I have been going back and forth on this heavily, but two weeks ago I reached out to ISC2 and ISACA’s ethics boards to begin exploring the process of terminating the certifications of several FB employees that potentially (let me emphasize 110% blameless until proven otherwise) have been in violation of the ethics code for both of those orgs.

I asked ISC2 in particular that if a certain employee was shown to be on XYZ team that handled XYZ task, if they had say ignored multiple outreaches from the community, and then also (this is key) not raised concerns internally to a reasonable degree that a single individual can in a megacorp...could their say CISSP be revoked. The answer I got was a strong yes in the hypothetical stories I proposed.

I also emphasized that I would be writing an apology to said employee, and offer to resign / terminate my CISSP/CCSP if wrong because we have to prevent this process from becoming a no-lose vindictive game.