Exam CAS-004 topic 1 question 365 discussion

He did his due diligence in finding the gaps, however, he is NOT doing his due care (A) in reporting them.

Due care is about correcting something immediately. The first letter of the two words even help to remember this, DC = do correct. Due diligence takes longer than just fixing something immediately, it is more the investigation as to why that something had to be corrected in the first place. It is about detecting the reason behind either an incident, event, or breach etc. etc. The first two letters help to remember this, DD, do detect.

B. Due diligence Given the scenario where the security assessor identified gaps but chose not to report them, the primary violation is with "due diligence." The assessor did not complete the due diligence process by withholding critical information. If the assessor had identified the gaps (due diligence) and then did nothing to address or rectify those gaps (despite knowing about them), that would be a violation of "due care." Due diligence: refers to the investigations and research conducted before taking an action. Due care: is about taking the necessary steps to mitigate the risks and threats that have been identified through due diligence. Due diligence need to happen before dual care. In the given scenario, the internal security assessor never did the duel diligence part.

https://www.studynotesandtheory.com/single-post/due-care-vs-due-diligence