2 Professionalism in IT Practice

Professional responsibilities

Professionalism in IT means using technical knowledge responsibly, treating people fairly, communicating clearly, and following appropriate rules and procedures. A professional’s choices affect systems as well as the people whose work, privacy, and safety depend on them. Professional codes, such as the ACM Code of Ethics, provide principles for careful judgment; they do not automatically answer every situation.

Conduct and authorization

Professional conduct includes acting honestly, reliably, and respectfully. Represent your skills and the status of your work accurately, acknowledge mistakes, and correct them promptly. Do not claim another person’s work as your own, access systems or information without authorization, or use workplace resources for improper personal gain. Treat users and colleagues fairly, without harassment or discrimination.

If a task is outside your competence or authority, explain the limitation and seek appropriate support instead of guessing or concealing uncertainty. Respect agreed procedures even when someone asks you to bypass them for convenience. For example, if a user asks you to bypass an access control to save time, explain the risk, offer an approved route to restore access, and escalate if the request involves pressure to violate policy.

Clear communication and handoffs

Good IT communication is clear, timely, accurate, and suited to the audience. Listen without interrupting, ask questions to confirm the issue, and explain technical terms in plain language. Avoid blame by focusing on what happened, what is known, and what happens next. Do not promise a fix or deadline unless you have evidence to support it.

For example, instead of saying, “The network is broken,” say: “The office network is unavailable for some people. I’m checking the connection and will update you by 2 p.m., even if the issue is not yet resolved.” This sets expectations without overstating certainty.

When handing work to a colleague, provide a concise handoff that includes symptoms, checks already completed, relevant timestamps, current impact, and the next agreed action. During an incident, follow the organization’s communication and escalation process.

Confidentiality and privacy

Confidential information may include passwords, personal data, customer records, internal messages, financial details, and nonpublic business information. Protect it from unauthorized access, use, or disclosure. Share only what is needed, only with people authorized to receive it, and through approved channels. Check recipients before sending messages or files, avoid discussing sensitive matters where others can overhear, and secure devices and records when unattended.

Confidentiality means preserving authorized restrictions on information access and disclosure, including protections for personal and proprietary information. It does not justify ignoring a suspected threat, privacy breach, or other serious violation. Do not investigate or disclose sensitive information beyond your authority. Preserve relevant facts and report concerns through the organization’s designated channel, seeking guidance from a supervisor, privacy or security lead, or other appropriate authority. Disclosure may be limited by law and organizational rules, so follow the applicable process rather than making an informal disclosure yourself.

A process for ethical judgment

When a request or situation feels questionable, pause and work through it systematically:

1. Clarify the facts: Identify what is known, what is uncertain, and who may be affected.

2. Identify obligations: Consider authorization, organizational policy, applicable law, privacy, safety, and professional standards.

3. Consider options and consequences: Ask whether an action could expose data, cause harm, mislead someone, or unfairly disadvantage a person or group.

4. Seek advice: Consult an appropriate supervisor or specialist when the issue is unclear, high-impact, or outside your authority.

5. Act and document appropriately: Use approved procedures, communicate relevant information, and record decisions factually in authorized systems.

For example, if a colleague asks you to look up a customer’s account for a personal reason, do not access it. Explain that access must be work-related and authorized, and report repeated or concerning requests through the proper channel. Professional codes emphasize privacy, honesty, responsible conduct, and protecting people from harm.

Applying professional principles

Responsible IT practice brings together integrity, respect, clear communication, confidentiality, and sound judgment. Listen carefully, explain what you know without overpromising, protect information, respect authorization, and use formal channels when concerns arise. When a situation is uncertain, pause, consider who could be affected, consult the right people, and follow approved procedures.