Cybersecurity Environmental, Social & Governance (ESG)

Environmental, Social & Governance (ESG) is a concept that is easily abused, where ESG is only as good as the executive leadership team involved in enforcing those self-imposed mandates. Any critical review of an ESG program should evaluate exceptions management practices to determine if ESG is merely "virtue signaling" to promote the organization through fraudulent marketing purposes or if the organization is willing to operationalize difficult decisions that could lead to lost profits in the pursuit of being a good corporate citizen. The SCF Council is fundamentally against this concept of ESG virtue signaling, since it offers no benefit to society in any form.  

In 2021, the SCF added five (5) ESG-specific controls that are intended to identify potentially harmful compliance requirements that have profound, life-changing implications from complying with a law or regulation from a hostile nation / oppressive regime. The goal of these ESG-specific controls is to elevate risk / decision making away from cybersecurity & data privacy practitioners by directing those issues to the organization’s executive leadership to address the moral and legal ramifications of such compliance actions. The implications include, but are not limited to: 

• Foreign government espionage;
• Intellectual property theft; and
• Human rights abuses.

​These controls focus on potentially ruinous corporate practices that organizations often agree to in order to gain market access to hostile nations / oppressive regimes. These are also concepts that should be included in any organization's Cybersecurity Supply Chain Risk Management (C-SCRM) strategy and implementation plan:

GOV-12: Forced Technology Transfer

Mechanisms exist to avoid and/or constrain the forced exfiltration of sensitive / regulated information (e.g., Intellectual Property) to the host government for purposes of market access or market management practices.

GOV-13: State-Sponsored Espionage

Mechanisms exist to constrain the host government's ability to leverage the organization's technology assets for economic or political espionage and/or cyberwarfare activities. 

CPL-06: Government Surveillance

Mechanisms exist to constrain the host government from having unrestricted and non-monitored access to the organization's systems, applications, services that could potentially violate other applicable statutory, regulatory and/or contractual obligations.

DCH-26: Data Localization

Mechanisms exist to constrain the impact of "digital sovereignty laws," that require localized data within the host country, where data and processes may be subjected to arbitrary enforcement actions that potentially violate other applicable statutory, regulatory and/or contractual obligations.

PRI-16: Potential Human Rights Abuses

Mechanisms exist to constrain the supply of physical and/or digital activity logs to the host government that can directly lead to contravention of the Universal Declaration of Human Rights (UDHR), as well as other applicable statutory, regulatory and/or contractual obligations.

Beware of "Garbage In Garbage Out" ESG Practices

Fraud Magazine has a good article on concerns related to abusing ESG principles that is well worth reading. The very real existence of sham practices associated with ESG puts the entire concept of ESG on shaky ground, such as:

• Making an organization look better than it is through the purchase of carbon credits to offset manufacturing practices; or
• Selectively enforcing prohibitions on choosing supply chain partners (e.g., Uyghur forced labor). 

The issue of choosing the harder right over the easier (and more profitable) wrong is the fundamental flaw with ESG in many organizations, since "faithful ESG practices" will often lead to a decision that would avoid engaging in or put an end to a profitable business venture. 

On the cybersecurity & data privacy side of ESG, unlike buying carbon credits, an organization cannot make up for its own lacking cybersecurity & data privacy practices by buying goodwill from another organization that implements its own responsible cybersecurity & data privacy practices. This means organizations need to step up and actually do what they should be doing to earn a good "social" rating, in the scope of ESG compliance. In cybersecurity, "a standard is a standard for a reason" and that concept needs to be enforced, even if it means making difficult choices that could negatively affect profits. Without an ethical, morally-rigid leadership team, ESG is not only meaningless, but fundamentally dishonest and indicative of fraudulent business practices. ESG must be driven from the highest levels of the organization's leadership team, but only if they are willing to chose the harder right over the easier wrong. 

Cybersecurity & Data Privacy Implications For ESG

ESG criteria are considerations of interest for "social responsibility" at the corporate level. ESG is traditionally used to screen potential investments as a way to support and maintain ethical conduct across organizations. However, with the evolving landscape of statutory, regulatory and contractual obligations, the SCF identified two significant points of intersection between the SCF's cybersecurity & data privacy controls with the "social" component of ESG factors:

1. Data protection / data privacy; and
2. Human rights. 

The social criteria component of ESG takes into account the human factor at the individual level, as well as what occurs within those organizations as part of normal business operations. This is where cybersecurity & data privacy come into play with the social criteria of the ESG model with the real-world ramifications associated with access to sensitive data and critical systems.

ESG is inexplicitly intertwined with cybersecurity & data privacy practices, since these functions have the ability to directly affect individuals, organizations, governments and society as a whole. Therefore, IT/cyber/privacy operations cannot merely “check the box” by providing access or data without understanding the real-world ramifications associated with compliance with a law, regulation or contractual obligation. How an organization responds to potentially hostile compliance requirements will determine its genuine adherence to ESG principles for corporate responsibility, since non-compliance might be the morally-correct path for an organization to take.