What it means
Due care is visible in decisions such as implementing safeguards, assigning responsibility, and responding to known weaknesses. Due diligence is the sustained work of monitoring, reviewing, testing, and updating those safeguards as conditions change.
Why it matters
Organizations need both action and continuing attention. A control that was reasonable two years ago may no longer address the current system, threat, or legal environment.
Practical focus
- Document material risk decisions and ownership
- Review whether controls still operate as intended
- Act on known high-impact weaknesses
- Retain evidence of review, testing, and follow-through
Common mistakes
- Assuming a purchased tool proves responsible practice
- Ignoring known exceptions because a policy exists
- Treating diligence as a one-time assessment
Certification relevance
This subject appears in or supports the following certification bodies of knowledge: