Due Diligence vs Due Care Explained for the Security+ Exam

Due diligence and due care are a matched pair, and the exam almost always presents them together so you can pick the wrong one. The distinction is simple once you have it: due diligence is investigating, due care is acting.

The distinction

Due diligence is the research you do before committing — before signing with a vendor, acquiring a company, adopting a platform. Are they financially stable? What certifications do they hold? Have they been breached? Where will the data live? Who are their subcontractors?

Due care is the ongoing exercise of reasonable precaution once you are responsible. Patching, training, enforcing policy, reviewing access, monitoring logs. It is what a reasonable organisation would do to protect what it holds.

A memorable framing: due diligence is doing your homework; due care is doing your job. Diligence comes first and is investigative; care is continuous and operational.

They are legal concepts before they are technical ones. Demonstrating both is how an organisation shows it behaved responsibly. Failing at either is negligence, and the exam uses that word deliberately — negligence is the absence of due care.

The prudent person rule

The standard against which both are measured: would a prudent person in a similar position, with similar responsibilities, have acted this way? It is not a standard of perfection. Being breached does not by itself prove failure. Being breached through an unpatched vulnerability that was public for eighteen months does.

Due diligence in practice

Vendor and third-party assessment is where Security+ places most of these questions.

Before engagement: review financial stability and viability; request audit reports such as SOC 2 Type II or ISO 27001 certification; send a security questionnaire; ask about breach history and how incidents were handled; establish where data is stored and processed, which is where data sovereignty enters; and identify their subcontractors, since your data may reach a fourth party you never assessed.

In the contract: agree the SLA with penalties, a right-to-audit clause, breach notification timelines, data ownership and return on exit, and end-of-life provisions for what happens to your data when the relationship ends.

After engagement: diligence does not stop at signature. Reassess periodically, monitor for news of breaches, and re-evaluate when their circumstances change — an acquisition can move your data to a different jurisdiction overnight.

Due care in practice

The ordinary discipline of running security: applying patches within defined windows, delivering security awareness training, enforcing policies rather than merely publishing them, reviewing access rights, maintaining and testing backups, monitoring and responding to alerts, and keeping documentation current.

Documentation is what turns due care into evidence. An organisation that patched diligently but recorded nothing has a much harder time demonstrating it.

Related agreements

These appear in the same exam questions.

Term	What it is
SLA	Service level agreement — measurable performance commitments and penalties
MOU / MOA	Memorandum of understanding or agreement — intent, usually not binding
BPA	Business partnership agreement — how partners share responsibility and profit
MSA	Master service agreement — the umbrella terms for an ongoing relationship
SOW	Statement of work — the specific deliverables under an MSA
NDA	Non-disclosure agreement — confidentiality obligations
ISA	Interconnection security agreement — terms for a direct system-to-system link

The MSA and SOW pairing is worth remembering: the MSA sets the standing terms once, and each project adds a SOW with its own scope, deliverables and timeline.

Telling them apart in a question

Look at the timing and the verb. Investigation before a decision is due diligence: reviewing a supplier's SOC 2 report, running a background check, assessing a cloud provider's controls. Ongoing responsible action is due care: applying patches, training staff, reviewing logs, enforcing policy.

A scenario where an organisation signed with a provider without checking anything is a failure of due diligence. One where it knew about a critical vulnerability and left it unpatched for a year is a failure of due care.

What to remember

Due diligence investigates before commitment; due care acts responsibly thereafter. Both are measured against the prudent person standard, and failing either is negligence. Vendor assessment, audit reports and right-to-audit clauses are diligence; patching, training and monitoring are care. Document both, because undocumented care is hard to prove.

Related reading: SBOM and supply chain · The shared responsibility model · Data owner and custodian roles