“Consider penetration testing as a representative example. Due care would be the owner of a system requesting that a penetration test be performed and then authorizing the remediation of the vulnerabilities identified by the penetration test. Due diligence would then be providing proof that the vulnerabilities were addressed in a cost-effective and efficient way to management and other relevant stakeholders (e.g., customers).”