Due diligence is a reasonable amount of careful and persistent work or effort, and due care lies at the core of due diligence.

• Individuals, organizations, or even nations exercise due diligence to inform risk-based decision making to avoid loss and liability.
• They use due care to ensure the decision is made and implemented without negligence. Negligence is a failure to exercise the care that a reasonably prudent person would exercise under similar circumstances; that is, lack of due care.

Due care means “the degree of care that a prudent and competent person engaged in the same line of business or endeavor would exercise under similar circumstances. Due care does not permit willful ignorance.” (16 CFR § 1107.2)

Due diligence can be part of the risk assessment process. People typically exercise due diligence, as a preemptive or proactive measure, by checking things out or conducting investigations to inform risk-based decision making.

As due diligence focuses on risk-based decision making, it is more often for the management to exercise due diligence than others. In contrast, everybody has to use due care to get things done without negligence.

Standard of Due Diligence

However, how much diligence or how diligent is enough to meet the standard of due diligence? There is no uniform or widely agreed standard, and it varies across professions or contexts. For example, in the context of a merger & acquisition case, the following professional due diligence may be performed:

• Financial due diligence may focus on uncovering any financial abnormalities.
• Legal due diligence may involve analyzing the company’s agreements, licenses, ownership, and legal standing to operate.
• Information security due diligence may contain activities such as data leakage review, cyber health check, supply chain risk assessment, SDLC and DevOps evaluation, and so forth.

Security Operations Due Diligence

When it comes to security operations, according to the Official (ISC)² Guide to the CISSP CBK 4^th edition, examples of due diligence for security professionals in an organization include but are not limited to:

• Background checks of employees
• Credit checks of business partners
• Information system security assessments
• Risk assessments of physical security systems
• Penetration tests of firewalls
• Contingency testing of backup systems
• Threat intelligence services used to check on the availability of company Intellectual Property (IP)

The Official (ISC)² CISSP Study Guide states:

• Due care is using reasonable care to protect the interests of an organization.
• Due diligence is practicing the activities that maintain the due care effort.

Due Diligence

• detailed assessment of one or more business processes or production lines, culture, assets, liabilities, intellectual property, judicial and financial situation in order to make the outsourcing decisions. (ISO 37500:2014)
• detailed assessment conducted by an economic operator to evaluate a supplier’s compliance with the guidance principles.
  Note 1 to entry: In the context of the guidance principles, due diligence is conducted through second-party audits or third-party audits and, wherever feasible, regularly monitored through government inspections and oversight. (ISO/IWA 19:2017)
• comprehensive, proactive process to identify the actual and potential negative social, environmental and economic impacts of an organization’s decisions and activities over the entire life cycle of a project or organizational activity, with the aim of avoiding and mitigating negative impacts. (ISO 26000:2010)
• process through which organizations proactively identify, assess, prevent, mitigate and account for how they address their actual and potential adverse impacts as an integral part of decision-making and risk management. (ISO 20400:2017)
• compilation, comprehensive appraisal and validation of information of an organization required for assessing accuracy, commercial integrity, financial stability and functional competence integrity at the appropriate stage of the agreement sourcing process (ISO 41011:2017)
• process to further assess the nature and extent of the bribery risk and help organizations make decisions in relation to specific transactions, projects, activities, business associates and personnel. (ISO 37001:2016)

Due Diligence and Due Care

The following is my definition of Due Diligence and Due Care. As I am not a lawyer, I just interpret them from my point of view and avoid to relate them to the context of the laws.

Due Diligence

The core concept of due diligence is about making informed decisions. A decision should be made based on sufficient information and justifications. If a decision-maker can’t do so, he or she doesn’t exercise due diligence. The decision-maker often implies the management.

CISSP PRACTICE QUESTIONS – 20190915

• Security Due Diligence
• Financial Due Diligence
• Operational Due Diligence
• Legal Due Diligence
• Human Rights Due Diligence

Due Care

The core concept of due care is about a reasonable person’s compliance and best efforts. A reasonable person should do his or her duty according to the organization’s policies, standards, and procedures; and with best efforts. Lack of due care is called negligence. The reasonable person role applies to everyone.

Due Diligence

• detailed assessment of one or more business processes or production lines, culture, assets, liabilities, intellectual property, judicial and financial situation in order to make the outsourcing decisions. (ISO 37500:2014)
• detailed assessment conducted by an economic operator to evaluate a supplier’s compliance with the guidance principles.
  Note 1 to entry: In the context of the guidance principles, due diligence is conducted through second-party audits or third-party audits and, wherever feasible, regularly monitored through government inspections and oversight. (ISO/IWA 19:2017)
• comprehensive, proactive process to identify the actual and potential negative social, environmental and economic impacts of an organization’s decisions and activities over the entire life cycle of a project or organizational activity, with the aim of avoiding and mitigating negative impacts. (ISO 26000:2010)
• process through which organizations proactively identify, assess, prevent, mitigate and account for how they address their actual and potential adverse impacts as an integral part of decision-making and risk management. (ISO 20400:2017)
• compilation, comprehensive appraisal and validation of information of an organization required for assessing accuracy, commercial integrity, financial stability and functional competence integrity at the appropriate stage of the agreement sourcing process (ISO 41011:2017)
• process to further assess the nature and extent of the bribery risk and help organizations make decisions in relation to specific transactions, projects, activities, business associates and personnel. (ISO 37001:2016)