Ethical principles and normative regulation of professional activity in cybersecurity: international standards, Ukrainian context, and practical guidelines

Abstract

This paper explores the ethical foundations and legal regulation of professional activity in cybersecurity amid digital transformation. The authors emphasize the growing importance of digital trust and moral responsibility in the daily work of cybersecurity professionals. A comparative analysis of European, American, and Ukrainian frameworks (including GDPR, ACM and (ISC)² Codes of Ethics, ENISA recommendations, and Ukrainian legislation) identifies key normative anchors and ethical principles. The study highlights complex dilemmas such as the boundary between privacy and surveillance, ethical vulnerability disclosure, and the role of cybersecurity experts during cyber conflicts. Attention is given to the need for professional certification standards to include ethical components, as well as the integration of ethics into organizational policies, audit procedures, and education. The paper proposes practical guidelines for ethical auditing, internal policy-making, and protection of responsible researchers. Recommendations are also made for harmonizing Ukrainian regulations with international ethical standards and for developing a national code of ethics. This research contributes to the development of a professional cybersecurity culture based on responsibility, transparency, and digital rights. The results are applicable in academic curricula, policy design, and industry governance.