Due Diligence

When it comes to CISSP, the definition of Due Diligence (DD) is obscure and inconsistent.

IMO, DD entails defining a standard in terms of contexts. The standard of DD in the legal sector is different from the one in finance.

The Audit Office of New South Wales defines the standard of DD in terms of third-party engagement. It’s a good practice.

Standard of Due Diligence

However, how much diligence or how diligent is enough to meet the standard of due diligence? There is no uniform or widely agreed standard, and it varies across professions or contexts. For example, in the context of a merger & acquisition case, the following professional due diligence may be performed:

  • Financial due diligence may focus on uncovering any financial abnormalities.
  • Legal due diligence may involve analyzing the company’s agreements, licenses, ownership, and legal standing to operate.
  • Information security due diligence may contain activities such as data leakage review, cyber health check, supply chain risk assessment, SDLC and DevOps evaluation, and so forth.

Source: The Effective CISSP: Security and Risk Management


Due Diligence

  • detailed assessment of one or more business processes or production lines, culture, assets, liabilities, intellectual property, judicial and financial situation in order to make the outsourcing decisions. (ISO 37500:2014)
  • detailed assessment conducted by an economic operator to evaluate a supplier’s compliance with the guidance principles.
    Note 1 to entry: In the context of the guidance principles, due diligence is conducted through second-party audits or third-party audits and, wherever feasible, regularly monitored through government inspections and oversight. (ISO/IWA 19:2017)
  • comprehensive, proactive process to identify the actual and potential negative social, environmental and economic impacts of an organization’s decisions and activities over the entire life cycle of a project or organizational activity, with the aim of avoiding and mitigating negative impacts. (ISO 26000:2010)
  • process through which organizations proactively identify, assess, prevent, mitigate and account for how they address their actual and potential adverse impacts as an integral part of decision-making and risk management. (ISO 20400:2017)
  • compilation, comprehensive appraisal and validation of information of an organization required for assessing accuracy, commercial integrity, financial stability and functional competence integrity at the appropriate stage of the agreement sourcing process (ISO 41011:2017)
  • process to further assess the nature and extent of the bribery risk and help organizations make decisions in relation to specific transactions, projects, activities, business associates and personnel. (ISO 37001:2016)