Loading...
Includes data collection (data minimisation; data collection is fit for purpose); data ownership and sovereignty; data governance; records and data management (cybersecurity and data protection; data at rest encryption); prevention of data misuse or unauthorised use; responsible management of personally identifiable information; data use (data comparability; fair and lawful data processing; ethical implications of machine learning; responsible use of artificial intelligence); responsible data retention and disposal; and storage limitations.
Share this Subissue on:LinkedIn
Data is a mission-critical asset for business, and appropriate oversight is essential for the responsible and effective use of data.
Anchored in research, our Data Oversight: A Getting Started Guide helps build an understanding of the importance of data oversight and of how to navigate this rapidly evolving space.
This framework from the National Institute of Standards and Technology (NIST) can help you better manage cybersecurity risks. It provides a common language and systematic methodology for managing this risk, and features a three-component framework. The “Framework Core” unpacks five pillars of a holistic cybersecurity program (Identify, Protect, Detect, Respond, and Recover); the “Implementation Tiers” help you to prioritise your cybersecurity program activities, as per your goals, risk appetite, and budget; and the “Profiles” section helps you to identify areas to improve.
To see how other organisations have implemented the framework, see the “Success Stories” page.
The NIST Privacy Framework (PF) is a voluntary tool that can help you to identify and manage privacy risk and to bring privacy risk into parity with your broader enterprise risk portfolio. The framework is composed of three components: Core, Organisational Profiles, and Tiers. The "Framework Core" provides an increasingly granular set of activities and outcomes that enable organisational dialogue about managing privacy risk; "Organisational Profiles" are a selection of specific functions, categories, and subcategories from the Core that your organisation has prioritised to help manage privacy risk; and "Tiers" support communication about whether your organisation has sufficient processes and resources in place to manage privacy risk.
This framework follows the structure of the Framework for Improving Critical Infrastructure Cybersecurity to facilitate the use of both frameworks together.
This report from the World Economic Forum can help you to navigate the growing complexity of the digital realm and identify essential actions for supporting resilience ecosystems. Produced in collaboration with Accenture, it examines the cybersecurity trends that will affect economies and societies in the year to come, including the impacts of AI, geopolitical volatility, cyber-enabled fraud and phishing, and more. The report is divided into two main section: CEO priorities in a shifting cyber landscape, and trends reshaping cybersecurity. This report will be especially beneficial for sustainability, risk, security, and technology professionals that want to summarise prominent near-future IT- and data-related threats for senior leaders.
This guide from ISAO Standards Organisation can help you understand how to address cybersecurity risks through information sharing, including both ad hoc and structured activities. This guide presents a conceptual framework for joining or forming a formalised Information Sharing and Analysis Organization (ISAO) with other organisations in your sector. It explains information sharing concepts, the types of cybersecurity information you may want to share, how to facilitate information sharing, as privacy and security concerns. The resource will be most useful to IT professionals or others responsible for managing cybersecurity risks.
This concise resource from PwC can help you to become better acquainted with data privacy and to get started on improving your data privacy practices. It explains why data privacy is important, highlights key concepts and principles of data privacy, and unpacks a ten-step framework for creating an effective data privacy programme. This is a good primer for change agents, leaders, and compliance and legal professionals.
This comprehensive resource from Baker McKenzie can help you to navigate the global landscape of data protection, privacy and cybersecurity laws, regulations, and guidance. Updated annually, this handbook provides detailed overviews of a broad range of topics, and allows for sophisticated comparisons of jurisdictions. This resource will be of particular use to information technology and security professionals and legal teams.
This paper from Public Knowledge can show you why cybersecurity should be treated as a sustainability issue. It begins by offering a broad definition of cybersecurity and its role in protecting trust in - and security of - digital infrastructure, including the internet. It then highlights how cybersecurity faces challenges that are parallel to the sustainability field, such as short-termism, tradeoffs, and a lack of resilience. The paper recommends that organisations draw on sustainability management practices to help address these cybersecurity challenges, and outlines the broader implications of cybersecurity for national security and the digital infrastructure that today’s economies rely on. This resource would be helpful for both IT leaders and sustainability professionals.
This article can help you to assess your board's understanding of cybersecurity, raise awareness on the issue, and prioritise action. The article highlights five key things directors need to know about cybersecurity, as well as seven questions you can ask to make sure your board understands how cybersecurity is being managed.
This short resource from the Data Protection Committee provides a brief, high-level overview of the Principles of Data Protection found in the EU's General Data Protection Regulation. These principles include lawfulness, fairness, and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality; and accountability. This overview provides an accessible introduction to the principles of data protection, and is a good starting point for sustainability professionals, managers, and senior leaders.
Although these key principles were created with the European Union and European Economic Area in mind, they provide a practical, appropriate, and effective reference point for businesses operating in other regions and jurisdictions.
This concise response plan from the Government of Canada is a good primer for developing and implementing a cybersecurity incident response plan. It can help you to identify the information and systems that are of value to your organisation; determine the types of incidents your organisation may face; consider who is qualified to be on the response team; and more. It also details the phases of the incident response life cycle.
The OECD's Recommendation on Information Integrity represents the first international soft law on information integrity. It aims to provide guidance for policy-makers to promote information integrity in line with the universal human rights of freedom of opinion and expression. This resource can help you to better understand and support global efforts to advance information integrity.
The Canadian Centre for Cyber Security’s Cyber Security Readiness Goals (CRGs) were developed in response to the growing susceptibility of critical infrastructure (CI) to cyber threats. This guide provides an introduction to the CRGs, and explains how they were developed and how they can be used to enhance cybersecurity and minimise potential risks to society, public safety, and the overall stability of the Canadian economy. The CRGs can be found in full in the Cross-Sector Cyber Security Readiness Goals Toolkit.
Although these goals were developed for critical infrastructure, and for Canadian businesses and multinational firms operating within Canada, the recommendations herein are applicable to all organisations, regardless of geography or jurisdiction.
This resource from the Government of Canada provides concrete actions that can elevate your company's cyber security posture. It presents 36 foundational goals for improving cyber security, grouped into the six pillars of the National Institute of Standards and Technology (NIST) Cybersecurity Framework 2.0. It then matches each goals with intended outcomes; associated risk, such as tactics, techniques, and procedures (TTPs) from MITRE ATT&CK, addressed by the goal; recommended action; and relevant references.
Although these goals were developed for critical infrastructure, and for Canadian businesses and multinational firms operating within Canada, the recommendations herein are applicable to all organisations, regardless of geography or jurisdiction.
The United Nations Global Principles for Information Integrity provide a holistic framework to guide multi-stakeholder action for a healthier information ecosystem. This framework consists of five principles for strengthening information integrity, and include societal trust and resilience; healthy incentives; public empowerment; independent, free, and pluralistic media; and transparency and research. These principles are grounded in international law, including international human rights law, and complement the relevant United Nations Guiding Principles on Business and Human Rights, the UNESCO Guidelines for the Governance of Digital Platforms, the UNESCO Recommendation on the Ethics of Artificial Intelligence, and more. The guide also features calls to action for a broad range of actors, including governments, industry, media, and civil society.
DLA Piper's Data Protection Laws of the World Handbook can help you to navigate the complex landscape of privacy and data protection laws worldwide. It provides an extensive overview of key privacy and data protection regulations across more than 160 jurisdictions.
This article identifies five critical issues that companies need to focus on to prevent abuse of data. These include the 'Provenance' of the data, the 'Purpose' for which it will be used, how it is 'Protected', how the 'Privacy' of the data providers is ensured, and how the data is 'Prepared' for use. This resource will be particularly beneficial to senior leaders, sustainability change agents, IT professionals, and anyone involved with data oversight and data-related compliance.
This resource from the Canadian Centre for Cyber Security can help you to prevent and respond to ransomware attacks. It explains how ransomware infects devices and provides practical guidance on how to prepare for and recover from such attacks. This resource will be of particular benefit to senior leaders (including CTOs) and IT managers.
The OECD Privacy Guidelines, or the "Recommendation of the Council concerning Guidelines Governing the Protection of Privacy and Transborder Flows of Personal Data," were the first internationally-agreed privacy principles. Updated in 2013, these guidelines remain a key privacy benchmark, including for the OECD's internal rules and practices.
This white paper from the World Economic Forum can you to build your understanding of cyber resilience. The paper explains the concept and practical aspects of cyber resilience, emphasising the need to move beyond technical solutions and develop strategies that align with business objectives. It also introduces the Cyber Resilience Compass - a tool that outlines interrelated categories that can help organisations to define their cyber resilience journey, including leadership; governance, risk, and compliance; people and culture; business processes; technical systems; crisis management; and ecosystem engagement. For each of these categories, the paper highlights key practices, examples, and case studies.
This resource is a good, accessible introduction to data encryption. It explains data encryption; the different states of data; and how to protect data in each of those states.
This resource was created to help boards govern cyber risks with confidence. It has three key components: the Cyber Governance Code of Practice, Cyber Governance Training, and the Cyber Security Toolkit.
The Cyber Governance Code of Practice outlines the key actions needed to govern cyber security risks effectively. It sets out the most critical governance actions that boards need to take ownership of and outlines the responsibilities and accountability required at the board level. The Code is built around five key governance principles: risk management; strategy; people; incident planning, response, and recovery; and assurance oversight. Next, the Cyber Governance Training helps boards and directors deepen their understanding of these actions, providing practical insights into why they matter and how to implement them. It features five interactive training modules aligned with the aforementioned principles. Each module includes an overview of the principle, a short video covering a use-case or scenario, multiple-choice questions, printable documents that summarise key points, and more. Finally, the Cyber Security Toolkit offers in-depth resources that correspond to the principles outlined in the Code, ensuring boards have the tools they need to manage cyber risks comprehensively.
Although created by the UK government for boards and directors of both public and private organisations across the UK, the lessons herein are applicable for boards and companies in any country or region.
These principles promote use of AI that is innovative, trustworthy, and respectful of human rights and democratic values. They consist of five value-based principles: inclusive growth, sustainable development and well-being; human-centred values and fairness; transparency and explainability; robustness, security, and safety; and accountability. This resource also includes key recommendations for policy-makers. These principles will be useful to anyone involved in procuring or implementing AI technologies, as well as for leaders who want to build a better understanding of ethical principles and practices.
This report from the Organisation for Economic Co-operation and Development (OECD) provides practical guidance that can help you to implement OECD standards on responsible business conduct and the OECD AI Principles when developing and using artificial intelligence. It aims to support innovation, investment, and growth of enterprises in the AI value chain by helping enterprises to proactively address adverse impacts, and - where appropriate - promotes policy coherence between the OECD and other national or international AI risk management frameworks. This resource will be especially beneficial to sustainability and technology professionals, as well as senior leaders.
This brief from the Governance & Accountability Institute is an accessible primer on the OECD's Due Diligence Guidance for Responsible AI, and especially for senior leaders. It unpacks the six-step due diligence process that underpins the OECD's guidance; explains the risks the guidance addresses across suppliers, operators, and users of AI systems; and highlights why the OECD guidance matters for companies aiming to stay ahead of tightening global compliance expectations. It lays out six due diligence steps: embedding OECD guidance on responsible business into policies and management systems; identifying and assessing actual and potential adverse impacts; ceasing, preventing, and mitigating adverse impacts; tracking implementation and results of due diligence activities; communicating actions to address impacts; and providing for or co-operating in remediation when appropriate.
Adopted in 2021, the UNESCO Recommendation on the Ethics of Artificial Intelligence is the first global standard on AI ethics. The Recommendation focuses on human rights and fundamental freedoms in the context of AI, providing a framework for the ethical development and deployment of AI systems. It also explores related policy issues such as ethical governance and stewardship, gender, culture, education and research, and more.
The Artificial Intelligence Act is a European Union regulation that establishes a common regulatory and legal framework for AI within the EU. The act covers all types of AI across a broad range of sectors, and - aside from exemptions for national security, military, research, and non-professional purposes - classifies AI applications by their risk of causing harm: unacceptable, high, limited, and minimal risk. Depending on their level of risk, AI applications may be banned outright or required to comply with security, transparency, and quality obligations. The act also established a European Artificial Intelligence Board to ensure compliance and promote national cooperation.
The National Institute of Standards and Technology (NIST) has developed this non-sector-specific, use-case agnostic, and practical framework to help individuals, organisations, and societies manage risks related to artificial intelligence (AI). Intended for voluntary use, the AI Risk Management Framework (RMF) was created to improve the ability to incorporate trustworthiness considerations into the design, development, use, and evaluation of AI products, services, and systems. This framework is centered around four core functions that organise AI risk management activities at their highest level, enabling you to better govern, map, measure, and manage these risks.
The NIST has developed a companion resource, the AI RMF Playbook, which provides suggested actions for achieving the outcomes laid out in the AI RMF. The suggestions are aligned to each of the aforementioned sub-categories. The NIST has also launched the Trustworthy and Responsible AI Resource Center, which was developed to support and operationalise the AI RMF and the accompanying playbook.
The High-Level Expert Group on AI has created ethics guidelines to promote trustworthy artificial intelligence (AI). According to the guidelines, trustworthy AI should be lawful, respecting all applicable laws and regulations; ethical, respecting all ethical principles and values; and robust, from both a technical and social environmental perspective. This guidance introduces seven key requirements that AI systems should meet in order to be deemed trustworthy and highlights assessment criteria to verify these requirements are being met. This is an importance resource for senior leaders, technology experts, and sustainability change agents of any large organisation that is considering developing and/or implementing AI into their operations. The High-Level Expert Group on AI was set up by the European Commission, the principles and recommendations of their guidance are applicable to every business regardless of industry or geography.
AI is rapidly being embedded across companies’ products, services, and internal operations, yet credible governance and disclosure are not evolving at the same pace. This report from the AI Company Data Initiative (AICDI) – the result of a partnership between the Thomson Reuters Foundation and UNESCO – can help you to better understand corporate practice in the context of the emerging responsible AI regulatory landscape. Based on information gathered from nearly 3,000 companies across 11 sectors and six regions on AI-related adoption and strategies, the report finds that AI maturity varies significantly across the industry spectrum; that a disconnect exists between many companies' high-level AI strategies and operational AI practices; and that significant gaps exist in training and transparency. The report explains why responsible AI matters now; unpacks the regulatory and framework landscape; and explores key thematic findings. It also provides a range of case studies, an investor engagement checklist, responsible AI principles for proxy voting, and more. This resource will be especially beneficial to senior leaders and operations managers.
This report from the United Nations University Institute for Water, Environment and Health (UNU-INWEH) can help you to understand the growing scope and scale of the environmental costs of AI and data centers. The report quantifies the carbon, water, and land footprints of AI use around the world, noting that by 2030 global data centres powering artificial intelligence are projected to consume 945 terawatt-hours of electricity by 2030; use the equivalent of the basic annual domestic water needs of all 1.3 billion people in Sub-Saharan Africa; and have a land footprint that exceeds 14,500 square kilometers - approximately double the size of the Jakarta metropolitan area, which is home to more than 32 million people.
The report explains that AI’s environmental costs depend not only on how much electricity is used, but also on where that electricity is generated and which energy sources power it. The report also explains that AI’s footprint is shaped by both major infrastructure trends, including the rapid growth of data centers, and everyday use patterns, such as model choice, output length, modality, and the growing use of text, image, and video generation. The report calls for a responsible AI ecosystem built on six principles (transparency; efficiency by design; equity and environmental justice; lifecycle responsibility; global cooperation; and sustainable use), and provides practical recommendations for key stakeholders.
BSR has produced a series of guides on generative AI to support responsible AI practitioners and to encourage greater transparency in the field of human rights and genAI. BSR conducted a human rights assessment to identify and assess the actual and potential human rights risks and opportunities associated with genAI throughout the value chain. They then created a series of practitioner guides that advise those working on responsible AI on how to incorporate a human rights-based approach to their work.
Together, these nine guides address the following topics:
Overview of Responsible AI Practitioner Guides
Guide 1: Fundamentals of a Human Rights-Based Approach to Generative AI
Guide 2: Governance and Management
Guide 3: Impact Assessment
Guide 4: Risk Mitigation
Guide 5: Conducting Stakeholder Engagement
Guide 6: Policies and Enforcement
Guide 7: Aligning Transparency and Disclosure Practices with Human Rights Responsibilities
Guide 8: Remedy for Generative AI-Related Harms
These principles and practical specifications from Forética can help you to ensure that the development and use of AI products sustainability outcomes.
This report from AI Now Institute can help you understand the diversity crises in the AI industry and the risk of bias it creates for those using AI tools. The report explains how AI tools suffer from systemic (gender and racial) bias, and quantifies the large and stagnant workforce diversity imbalance in the field of AI. It explains how this lack of diversity creates biased AI systems that negatively impact under-represented groups. It also explains the lack of progress made by existing efforts to address the issue, and provides recommendations for taking a new approach. This report will be most useful to IT, sustainability, and HR teams, or anyone implementing or developing AI tools.
This primer provides a helpful high-level summary of artificial intelligence that will benefit executives, board members, and other business leaders. It explains the concept and types of AI, as well as their impact on workers; highlights the risks of data bias and insecurity, privacy concerns, and regulatory risks; and examines the opportunities, such as those related to workforce training and collaborative machine-human applications.
This series of briefing papers published by the World Economic Forum can help you understand the multifaceted challenges and opportunities involved in developing, deploying, and using generative AI. The first paper outlines the importance of establishing safety guidelines across the AI model lifecycle. The second paper focuses on assessing potential AI use cases and how to avoid negative downstream consequences. The third paper highlights key debates in generative AI and the importance of inclusive and international cooperation on AI governance. These resources will be most useful to IT professionals as well as decision-makers exploring AI use cases within their business.
This series of explainers from McKinsey can help you to better understand seven technologies that are reshaping societies, industries, and economies: artificial intelligence, generative artificial intelligence, artificial general intelligence, deep learning, prompt engineering, machine learning, and tokenization. These explainers provide an accessible introduction to corporate professionals, regardless of role or experience.
Generative artificial intelligence (Gen AI) models are resource-intensive, and it is imperative that they remain within the guardrails of environmental sustainability. This report from Capgemini can help you to understand the environmental impact of Gen AI, as well as the potential of Gen AI to drive sustainable business value. The report sets out a roadmap for creating responsible Gen AI for sustainable business value, which includes identifying the right technology to address business needs; assessing and mitigating Gen AI's environmental impact; investing in and scaling the right use cases to accelerate sustainable business value; developing the right data and technology foundations; and setting governance for sustainable Gen AI.
This report from Scottish Widows can help you to understand key governance risks and evolving considerations associated with AI investments. It explores why AI matters to investors; explains the governance gaps, including a lack of transparency, regulatory uncertainty, and systemic concentration; and the investor response, including the steps investors are already taking to hold companies accountable for AI oversight. It also provides a practical framework to help institutional investors ensure that AI development and use contributes to sustainable, long-term outcomes.
This article from the International Institute for Management Development (IMD) can help you to become more familiar with the concept of AI ethics. It provides a brief summary of AI ethics; key ethical issues and challenges in AI; developing and implementing ethical AI frameworks; the role of stakeholders in AI ethics; and more. This article will be particularly helpful to senior leaders who want to quickly build their understanding of AI ethics.
AI is embedded in a growing number of technologies and economic activities, and without ethical and equitable direction, this infusion will continue to drive negative impacts on society and the environment. This article from the Stockholm Resilience Centre introduces a new guiding principle - "Earth alignment" - that can help you to ensure that AI supports a stable biosphere. Earth alignment aims to steer the development and use of AI in ways that promote sustainable development for all by focusing on aligning AI’s development and deployment with the need to reduce greenhouse gas emissions, protect biodiversity, and support equitable access to sustainability tools. The proposed framework includes three criteria that AI development and use need to fulfil to achieve strong Earth alignment: accelerate the transition to sustainable production and consumption in ways that respect planetary boundaries or at least do not obstruct them; ensure equitable access to AI tools for global sustainability and prevent power concentration, especially in low-income regions; and foster social cohesion and trust and provide access to reliable information for planetary stewardship.
This white paper from the World Economic Forum can help you to better understand the potential futures arising from the interaction and intersection of AI advancement and talent development. Consolidating the views and insights from chief strategy officers and other experts around cross-cutting risks and opportunities, the paper provides four potential scenarios: Supercharged Progress, The Age of Displacement, Co-Pilot Economy, and Stalled Progress. This resource will be especially beneficial to sustainability practitioners, risk and strategy professionals, and senior leaders.
This accessible guide from Watershed can help you to better understand the emissions-related impacts of AI. It explains where AI emissions come from; the forces shaping AI's climate impact; responsible procurement strategies to influence AI providers on transparency and impact; insights into measuring and estimating AI emissions; and more. This resource will be especially beneficial as a primer for senior leaders.
The paper can help you to better understand how AI has the potential both to radically increase and reduce negative environmental effects. Synthesising recent advances, the paper proposes a typology of effects through which AI shapes environmental outcomes: efficiency and footprint effects, prebound and rebound effects, and unlocking and path-escalating effects. The paper highlights how these effects are not properties of AI itself; rather, they emerge based on how firms choose to manage the interactions between effects. To help contextualise the interplay of effects and strategic choices, the paper introduces three AI adoption configurations - sustainability-amplifying, productivity-stabilising, and harm-amplifying AI adoption - and provides actionable guidance for managers, change agents, and policymakers seeking to steer AI deployment towards sustainable effects.
The Global Digital Compact is a comprehensive global framework for digital cooperation and governance of digital technologies and artificial intelligence. Negotiated by 193 Member States and informed by global consultations, the Compact commits governments to upholding international law and human rights online and aims ro bring together governments, private sector entities, civil society organisations, and other stakeholders to close digital divides and deliver an inclusive digital economy; build an inclusive, open, safe, and secure digital space; and strengthen international data governance and govern AI for humanity.
Failures related to digital technologies (such as artificial intelligence, the security of personal information, and algorithmic predictions) have eroded societal confidence at an unprecedented scale and rate and are contributing to broad and growing mistrust in science and technology. This insight paper from the World Economic Forum can help you to make better, more trustworthy decisions regarding technology. It defines "digital trust" globally and introduces a "digital trust framework" to guide decision-making. The framework defines shared goals or values that inform the concept of digital trust, including security and reliability; accountability and oversight; and inclusive, ethical, and responsible use. The framework further defines eight dimensions against which the trustworthiness of digital technologies can be operationalised and evaluated: cybersecurity, safety, transparency, interoperability, auditability, redressability, fairness, and privacy. This paper also lays out a four-step digital trust roadmap that can help guide and align decision-making with societal expectations.
The first in a two-part series, this article defines data inequality and identifies three common areas of inequality: data access and availability, data representation, and data workflows.
The second article in a two-part series, this resource identifies seven intersectional practices that can help you to promote more equitable data access, collection, representation, and analysis.can help you
This article from Oracle can help you to understand data sovereignty, including what data sovereignty is, why it's important, and how it differs from data localisation, data residency, and data privacy. It also identifies key data sovereignty challenges and best practices.
The FAIR Guiding Principles were created to improve the Findability, Accessibility, Interoperability, and Reuse of digital assets. First published in 2016 in the journal Scientific Data for scientific and research data, they have become internationally recognised for their applicability to the management of data across multiple domains. Managing data according to the FAIR principles supports the open and strategic management of data and can help your organisation to enhance its reusability and promote effective data stewardship across the organisation (and throughout your value chain). Enhancing data reusability allows for it to have an impact beyond its original purpose, such as enabling the use of automated decision systems and supporting the delivery of services.
The CARE Principles - and the other resources available on the Global Indigenous Digital Alliance (GIDA) website - can help you to affirm Indigenous rights to self-determination through data practices that address complex issues related to privacy, future use, and collective interests. GIDA developed the CARE Principles to prioritise Indigenous rights, interests, and control over their data and knowledge, and to ensure that Indigenous data is used in ways that align with Indigenous values and aspirations. Existing principles within the open data movement (such as the FAIR Principles) primarily focus on characteristics of data that will facilitate increased data sharing among entities while ignoring power differentials and historical contexts. In response, the CARE Principles for Indigenous Data Sovereignty were created to complement standards like the FAIR principles by addressing historical power imbalances and promoting genuine Indigenous leadership in data stewardship. This people-centered framework emphasises Collective Benefit, Authority to Control, Responsibility, and Ethics to ensure that data use reinforces the rights of Indigenous Peoples to engage in decision-making in accordance with Indigenous values and collective interests.