Is Climate Change an Issue for Your ISO Certification?

Originally published by Schellman.

On February 23, 2024, ISO (along with the International Accreditation Federation (IAF)) published short amendments to all standards aligned with its Harmonized Structure. In the form of new requirement language and one additional note, ISO has now adapted climate change concerns as considerations for a wide range of popular certifications.

More specifically, Clause 4.1 (Understanding the organization and its context) within the affected standards now asks organizations to “determine whether climate change is a relevant issue” while a note under Clause 4.2 (Understanding the needs and expectations of interested parties) suggests that “relevant interested parties can have requirements related to climate change.”

Though it does initially appear that these changes will allow for a “comply or explain” approach, their addition may indicate— that if your company affirms both—you may have a compliance obligation to account for climate change risk under your relevant certification.

In this article, we’ll break down the relevance of climate change in three popular ISO standards—27001, 22301, and 42001—so that when you consider your compliance obligations under these frameworks, you’ll know where to start in determining how applicable these concerns are to your certification.

What ISO Standards are Concerned with Climate Change?

In all, the amendment to account for climate change covers all Type A Management Systems Standards (MSS) that follow the Harmonized Structure—that’s about 30 of the most widely used standards, which include:

• ISO 14001: Environmental
• ISO 27001: Information security, cybersecurity, and privacy protection
• ISO 22301: Business continuity
• ISO 42001: Artificial intelligence

Obviously, climate change—being an environmental issue—is enormously pertinent to ISO 14001, but its relevance to the other standards may not be as evident. So, here are some examples as to how you, as an organization applying one or more of these standards, may see climate change as relevant.

Climate Change and Information Security (ISO 27001)

The information technology (IT) revolution has brought tremendous capacity for the world to tackle climate change, be it:

• The promise of the Internet of Things in data collection
• The immutability blockchain brings to the transfer of the same data; or
• The ability of AI to help us with climate modeling.

But harnessing all that potential in technology on the march to global decarbonization depends on that technology remaining trustworthy—and that depends on the tech remaining secure.

At the same time, the necessary tools for information security are not an insignificant consumer of energy, and its share of global greenhouse gas emissions is destined to grow much faster than those of other industries, and brands, buyers, and regulators have already noticed—some are proactively increasing their focus and pressure for critical and growing data infrastructure to go green.

Second only to efficiency gains, green energy procurement is the most effective way for technology companies to transition from fossil fuel energy sources. But as organizations make that transition to better manage their energy response with renewable energy, the necessary use of smart grids will consequently enlarge the cyberattack surface for each connected utility.

Climate Change and Business Continuity (ISO 22301)

If information security controls should now account for climate transition risks, then those for business continuity must account for physical climate risks—or, those that can affect your organization’s ability to respond and adapt to extreme weather events, as well as rising sea levels.

But these extreme weather events—storms, flooding, drought—aren’t anything new, so any organization that has previously considered them as part of its emergency response and resilience plan is already identifying climate change as relevant, even if not explicitly.

Such extreme weather can be a disruptor anywhere upstream or downstream of the organization, so that business continuity risk may extend to your supply chains, as—for some—the short-term and long-term effects of physical climate risk on service and product delivery may be predominantly outside your direct control.

Climate Change and Artificial Intelligence (ISO 42001)

We mentioned earlier the potential of various emerging technologies—IoT, blockchain, AI—in global decarbonization, but, of them all, AI could be the real game-changer.

That’s because—as designed—AI should be able to:

• Perform the complex analysis of your organization’s true allocation so that you can contribute toward averting a global climate tipping point; and
• Make science-based decisions regarding:
  • How to best stay on a net zero pathway;
  • How to maximize each lever; and
  • Even how to make course corrections as the science evolves.

However, taking advantage of this potential (power) will mean accepting great responsibility. Calculating greenhouse gas emissions and the allocation of responsibilities for their reduction is complicated, and climate change scenario models rely on ever-improving data sets, with estimations and assumptions made on various industrial considerations. Ensuring that AI can do those jobs credibly will require these systems to remain trustworthy, ethical, and transparent.

How to Address Climate Change in Your ISO Certification

All these risks that climate change introduces or exacerbates—those to information security, business continuity, and responsible AI management—can also potentially affect your ISO certification in these areas (as well as the other now-aligned Type A Management Systems Standards also amended by ISO/IAF).

So, if you’ve implemented any of these management systems—including the three we’ve discussed here—you must:

• Determine whether climate change is relevant to the achievement of your management system’s targets;
• Document this conclusion, as well as the client or regulatory climate obligations you considered in coming to it; and
• Audit that determination either internally or externally.

If it becomes clear that climate change is relevant and material to your organization due to compliance obligations, your organization’s competitiveness, or even due to efficiency gains, consider extending your management system and taking the proactive step of adopting an international climate risk framework, such as the International Financial Reporting Standards S2 standard.

Further Considerations for Your Environmental Impact

As climate change continues to affect the planet, the ripple effect could extend to something even so specific as your ISO certification. Now that you understand a little bit more about how these environmental risks may affect your information security, business continuity, and AI management, you can begin investigating more concretely as to whether they do.

In the meantime, check out our other content that can also help inform your environmental initiatives:

• 5 Benefits of Investing in ESG Reporting
• How to Prepare for Supply Chain Sustainability Data Demands
• What is the Carbon Disclosure Project (CDP) Framework?