After a breach, residents claim the city never researched reasonable safeguards before outsourcing billing. Which distinction best frames that claim?
Select an answer to reveal the explanation.
Short Explanation
Due diligence is doing your homework before you hire the billing vendor. Due care is continuing to act like a reasonable steward after the ink dries — monitoring, reviewing, fixing. Residents saying nobody researched safeguards are pointing at a due-diligence gap first.
Full Explanation
Due diligence is the research and investigation performed before selecting safeguards or vendors; due care is the ongoing, prudent action taken afterward to protect assets. When residents claim the city never researched reasonable safeguards before outsourcing billing, they are primarily alleging a due-diligence failure: homework that should have preceded the outsourcing decision. Understanding the distinction frames liability and remediation—fix selection gaps versus failures to monitor and maintain protections once the vendor is live.
Treating due care as only a procurement slogan and due diligence as solely background checks shrinks both concepts into narrow HR or marketing uses and misses their security-governance meaning. Equating due care with buying the cheapest vendor and due diligence with never reviewing contracts inverts prudent practice. Treating the labels as interchangeable synonyms for encryption strength collapses a process distinction into a single technical control and will mislead exam and courtroom analysis alike.
Exam caveat: Remember the sequence—diligence before, care during operations. Stems about 'never researched' point to diligence; stems about 'failed to keep monitoring' point to care.
Operational check: Before outsourcing billing, document vendor security reviews, contract clauses, and residual-risk acceptance; after award, schedule continuous monitoring, SOC report reviews, and incident-notification drills as ongoing due care.