Due Care, Due Diligence, and Governance Decisions
Key Takeaways
Subdomain 1.5 names due care, due diligence, and the ISC2 Code of Ethics as conduct topics.
Due care means acting responsibly to protect assets; due diligence means checking before relying on a party or decision.
A governance answer follows the policy and the people with authority, not an informal shortcut.
Source: ISC2 CC Exam Outline effective September 1, 2026, subdomains 1.3 and 1.5, checked 2026-10-22.
Due Care and Due Diligence
The outline lists due care and due diligence under professional and ethical conduct (subdomain 1.5). Due care is the responsible protection of assets as a normal part of the job. Due diligence is the checking done before relying on a person, vendor, or decision. Scenarios often test whether a shortcut replaces one of these.
Source: ISC2 CC Exam Outline effective September 1, 2026 (v01/2026), subdomains 1.3 and 1.5, https://www.isc2.org/certifications/cc/cc-certification-exam-outline, checked 2026-10-22.
Choosing the Governance Answer
Prefer the answer that follows the documented policy and gives the decision to the person with authority. An informal request from a senior person does not change the policy. When the scenario asks what to do first, the correct answer is usually to confirm the policy and escalate through the proper channel rather than act alone.
What the Outline Lists for This Section
The outline names these items. Be able to explain each one in plain language and apply it to a short scenario:
- 1.3: Regulations and laws
- 1.3: Frameworks and guidelines
- 1.3: Policies, standards (e.g., ISO, Center for Internet Security), procedures
- 1.5: Professional code of conduct
- 1.5: Due care and due diligence
- 1.5: ISC2 Code of Ethics
Common Traps
A common trap is treating an informal instruction as policy. Answer from the documented policy, standard, or procedure, and from the person with authority to decide.
An executive asks a CC staff member to skip a documented control because it is inconvenient. What is the best response?
Refer the request to the policy owner and follow the documented control
Skip the control once because the executive has authority over the team and the request is made in person
Remove the control permanently without a record, since the executive has said it is inconvenient to the business
Ignore the request and say nothing, and let the executive decide later whether the control applies to the case
Sections you finish are checked off in the contents.