Cyber Security in ESG Reporting: Investor Questions

Cyber security now sits inside sustainability reporting, yet most companies still answer investor and ESG rating questions with marketing text that no one can verify or compare. Investors read cyber risk as a governance and product liability issue, rating agencies score it from public evidence, and disclosure frameworks such as IFRS S1, the SASB Standards, GRI and the EU CSRD each ask for it in a different shape. This guide explains what each framework and rater looks for, how to build a single evidence base that serves all of them, and how to keep ESG statements consistent with your regulatory filings. It is for CISOs, sustainability and investor relations teams, company secretaries and audit committee members. How to report cyber risk to the board itself is covered in the Board Cyber Risk Reporting Guide and is not repeated here.

Key takeaways

Cyber is a governance and product liability topic in ESG. Raters such as MSCI place privacy and data security in the Social pillar under product liability, and score both exposure and how well you manage it.
One evidence base, many formats. IFRS S1, SASB, GRI 418, CSRD and SEC Item 106 overlap heavily: maintain one controlled set of facts and map it out, rather than writing each report from scratch.
Raters reward verifiable facts. Certification scope, named board oversight, audit frequency, training coverage and supplier requirements score; vague commitments do not.
Breach numbers must reconcile. Any count of breaches or affected users in a sustainability report has to match what you told regulators, customers and securities markets.
The CISO owns the facts, not the prose. Security supplies defined, dated, evidenced data points; sustainability and legal teams own the wording and the materiality call.

Why cyber security appears in ESG reporting

For investors, a serious breach is a governance failure with financial consequences: regulatory fines, litigation, lost customers and remediation cost. ESG frameworks treat cyber security as part of how a company protects customers and runs itself, not as an environmental topic. Three forces put it in the report:

Investor-focused standards: IFRS S1 requires disclosure of sustainability-related risks and opportunities that could reasonably be expected to affect a company's prospects, across governance, strategy, risk management and metrics. For a software, financial services or healthcare company, data security is usually one of those risks.
Industry standards: the SASB Standards, now maintained by the ISSB, include data security and data privacy disclosure topics for the industries where customer data is central to the business model.
ESG ratings: rating agencies build scores from public disclosures, company feedback and controversy monitoring. A company that discloses little is scored on assumptions and news coverage.

Cyber disclosure in ESG reports is voluntary or framework-driven in most jurisdictions, but it is read alongside mandatory disclosures. In the US, the SEC rules require annual description of cyber risk management, governance and board oversight under Regulation S-K Item 106. See the SEC Cybersecurity Disclosure Rules Guide.

The frameworks and what each asks

Framework	Who maintains it	What it asks about cyber security	Status note (checked November 2026)
IFRS S1 General Requirements	ISSB (IFRS Foundation)	Governance, strategy, risk management and metrics for material sustainability-related risks, which can include data security	Effective for annual periods beginning on or after 1 January 2024, where adopted by a jurisdiction
SASB Standards	ISSB	Industry-specific data security and data privacy topics: breach counts, share involving personal data, users affected, and the approach to identifying and addressing data security risks	77 industry standards; IFRS S1 requires companies to refer to and consider them
GRI 418: Customer Privacy 2016	Global Reporting Initiative	Disclosure 418-1: substantiated complaints about customer privacy breaches, and identified leaks, thefts or losses of customer data	Confirm the current GRI standards list before each reporting cycle
CSRD and ESRS	EU (EFRAG drafts the standards)	No dedicated cyber standard; material cyber impacts, risks and opportunities are reported under the general requirements as company-specific topics	Scope narrowed by the Omnibus I Directive; revised ESRS delegated act published July 2026
SEC Regulation S-K Item 106 and Form 8-K Item 1.05	US SEC	Risk management processes, board oversight, management role and expertise; material incidents within four business days of the materiality determination	In force since December 2023 for annual reports

IFRS S1 and the SASB Standards

IFRS S1 does not require companies to apply the SASB Standards, but it does require them to refer to and consider the applicability of SASB disclosure topics when identifying sustainability-related risks, and SASB metrics when deciding what to disclose. In practice, an ISSB reporter in a data-intensive industry should expect auditors and investors to ask why it did not report the SASB data security metrics if it omitted them.

The SASB data security topic, in the industries that carry it, typically asks for three things:

A description of the approach to identifying and addressing data security risks, including use of third-party cybersecurity standards.
The number of data breaches.
The percentage of those breaches involving personally identifiable information and the number of users affected.

Metric wording and codes differ by industry (Software and IT Services, Professional and Commercial Services, Commercial Banks, Health Care Delivery and others). Always read the metric definitions for your industry standard in the SASB Standards Navigator, because terms such as "data breach" are defined in the standard and may not match your internal incident taxonomy. The ISSB launched a review of the SASB Standards in July 2025, prioritising extractives and processed foods, with finalised amendments targeted for 2026: check whether your industry standard has been amended before each cycle.

GRI 418

GRI 418-1 asks for the total number of substantiated complaints about customer privacy breaches, split between complaints from outside parties substantiated by the organisation and complaints from regulatory bodies, plus the total number of identified leaks, thefts or losses of customer data. If none were identified, a brief statement is enough. The standard also asks you to say if a substantial number of the breaches relate to earlier years, which matters when a breach discovered this year began long before.

CSRD and the ESRS

The Omnibus I Directive, Directive (EU) 2026/470, was published in the Official Journal on 26 February 2026 and entered into force on 18 March 2026, according to EUR-Lex. According to a Latham and Watkins summary, it narrowed CSRD scope to EU undertakings and groups with more than 1,000 employees and net turnover above 450 million euros, with a separate test for non-EU groups, and Member States must transpose the CSRD amendments by 19 March 2027. EFRAG delivered technical advice on simplified ESRS to the Commission on 3 December 2025, cutting required datapoints by around 70 per cent according to Arendt. EFRAG reported in July 2026 that the Commission had published the delegated act on revised ESRS, sent for scrutiny by Parliament and Council, applying to financial years beginning on or after 1 January 2027 with early adoption allowed for 2026. Because the ESRS contain no standalone cyber standard, an in-scope company that assesses cyber security as material through double materiality reports it as a company-specific matter. Status is moving: confirm the applicable delegated act and national transposition before relying on any date here.

What ESG rating agencies look for

Rating methodologies are proprietary and change, but MSCI publishes its approach for the Privacy and Data Security key issue, and it shows the pattern most raters follow. The key issue sits in the Social pillar under the Product Liability theme, and the score combines exposure with management, so a company with higher exposure needs stronger demonstrated management to reach the same score.

Assessment element	What drives it (MSCI methodology, March 2024)	Evidence you can make public
Business exposure	Sensitivity of data handled in each business segment (health, financial, advertising or sale of user data) and breach frequency and cost	Clear segment description of what personal data you hold and why
Geographic exposure	Strictness of privacy regulation and breach incidence in the countries where you operate	Jurisdictions and the privacy regimes you comply with
Certifications	Scope and type of information security certification such as ISO/IEC 27001 or SOC 2; best practice is more than 80 per cent of owned operations certified	Certificate scope statements, by business unit and share of operations covered
Governance	Who is responsible for privacy and data security strategy: board committee, executive or risk officer	Named committee, charter wording, executive owner and reporting line
Policies	Data protection policy scope, data minimisation, consent for secondary use, and consumer access, correction and deletion rights	Published privacy and information security policy summaries
Programmes	Training coverage (best practice is all staff and contractors), breach response plans, supplier data protection requirements and inspections	Training completion rates, incident response plan existence and testing, supplier assessment coverage
Audits	How often information security policies and systems are audited	Internal and external audit frequency and scope
Controversies	Deduction of 0 to 5 points for privacy and data security controversies, by severity and type	Factual incident disclosures, remediation and lessons learned

Two lessons follow. First, raters score what they can find: an ISO/IEC 27001 certificate that covers half the business but is described as "certified" will be scored on its actual scope once the rater checks. Second, controversies are deducted from management, so the way an incident is disclosed and remediated affects the score for years. See the ISO 27001 Certification Guide and the SOC 2 Guide.

Questions investors and raters commonly ask

Investor questionnaires, rater feedback forms and stewardship meetings return to a stable set of questions. Prepare a controlled answer for each, with an owner and evidence:

Question	Good answer contains	Owner of the evidence
Who oversees cyber risk at board level?	Named committee, frequency of cyber agenda items, director expertise or education	Company secretary
Who is accountable in management?	Role, reporting line, relevant experience	CISO and HR
Which standards do you align to or certify against?	Framework names, certification scope and coverage percentage, audit body type	CISO and compliance
How many breaches did you have and how many people were affected?	Counts using the framework's definition, reconciled with regulatory notifications	CISO, DPO and legal
How do you manage supplier cyber risk?	Assessment approach, contractual requirements, coverage of critical suppliers	Procurement and third-party risk
How do you prepare for incidents?	Plan, testing frequency, exercise involvement of executives and board	CISO and crisis management
What share of staff are trained?	Completion rate across employees and contractors, role-based training	Security awareness lead
Is cyber insured and how is residual risk managed?	Approach to risk transfer, without disclosing limits that would aid attackers	Risk and insurance

Do not publish detail that helps attackers: specific tools, unpatched weaknesses, insurance limits or the identity of security staff below executive level. Investors want evidence of governance and outcomes, not an architecture diagram.

Building one cyber evidence base for all reports

The most common failure in cyber ESG disclosure is inconsistency: the sustainability report says one thing, the annual report another, and the rater's questionnaire a third. Fix it with a single controlled register of cyber disclosure facts.

Inventory every outbound statement. Collect last year's sustainability report, annual report risk section, SEC or other regulatory filings, rater questionnaires, customer trust pages and investor presentations. List every cyber statement and who wrote it.
Define each data point once. For each fact (breach count, users affected, certification coverage, training rate, audit frequency) write a definition, the source system, the period, the owner and the framework it serves. A Security Metrics Dictionary Template is a good starting format.
Map to frameworks. Build a cross-reference: which data point answers which SASB metric, GRI 418-1 item, IFRS S1 element, ESRS disclosure or Item 106 requirement. Most facts serve three or more.
Agree the breach definition. Align the SASB or GRI definition with your incident taxonomy and with the incidents notified to data protection regulators. Record which internal incident classes count and why.
Collect evidence before writing. Certificates and scope statements, committee minutes extracts, training system reports, audit plans. Statements without evidence are removed.
Review through disclosure controls. Route the cyber section through the same disclosure committee, legal review and, where applicable, assurance as financial disclosures. Test that no sentence contradicts a filing.
Pilot with the rater feedback cycle. Most raters let companies review and correct their data. Use the first cycle to find gaps between what you disclose and what they score, then fix the disclosure, not the rater record alone.
Version and roll back. Keep each year's register frozen. If a figure is later restated, record the restatement and reason, and update every channel that used it.

Decision guidance: what to disclose and where

Listed company with SEC filings: make Item 106 text the anchor. ESG wording on governance and risk management should be consistent with, and no stronger than, the 10-K. See the SEC Cyber Disclosure Executive Briefing.
ISSB jurisdiction reporter: report SASB data security metrics for your industry unless you can justify why the topic is not material, and document that judgement.
CSRD in-scope company: run cyber through the double materiality assessment explicitly; if it is material, report policies, actions, metrics and targets as company-specific disclosures.
Private or smaller company: ESG reporting is usually driven by customers, lenders or private equity owners. A short fact sheet covering governance, certification scope, breach count and training rate answers most questionnaires. See the Private Equity Portfolio Cyber Security guide.
Framework choice for metrics: use SASB metrics where investors are the audience and GRI 418 where a multi-stakeholder report is expected; many companies report both from the same register.

Where identity fits

Identity controls are among the most verifiable cyber facts a company can disclose and among the most common root causes of breaches. Phishing-resistant MFA coverage for staff and administrators, privileged access governance and the ownership of service accounts and API keys are measurable and auditable. Raters do not yet ask for them by name, but supplier and investor questionnaires increasingly do. See the Identity Controls for Cyber Insurance Questionnaires Guide, which covers similar evidence for underwriters.

Measuring disclosure quality

Reconciliation rate: share of cyber statements in the ESG report traced to a defined data point in the register (target 100 per cent).
Cross-report consistency: number of contradictions found between the ESG report, annual report and regulatory filings during review (target zero at publication).
Evidence coverage: share of published data points with stored evidence for assurance.
Rater data accuracy: number of rater data corrections submitted and accepted per cycle, falling year on year.
Framework coverage: share of applicable SASB data security metrics and GRI 418-1 items reported or explained.
Timeliness: days between period end and a signed-off cyber data set.

Framework mapping

Disclosure activity	NIST CSF 2.0	NIST SP 800-53 Rev 5	ISO/IEC 27001:2022
Identify legal and investor disclosure requirements	GV.OC-03	PM-1	Clause 4.2, Annex A 5.31
Leadership accountability for cyber risk	GV.RR-01	PM-1	Clause 5.1
Risk management objectives and strategy	GV.RM-01	PM-9	Clause 6.1
Review of strategy outcomes and performance	GV.OV-01, GV.OV-03	PM-9	Clause 9.3
Supplier risk evidence	GV.SC-07	SR-6	Annex A 5.19 to 5.22
Stakeholder notification of incidents	RS.CO-02	IR-6	Annex A 5.24 to 5.26
Improvement from evaluations	ID.IM-01	PM-9	Clause 10.1

Common failure patterns

Overstated certification: "We are ISO 27001 certified" when the certificate covers one data centre or product line. Raters check scope; state coverage precisely.
Breach counts that do not reconcile: a sustainability report claiming zero breaches in a year when a notification was made to a data protection regulator or a Form 8-K was filed. This is a credibility and potential liability problem.
Boilerplate governance: "The board takes cyber security seriously" with no committee, frequency or accountable executive named. Raters score structure, not tone.
Disclosure that aids attackers: naming security tools, describing open weaknesses or publishing insurance limits.
Annual scramble: security learns of the ESG questionnaire two weeks before the deadline, so answers are written from memory and differ from last year's with no explanation.
Ignoring supplier risk: raters and investors ask about third parties, yet many reports describe only in-house controls. See the Third-Party Risk Management Guide.

Practitioner checklist

Identify which frameworks and raters apply to the company this cycle, and who owns each submission.
Build a single register of cyber disclosure data points with definitions, owners, sources and evidence.
Read the SASB industry standard metric definitions and align the breach definition with your incident taxonomy.
Reconcile breach and affected-user counts with regulatory notifications and securities filings.
State certification scope and coverage precisely, by share of operations.
Name the board committee, executive owner and frequency of board cyber discussion.
Route the cyber section through disclosure controls and legal review, and check consistency with Item 106 text where applicable.
Review and correct rater data records in each feedback window.
Check CSRD, ESRS and SASB status before each cycle, as all three are being amended.
Remove any detail that would help an attacker.

Standards and references

Related NHI Mgmt Group resources: Board Cyber Risk Reporting Guide · SEC Cybersecurity Disclosure Rules Guide · Security Metrics and KPIs Programme Guide · Cyber Risk Quantification Guide. This guide summarises disclosure frameworks and rating methodologies and is not legal advice.

Cyber Security in ESG Reporting: What Investors and Rating Agencies Ask