the restrictions are consistent with other principles in the Code. Consequently, computing
professionals should not access another's computer system, software, or data without a
reasonable belief that such an action would be authorized or a compelling belief that it is
consistent with the public good. A system being publicly accessible is not sufficient grounds on
its own to imply authorization. Under exceptional circumstances a computing professional may
use unauthorized access to disrupt or inhibit the functioning of malicious systems; extraordinary
precautions must be taken in these instances to avoid harm to others.
9. Design and implement systems that are robustly and usably secure.
Breaches of computer security cause harm. Robust security should be a primary consideration
when designing and implementing systems. Computing professionals should perform due
diligence to ensure the system functions as intended, and take appropriate action to secure
resources against accidental and intentional misuse, modification, and denial of service. As
threats can arise and change after a system is deployed, computing professionals should
integrate mitigation techniques and policies, such as monitoring, patching, and vulnerability
reporting. Computing professionals should also take steps to ensure parties affected by data
breaches are notified in a timely and clear manner, providing appropriate guidance and
remediation.
To ensure the system achieves its intended purpose, security features should be designed to be
as intuitive and easy to use as possible. Computing professionals should discourage security
precautions that are too confusing, are situationally inappropriate, or otherwise inhibit legitimate
use.
In cases where misuse or harm are predictable or unavoidable, the best option may be to not
implement the system.