thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Commonly confused · Governance, Risk, Audit & Privacy

Due Care vs Due Diligence: What's the Difference?

Due diligence is the research, planning, and ongoing investigation needed to understand risks and decide on appropriate protections. Due care is actually doing what a reasonable person would do to protect assets, such as implementing and maintaining those controls.

vs

Due Diligence

Full definition
Due CareDue Diligence
NatureAction, doing the right thingInvestigation, knowing the right thing
QuestionDid we act responsibly?Did we research and verify properly?
ExamplesPatching systems, enforcing policies, training staffRisk assessments, vendor reviews, audits, background research
Legal significanceFailure can be negligenceFailure means decisions were uninformed
OrderImplements what diligence identifiedPrecedes and continues alongside due care
Remember it

Due diligence is doing your homework; due care is doing the work.

Exam tip

CISSP frames due care as the prudent person rule. A vendor security assessment before signing a contract is due diligence; enforcing a security policy is due care.

Tested on

More Governance, Risk, Audit & Privacy look-alikes