Let’s face it --- while CISSPs are bound to hold up the code of ethics, they aren’t always enforced to do so by legal organizations, and so their boundaries will vary with the environment.
An example: Jack is a CISSP, holding an executive position in a business-driven organization that offers IT Solutions & Services. Should Jack want to veto or implement any major process, the final decision falls to a board of directors. When presenting business cases with a cost-benefit and risk analysis, he has to keep in mind that the directors won't consider morality in place of money.
Assuming he can link his cases to other factors that impact the business --- say, legal implications --- he might get heads to turn; otherwise, no.
If he's too strong an advocate of ethics & it doesn't appeal to the directors, they may decide to let him go, & should this happen, there’s no guarantee he’ll be able to find a new post with equal / higher benefits.
Of course, he’ll probably have better luck if he's employed by (ISC)2
Before you ask to what level I stand up for ethics in my organization, let me tell you that it's in KSA... 
