Cybersecurity has consequences for sustainability
In 2022, a cyberattack targeted a French hospital. The consequences for sustainability were devastating:
- Personal data exposure: can you imagine your medical information no longer being confidential? Surgeries were postponed. (Social aspect of sustainability – « S »);
- Staff reverted to using pens & notebooks: a real danger for traceability (Governance aspect of sustainability – « G »).
For information, the financial loss was estimated to be around 7M EUR and it took 18 months for the hospital to recover.
How do ESG & cybersecurity intersect ?
So the topic of cybersecurity piqued my interest: it’s not ‘just an IT issue’ : it’s a global social issue with business survival at stake.Lucky me, I know someone in the cybersecurity space (networking is ALWAYS rewarding!) :
- With Iva – founder of a cybersecurity advisory firm – , we decided to co-write an article on how cybersecurity and Environmental, Social & Governance (« ESG ») criteria intersect within an organization.
- I guess we got a little too passionate because, somehow, the article ended up being a white paper !
Leveraging ESG and cybersecurity for resilient organizations - 5 key takeaways
✏️ Cybersecurity falls under all pillars of ESG : we can go as far as saying that an ESG framework can only be considered as strong if there is a cybersecurity element to it.
💹 Asset managers (in short, they make the money you saved grow) rank cybersecurity as their 2nd biggest concern among ESG-related themes. We even got tips on best practices from the CEO of an asset management firm !
⚖️ Within the EU, the EU legislator has been paving the way on both topics.
- Great news: cybersecurity is now an essential part of sustainability disclosures.
- Not so great news: while societal protection is a key driver for many EU cybersecurity regulations, a concrete assessment of their societal impact is still lacking. Are security monitoring systems designed fairly, without discrimination or bias ?
🏢 On the implementation of ESG & cybersecurity practices within companies, there’s a clear divide between :
- Large corporations which are resilient : Bank of America is spending over USD 1 billion on cybersecurity annually.
- And SMEs, which are struggling: only 16% of SMEs feel well-prepared for a cyberattack. In the UK, only 29% of companies fully understand the ESG legislative and regulatory landscape (due to a lack of resources).
🔎 Case study explaining why non-EU companies that want to penetrate the EU market (to increase their turnover) should develop cybersecurity & ESG practices, the steps to be taken, and how to leverage ESG and cybersecurity while doing so.
Enjoyed this insight ?
Subscribe to Raise — our monthly newsletter exploring sustainability, strategy, and everything in between (with a focus on the overlooked).