GOV-04Governance and Accountability
Code of conduct and ethics affirmation
Expected conduct is published and affirmed by staff on joining and annually.
Why it exists
Culture is what people affirm and what leadership enforces.
What usually proves it
Code of conduct, affirmation records, disciplinary process.
Smaller organizations
Signed on joining, re-affirmed each year at review time.
Mapped to
- Fully addressedSOC 2 Trust Services Criteria · CC1.1
- Partially addressedISO/IEC 27001 Annex A · A.6.2 — Covered through terms of employment rather than a separate code.
- Partially addressedNIST Cybersecurity Framework · GV.RR-04 — Addressed through workforce expectations.
- Partially addressedPCI DSS · 12.6 — Framed as security awareness acknowledgement.
- Fully addressedHIPAA Security Rule · 164.308(a)(1)(ii)(C)
- Deliberately absentGDPR — No conduct code obligation; confidentiality of processing staff is required under Art. 28(3)(b) instead.
- Partially addressedEU AI Act · Art. 4 — AI literacy duty touches conduct without a code.
- Fully addressedNIST AI Risk Management Framework · GOVERN 3.2