Last updated:
CISSP decision trap
How do due care and due diligence differ for CISSP?
Direct answer
Due diligence is the investigation and oversight that tells an organization what reasonable protection requires and whether it is still working: risk assessments, supplier reviews, audits and monitoring. Due care is acting on that knowledge: putting reasonable protections in place and keeping them running. A short way to remember it: diligence is knowing, care is doing. CISSP scenarios often contain both, so work out which one the question asks about.
due care and due diligence: a practical decision framework
| Check | How to use it |
|---|---|
| Objective | Ask whether the scenario describes reasonable action or the sustained process that informs and checks that action. |
| First move | identify the protective decision and the evidence-gathering or oversight activity around it |
| Common trap | Treating the terms as interchangeable or reducing either one to a single security control. |
due care and due diligence in practice
A board approves a security program based on assessed risk, while management regularly reviews metrics, supplier performance, changes, and control effectiveness.
Approving reasonable protection demonstrates care; maintaining investigation and oversight demonstrates diligence. The scenario can contain both at different levels.
Due care and due diligence side by side
Diligence produces knowledge and oversight; care turns it into protection.
- Suppliers: assessing a vendor's controls before signing is diligence; requiring and enforcing the contract's security terms is care.
- Patching: tracking new vulnerabilities and checking exposure is diligence; applying the patches on time is care.
- Acquisitions: investigating a target company's security before buying it is diligence.
How the terms appear in exam questions
A question usually describes an activity and asks which duty it shows, or what a prudent organization should do next.
Look at the verb. Assess, review, investigate, audit and monitor point to diligence. Implement, enforce, train and maintain point to care. The ISC2 CISSP outline lists due care and due diligence together under Domain 1, objective 1.3, security governance principles.
The common mistake: treating one control as the whole duty
Neither term means a single control, and neither is finished after one action.
A distractor may call one firewall rule or one audit due care. Both duties continue: diligence keeps checking after the program starts, and care has to keep pace with what diligence finds.
Check the rule on a changed scenario
Change one fact and decide whether the activity becomes diligence or care.
- The board reviews a risk assessment, then funds the controls it recommends: the review is diligence; funding the controls is care.
- An organization never assessed a supplier that later leaked data: the failure was diligence.
- A breach follows a weakness the organization knew about and left unfixed: it knew, so diligence was done, but it did not act, so care failed.
Sources and fact check
Source checked: 2026-10-26
- CertArc is an independent exam-preparation platform and is not affiliated with or endorsed by ISC2.
- CertArc uses original practice questions, not live or recalled exam items, and does not reproduce the CISSP CAT algorithm.
- Practice performance is study evidence, not a pass prediction or guarantee.
Frequently asked questions
How do due care and due diligence differ for CISSP?
Due diligence is the investigation and oversight that tells an organization what reasonable protection requires and whether it is still working: risk assessments, supplier reviews, audits and monitoring. Due care is acting on that knowledge: putting reasonable protections in place and keeping them running. A short way to remember it: diligence is knowing, care is doing. CISSP scenarios often contain both, so work out which one the question asks about.
What is an example of due care?
Applying security patches on schedule, enforcing access controls, training staff and keeping backups working: reasonable protective actions that an organization keeps doing.
What is an example of due diligence?
Assessing a supplier before signing, running risk assessments, auditing controls and monitoring whether policies are followed: the work that tells an organization what protection it needs and whether it works.
Which comes first, due diligence or due care?
Usually diligence, because you need to understand the risk before choosing a reasonable response. Both then continue: diligence keeps checking, and care keeps acting on what it finds.
Where are due care and due diligence in the CISSP outline?
In Domain 1, Security and Risk Management, under objective 1.3, security governance principles, in the outline effective 15 April 2024.
