Standard of due care: when adopting levels of security for a legal defense, organization shows it has done what any prudent organization would do in similar circumstances
Due diligence: demonstration that organization is diligent in ensuring that implemented standards continue to provide required level of protection