Topics in this domain
- Exam Technique: Thinking Like a Security Manager
- Security Governance vs Security Management
- Organisational Culture and Tone at the Top
- Ethics, Codes of Conduct and Accountability
- Integrating Security into Corporate Governance
- Legal, Regulatory and Contractual Requirements
- Due Diligence, Due Care and Legal Liability
- Privacy and Data Protection Governance
- Governance Roles, the CISO and Reporting Lines
- The Security Steering Committee
- The Three Lines Model and Independent Assurance
- Aligning Security Strategy with Business Objectives
- Developing a Security Strategy and Roadmap
- Gaining and Keeping Executive Commitment
- Governing AI and Emerging Technology
- Security Frameworks Compared: NIST CSF, ISO 27001 and COBIT
- Selecting and Implementing a Framework
- Governance Models: BMIS and the Security Balanced Scorecard
- Resource Planning and Security Budgets
- Building a Business Case for Security Investment
- Demonstrating Value and Return on Security Investment
Due Diligence, Due Care and Legal Liability
What does “reasonable” mean?
After a breach, regulators, courts and customers ask one question: did the organisation do what a reasonable, prudent organisation in its position would have done? Nobody expects perfect security. They expect sensible, documented effort proportionate to the risk. This expectation is called the standard of care, often summed up as the prudent person rule.
Due diligence vs due care
| Due diligence | Due care | |
|---|---|---|
| Meaning | Investigating and understanding risk | Acting reasonably on what you know |
| Question | Do we know what could go wrong? | Have we done something sensible about it? |
| Examples | Risk assessments, supplier assessments, security review of an acquisition target, ongoing monitoring | Implementing controls, patching known vulnerabilities, training staff, enforcing policy, fixing findings |
A simple way to remember it: diligence is discovering, care is doing. You need both. Knowing about a risk and doing nothing is worse than not knowing, because it shows the harm was foreseeable.
How liability arises
- Negligence: harm was foreseeable, a reasonable control existed, and the organisation didn’t use it.
- Breach of contract: security commitments in a customer contract weren’t kept.
- Regulatory penalties: required controls weren’t in place.
- Downstream liability: weak security in one organisation harmed others, for example attackers used a supplier’s network to reach its customers.
In many jurisdictions, directors and officers can face personal consequences if they ignored security duties. Some newer regulations, such as NIS2, make management bodies explicitly responsible for approving and overseeing cyber risk measures.
Proving you took care
Documentation turns good decisions into evidence:
- risk assessments showing risks were identified
- recorded decisions: who accepted which risk, why and until when
- policies, standards and evidence that controls actually operate
- supplier assessments before contracts and during them
- training records and incident response records
Following recognised frameworks (ISO 27001, NIST CSF, CIS Controls) and industry practice also helps show a reasonable standard of care.
Example. Two companies suffer the same ransomware attack. One can show a risk assessment, a board-approved plan to close the gap and progress reports. The other has nothing written down. Regulators and courts treat them very differently.
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| Assessing a supplier before signing | Due diligence |
| Implementing controls to address a known risk | Due care |
| Best protection against negligence claims | Documented, reasonable, risk-based decisions |
| The legal standard for security | What a prudent person would do (reasonable care) |
| Does outsourcing remove the duty of care? | No; due diligence and oversight are still required |
In short
- Due diligence is investigating and understanding risk; due care is acting reasonably on what you know.
- The legal test is usually what a prudent person in a similar organisation would have done: the standard of care.
- Negligence is failing to exercise due care when harm was foreseeable; it can create liability for the organisation and, sometimes, its directors.
- Documentation (risk assessments, decisions, approvals, evidence of controls) is how an organisation proves it exercised due care.
- Downstream liability arises when weak security at one organisation harms its customers or partners.
- Following recognised frameworks and industry practice helps show a reasonable standard of care.
Exam traps
- Due diligence = find out; due care = act. Exam options often swap them.
- Accepting a known risk without documentation looks like negligence, even if the decision was reasonable.
- Outsourcing doesn't remove the duty of care; you must still do due diligence on the supplier.
- Perfect security isn't the legal standard; reasonable security is.
Slides
Click the slide and use the arrow keys. F toggles full screen.
Due diligence vs due care