The standard of demonstrable diligence an organisation can show to auditors, boards or regulators. In mobile security, it means there is a traceable record of testing, policy enforcement, remediation and privacy oversight that supports the approval decision.
What reasonable care means in cybersecurity governance
Reasonable care is not a loose claim that an organisation “tried its best.” It is a defensible standard of diligence that can be shown through evidence, such as policies, approvals, testing records, remediation tracking and oversight artefacts. In security reviews, the question is usually whether the organisation can prove it acted thoughtfully and consistently, not whether it achieved perfect protection.
Why the standard matters to approval and oversight
Boards, auditors and regulators use reasonable care as a way to judge whether security decisions were informed, traceable and proportionate. That makes the standard especially important where an organisation is asked to approve a mobile application, accept residual risk or defend a control decision after the fact. The practical test is whether the evidence trail supports the decision-making process, not just the final outcome.
In privacy and mobile-security contexts, reasonable care usually depends on showing that testing occurred, policy exceptions were handled, and remediation was tracked to closure. Where the review touches sensitive personal data, organisations also need to show that privacy oversight was part of the approval path, not an afterthought.
What demonstrable diligence looks like in practice
Demonstrable diligence means the organisation can reconstruct what it did, when it did it and who approved it. That usually includes risk-based testing, documented exceptions, evidence of control enforcement, and a clear record of follow-up when issues were found. A strong record matters because reasonable care is judged on substantiation, not intention.
The standard is also about consistency. If one team receives a thorough review and another team is approved on an informal basis, the organisation may struggle to show that it applied a stable and governed process. Consistency matters because it reduces the appearance of arbitrary decision-making and improves audit credibility.
How reasonable care is evaluated after an incident or review
After a security incident, the focus often shifts from “Was the control ideal?” to “Could the organisation show it acted prudently before the incident?” Evidence of monitoring, remediation priority, exception handling and oversight can be decisive in that review. Without that record, even sensible decisions can look careless in hindsight.
Reasonable care is therefore both a governance standard and an evidentiary standard. It rewards organisations that can prove their security decisions were deliberate, reviewed and proportionate to the risk they accepted.
Risk and Threat Considerations
Reasonable care fails when organisations rely on undocumented judgement, incomplete testing or informal approvals. In that situation, a control may exist in name but not in a form that can be defended to auditors, boards or regulators.
Failure mechanism: The organisation cannot produce a clear evidence trail showing testing, policy enforcement, remediation and oversight, so the approval decision looks arbitrary or superficial.
Impact: That gap can undermine regulatory defence, weaken internal accountability and leave the organisation exposed to greater scrutiny after a breach or compliance review.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | GV.OV-01 — Oversight of the cybersecurity risk management strategy | Reasonable care is shown through governed oversight and defensible security decisions. |
| PR.PO-01 — Policies, processes, and procedures are established and maintained | The term depends on documented policy enforcement and repeatable process evidence. | |
| Recommendation — Document oversight decisions and retain evidence that shows security approvals were reviewed and justified. Maintain and enforce security policies and keep dated records that prove the process was followed. | ||
| NIST SP 800-53 Rev 5 | CA-2 — Control Assessments | Reasonable care relies on evidence from testing and assessment activities. |
| AU-6 — Audit Record Review, Analysis, and Reporting | Traceable oversight depends on reviewable records and follow-up evidence. | |
| Recommendation — Perform and retain control assessment evidence that supports the approval decision. Review audit records and preserve reporting evidence that shows issues were identified and handled. | ||
| ISO/IEC 27001:2022 | A.5.36 — Compliance with policies, rules and standards for information security | Reasonable care is supported by demonstrable compliance with internal security rules and standards. |
| Recommendation — Show compliance with security standards through retained evidence, exceptions and remediation records. | ||
Practitioner Guidance
Why practitioners should care: Treat reasonable care as a documentation and governance standard as much as a security standard. If you cannot explain the control decision from the record alone, the organisation may struggle to defend it later.
Common misunderstanding: Reasonable care is often mistaken for “best effort.” In practice, it is closer to demonstrable diligence, where the quality of the evidence matters as much as the control outcome.
Practitioner takeaway: Build approval paths so the underlying evidence, not just the final sign-off, can survive audit, incident review and executive challenge.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 30, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org