ue Care is taking steps to according to what is reasonable' (policies and procedures) and due diligence was being able to prove it (audits, logs, tests). With LeastPriv vs Need to know, the way I understood it was that you need Need to know FIRST and then you get Least Priv on it. e.g. Lorenzo is granted Need to Know to the HR folder, BUT is given least priv through read-only on just 3 files'

due care=governance. due diligence=actions