Why I Keep Mixing Up Due Care and Due Diligence
One of the concepts that repeatedly tripped me up while studying for the Certified Information Systems Security Professional exam was the difference between due care and due diligence.
At first, the distinction seemed simple. One term involved deciding what an organization should do, while the other involved actually doing it. Then I would read another practice question, both answers would sound reasonable, and suddenly the distinction disappeared.
It reminded me of the famous Spider-Man meme where two nearly identical characters point at each other.
Due care.
Due diligence.
Which one is which again?
The frustrating part was that I could explain both concepts in a conversation and still second-guess myself during a test. Because the terms are closely related—and are sometimes used differently outside certification materials—it is easy to understand why they become tangled together.
