Reporting cybersecurity to stakeholders: A review of CSRD and the EU cyber legal framework

Abstract

The purpose of this article is to explain, through a doctrinal review of the EU sustainability and cybersecurity legal framework, how the cybersecurity obligations contribute to the cybersecurity content and quality of the sustainability reporting. Previous studies are limited to voluntary cybersecurity disclosure in annual reports because they date back to before the adoption of CSRD. The CSRD harmonized sustainability reporting in the EU and introduced the ESRS, the standards for sustainability disclosure. As stated in the ESRS S4, the sustainability reporting should now address how the company manages the risks linked to data usage and data collection. Therefore, cybersecurity measures must be included in the sustainability report. This information can be used by stakeholders to assess the risk appetite and the potential long-term profitability of the company. The cybersecurity measures adopted by companies must comply with the cybersecurity obligations of the EU legal framework. While it is out of the scope of these cybersecurity obligations to inform ex ante the stakeholders of a company of how the company is managing cyber risks, these same obligations can improve the quality and content of the sustainability discourse.