What is due diligence?
Due diligence is the research and verification an organization does before it commits to a vendor, partner or acquisition. In security, it means confirming that a supplier can protect the data, systems and services it will be trusted with, using evidence rather than the supplier's sales pitch. The word "due" signals that the effort should match the risk: a reasonable organization in the same position would have checked at least this much.
Due diligence is one stage of third-party risk management. It happens during vendor selection, before the contract is signed, while the buyer can still demand evidence, add security terms or walk away.
What a due diligence review covers
- Security controls: a completed security questionnaire, such as the Shared Assessments SIG or the Cloud Security Alliance CAIQ, followed up for high-risk vendors with policies, configuration evidence or interviews.
- Independent reports: a SOC 2 Type II report, an ISO/IEC 27001 certificate and its scope statement, or a PCI DSS Attestation of Compliance for a provider that handles card data.
- Financial health: audited statements, credit reports or funding history, because a vendor that goes out of business takes the service, and possibly your data, with it.
- History: past breaches, lawsuits and regulatory actions, and how the vendor handled them.
- Fourth parties: the subcontractors and subprocessors that will also touch your data, and the countries they operate in.
- People and insurance: background checks for staff with privileged access, and cyber insurance sized to the exposure.
Scaling the review to the vendor's risk
No team can examine every supplier in depth, so due diligence is tiered. A vendor that will store customer records, connect to the network or run a critical business process gets the full review, including evidence requests and calls with its security team. A vendor with no data and no access, such as an office supplies company, gets a short check. The tier is usually set from a brief intake form that the business owner requesting the purchase fills in.
Example: a payroll provider
A company with 800 employees plans to move payroll to a SaaS provider that will hold names, Social Security numbers and bank details for every employee. The security team rates it a top-tier vendor and asks for a current SOC 2 Type II report, the latest penetration test summary and the list of subprocessors. The report shows an exception: departing staff at the provider kept system access for up to three weeks during the audit period. The team asks how that was fixed, receives evidence of a new automated deprovisioning process, and records the remaining risk before approving the contract. Without the review, the exception would have surfaced only after an incident.
Due diligence vs. due care
The two terms are often paired. Sources draw the line in slightly different places, but a common way to divide them is:
- Due diligence is investigating and understanding the risk: researching the vendor, assessing threats and finding out what could go wrong before you act.
- Due care is acting on that knowledge: putting reasonable controls in place and keeping them running, the way a prudent organization would.
A short way to remember it: due diligence is doing your homework, and due care is doing the right thing with what you learned. Regulators and courts look for both, because an organization that skipped either can be found negligent after a breach. Due diligence is also different from vendor monitoring, which repeats similar checks on a schedule once the contract is running.
Due diligence on the CompTIA Security+ exam
SY0-801 places due diligence under objective 5.3, which covers assessing and managing the risk of vendors and other third parties, as part of vendor selection along with conflict-of-interest checks. Scenario wording such as "before signing the contract," "evaluate the vendor's security posture" or "verify the provider's claims" points to due diligence. The usual distractors are due care, which is about maintaining controls once the risk is known; vendor monitoring, which happens after the contract starts; and a right-to-audit clause, which is a contract term rather than an investigation. When a question asks for the best evidence during due diligence, choose an independent report over the vendor's own assurances.