Data Oversight

NIST Cybersecurity Framework

This framework from the National Institute of Standards and Technology (NIST) can help you better manage cybersecurity risks. It provides a common language and systematic methodology for managing this risk, and features a three-component framework. The “Framework Core” unpacks five pillars of a holistic cybersecurity program (Identify, Protect, Detect, Respond, and Recover); the “Implementation Tiers” help you to prioritise your cybersecurity program activities, as per your goals, risk appetite, and budget; and the “Profiles” section helps you to identify areas to improve.

To see how other organisations have implemented the framework, see the “Success Stories” page.

NIST Privacy Framework

The NIST Privacy Framework (PF) is a voluntary tool that can help you to identify and manage privacy risk and to bring privacy risk into parity with your broader enterprise risk portfolio. The framework is composed of three components: Core, Organisational Profiles, and Tiers. The "Framework Core" provides an increasingly granular set of activities and outcomes that enable organisational dialogue about managing privacy risk; "Organisational Profiles" are a selection of specific functions, categories, and subcategories from the Core that your organisation has prioritizsd to help manage privacy risk; and "Tiers" support communication about whether your organisation has sufficient processes and resources in place to manage privacy risk.

This framework follows the structure of the Framework for Improving Critical Infrastructure Cybersecurity to facilitate the use of both frameworks together.

Global Cybersecurity Outlook 2026

This report from the World Economic Forum can help you to navigate the growing complexity of the digital realm and identify essential actions for supporting resilience ecosystems. Produced in collaboration with Accenture, it examines the cybersecurity trends that will affect economies and societies in the year to come, including the impacts of AI, geopolitical volatility, cyber-enabled fraud and phishing, and more. The report is divided into two main section: CEO priorities in a shifting cyber landscape, and trends reshaping cybersecurity. This report will be especially beneficial for sustainability, risk, security, and technology professionals that want to summarise prominent near-future IT- and data-related threats for senior leaders.

ISAO 300-1: Introduction to Information Sharing

This guide from ISAO Standards Organisation can help you understand how to address cybersecurity risks through information sharing, including both ad hoc and structured activities. This guide presents a conceptual framework for joining or forming a formalised Information Sharing and Analysis Organization (ISAO) with other organisations in your sector. It explains information sharing concepts, the types of cybersecurity information you may want to share, how to facilitate information sharing, as privacy and security concerns. The resource will be most useful to IT professionals or others responsible for managing cybersecurity risks.

Data Privacy Handbook: A starter guide to data privacy compliance

This concise resource from PwC can help you to become better acquainted with data privacy and to get started on improving your data privacy practices. It explains why data privacy is important, highlights key concepts and principles of data privacy, and unpacks a ten-step framework for creating an effective data privacy programme. This is a good primer for change agents, leaders, and compliance and legal professionals.

Global Data Privacy and Cybersecurity Handbook

This comprehensive resource from Baker McKenzie can help you to navigate the global landscape of data protection, privacy and cybersecurity laws, regulations, and guidance. Updated annually, this handbook provides detailed overviews of a broad range of topics, and allows for sophisticated comparisons of jurisdictions. This resource will be of particular use to information technology and security professionals and legal teams.

Securing the Modern Economy: Transforming Cybersecurity Through Sustainability

This paper from Public Knowledge can show you why cybersecurity should be treated as a sustainability issue. It begins by offering a broad definition of cybersecurity and its role in protecting trust in - and security of - digital infrastructure, including the internet. It then highlights how cybersecurity faces challenges that are parallel to the sustainability field, such as short-termism, tradeoffs, and a lack of resilience. The paper recommends that organisations draw on sustainability management practices to help address these cybersecurity challenges, and outlines the broader implications of cybersecurity for national security and the digital infrastructure that today’s economies rely on. This resource would be helpful for both IT leaders and sustainability professionals.

7 Pressing Cybersecurity Questions Boards Need to Ask

This article can help you to assess your board's understanding of cybersecurity, raise awareness on the issue, and prioritise action. The article highlights five key things directors need to know about cybersecurity, as well as seven questions you can ask to make sure your board understands how cybersecurity is being managed.

Principles of Data Protection

This short resource from the Data Protection Committee provides a brief, high-level overview of the Principles of Data Protection found in the EU's General Data Protection Regulation. These principles include lawfulness, fairness, and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality; and accountability. This overview provides an accessible introduction to the principles of data protection, and is a good starting point for sustainability professionals, managers, and senior leaders.

Although these key principles were created with the European Union and European Economic Area in mind, they provide a practical, appropriate, and effective reference point for businesses operating in other regions and jurisdictions.

Developing Your Incident Response Plan

This concise response plan from the Government of Canada is a good primer for developing and implementing a cybersecurity incident response plan. It can help you to identify the information and systems that are of value to your organisation; determine the types of incidents your organisation may face; consider who is qualified to be on the response team; and more. It also details the phases of the incident response life cycle.

Recommendation on Information Integrity

The OECD's Recommendation on Information Integrity represents the first international soft law on information integrity. It aims to provide guidance for policy-makers to promote information integrity in line with the universal human rights of freedom of opinion and expression. This resource can help you to better understand and support global efforts to advance information integrity.

Cyber Security Readiness Goals: Securing Our Most Critical Systems

The Canadian Centre for Cyber Security’s Cyber Security Readiness Goals (CRGs) were developed in response to the growing susceptibility of critical infrastructure (CI) to cyber threats. This guide provides an introduction to the CRGs, and explains how they were developed and how they can be used to enhance cybersecurity and minimise potential risks to society, public safety, and the overall stability of the Canadian economy. The CRGs can be found in full in the Cross-Sector Cyber Security Readiness Goals Toolkit.

Although these goals were developed for critical infrastructure, and for Canadian businesses and multinational firms operating within Canada, the recommendations herein are applicable to all organisations, regardless of geography or jurisdiction.

Cross-Sector Cyber Security Readiness Goals Toolkit

This resource from the Government of Canada provides concrete actions that can elevate your company's cyber security posture. It presents 36 foundational goals for improving cyber security, grouped into the six pillars of the National Institute of Standards and Technology (NIST) Cybersecurity Framework 2.0. It then matches each goals with intended outcomes; associated risk, such as tactics, techniques, and procedures (TTPs) from MITRE ATT&CK, addressed by the goal; recommended action; and relevant references.

Although these goals were developed for critical infrastructure, and for Canadian businesses and multinational firms operating within Canada, the recommendations herein are applicable to all organisations, regardless of geography or jurisdiction.

United Nations Global Principles For Information Integrity

The United Nations Global Principles for Information Integrity provide a holistic framework to guide multi-stakeholder action for a healthier information ecosystem. This framework consists of five principles for strengthening information integrity, and include societal trust and resilience; healthy incentives; public empowerment; independent, free, and pluralistic media; and transparency and research. These principles are grounded in international law, including international human rights law, and complement the relevant United Nations Guiding Principles on Business and Human Rights, the UNESCO Guidelines for the Governance of Digital Platforms, the UNESCO Recommendation on the Ethics of Artificial Intelligence, and more. The guide also features calls to action for a broad range of actors, including governments, industry, media, and civil society.

Data Protection Laws of the World

DLA Piper's Data Protection Laws of the World Handbook can help you to navigate the complex landscape of privacy and data protection laws worldwide. It provides an extensive overview of key privacy and data protection regulations across more than 160 jurisdictions.

The Ethics of Managing People’s Data

This article identifies five critical issues that companies need to focus on to prevent abuse of data. These include the 'Provenance' of the data, the 'Purpose' for which it will be used, how it is 'Protected', how the 'Privacy' of the data providers is ensured, and how the data is 'Prepared' for use. This resource will be particularly beneficial to senior leaders, sustainability change agents, IT professionals, and anyone involved with data oversight and data-related compliance.

Ransomware: How to prevent and recover

This resource from the Canadian Centre for Cyber Security can help you to prevent and respond to ransomware attacks. It explains how ransomware infects devices and provides practical guidance on how to prepare for and recover from such attacks. This resource will be of particular benefit to senior leaders (including CTOs) and IT managers.

OECD Privacy Guidelines

The OECD Privacy Guidelines, or the "Recommendation of the Council concerning Guidelines Governing the Protection of Privacy and Transborder Flows of Personal Data," were the first internationally-agreed privacy principles. Updated in 2013, these guidelines remain a key privacy benchmark, including for the OECD's internal rules and practices.

The Cyber Resilience Compass: Journeys Towards Resilience

This white paper from the World Economic Forum can you to build your understanding of cyber resilience. The paper explains the concept and practical aspects of cyber resilience, emphasising the need to move beyond technical solutions and develop strategies that align with business objectives. It also introduces the Cyber Resilience Compass - a tool that outlines interrelated categories that can help organisations to define their cyber resilience journey, including leadership; governance, risk, and compliance; people and culture; business processes; technical systems; crisis management; and ecosystem engagement. For each of these categories, the paper highlights key practices, examples, and case studies.

A Comprehensive Guide to Data Encryption

This resource is a good, accessible introduction to data encryption. It explains data encryption; the different states of data; and how to protect data in each of those states.

Cyber Governance for Boards

This resource was created to help boards govern cyber risks with confidence. It has three key components: the Cyber Governance Code of Practice, Cyber Governance Training, and the Cyber Security Toolkit.

The Cyber Governance Code of Practice outlines the key actions needed to govern cyber security risks effectively. It sets out the most critical governance actions that boards need to take ownership of and outlines the responsibilities and accountability required at the board level. The Code is built around five key governance principles: risk management; strategy; people; incident planning, response, and recovery; and assurance oversight. Next, the Cyber Governance Training helps boards and directors deepen their understanding of these actions, providing practical insights into why they matter and how to implement them. It features five interactive training modules aligned with the aforementioned principles. Each module includes an overview of the principle, a short video covering a use-case or scenario, multiple-choice questions, printable documents that summarise key points, and more. Finally, the Cyber Security Toolkit offers in-depth resources that correspond to the principles outlined in the Code, ensuring boards have the tools they need to manage cyber risks comprehensively.

Although created by the UK government for boards and directors of both public and private organisations across the UK, the lessons herein are applicable for boards and companies in any country or region.

OECD AI Principles

These principles promote use of AI that is innovative, trustworthy, and respectful of human rights and democratic values. They consist of five value-based principles: inclusive growth, sustainable development and well-being; human-centred values and fairness; transparency and explainability; robustness, security, and safety; and accountability. This resource also includes key recommendations for policy-makers. These principles will be useful to anyone involved in procuring or implementing AI technologies, as well as for leaders who want to build a better understanding of ethical principles and practices.

Global Digital Compact

The Global Digital Compact is a comprehensive global framework for digital cooperation and governance of digital technologies and artificial intelligence. Negotiated by 193 Member States and informed by global consultations, the Compact commits governments to upholding international law and human rights online and aims ro bring together governments, private sector entities, civil society organisations, and other stakeholders to close digital divides and deliver an inclusive digital economy; build an inclusive, open, safe, and secure digital space; and strengthen international data governance and govern AI for humanity.

Earning Digital Trust: Decision-Making for Trustworthy Technologies