Standard of Care

Once a duty of care exists (see L-01), the standard of care defines what conduct satisfies it: what a reasonably careful manufacturer would have done.

Established professions set that benchmark through industry custom. Software has no equivalent, no widely recognized "reasonably secure" baseline. NIST, OWASP, and CISA's Secure by Design pledge are candidates, but none are enforceable, and even universal practice isn't automatically enough.

Without an agreed standard, "reasonable" security gets argued case by case.

Discussion prompts

• If your organization follows NIST or OWASP guidance, would that satisfy a court, or just a jury?
• What would change if an industry-wide practice your team relies on were still found negligent?
• Who should set the standard of care for software: courts case by case, regulators, or the industry itself?