The Corporate Sustainability Reporting Directive (CSRD) has been in force for large companies since financial year 2024, and extends to companies with more than 250 employees from 2026. In the vast majority of organisations concerned, the sustainability report has been entrusted to CSR teams, with only marginal input from the CISO. This is a structural mistake, and it is beginning to show up in statutory audits.
The CSRD framework: double materiality and cyber incidents
The CSRD introduces the concept of double materiality: information is material if it has an impact on the environment or society (impact materiality), but also if an external risk or opportunity can have a significant financial impact on the company (financial materiality). Cybersecurity incidents satisfy both criteria without any stretch of interpretation.
A ransomware incident simultaneously affects customers' personal data (societal impact, GDPR link), operational continuity (direct financial materiality) and the organisation's reputation (deferred financial materiality). In 2025, the average cost of a data breach in Europe was EUR 4.45 million according to IBM, a figure that, in the strict sense of the ESRS, constitutes a material risk.
Yet the double materiality analysis of most CSRD reports treats cyber risk as a sub-item of generic operational risk, with no link to the NIS2 mappings or DORA registers that GRC teams have already produced. Two parallel worlds, two teams, zero alignment.
The three ESRS obligations that directly involve your CISO
The European Sustainability Reporting Standards (ESRS) contain several entry points for cybersecurity. Three are immediately actionable.
ESRS 2, IRO-1 (identification of impacts, risks and opportunities). ESRS 2 is the mandatory cross-cutting standard. It requires systematic identification of material risks, their probability of occurrence, and the management measures in place. If your organisation is within the scope of NIS2 or DORA, you already have a risk mapping compliant with Article 21. This document can be reused directly as input for IRO-1, provided the teams talk to each other. The common mistake: the CSR department conducts an independent materiality analysis that reinvents the wheel while ignoring the existing GRC work.
ESRS S4, consumers and end-users. This standard covers the protection of customers' personal data and privacy. It is formally distinct from the GDPR but covers exactly the same obligations. Organisations that have structured a compliant record of processing activities and documented their legal bases are already ahead. The pitfall: the CSRD report must include qualitative and quantitative indicators (number of reported data incidents, resolution rate, complaint mechanisms). This data lives with your DPO, not with your CSR team.
ESRS G1, business conduct. G1 covers risk management and internal controls, a territory that is naturally GRC. Disclosure requirement G1-3 calls for a description of the processes for preventing and detecting corruption, but more broadly also of internal control arrangements covering significant risks. A documented information security management system (ISMS) and NIS2 controls are exactly what statutory auditors will look for here.
The systemic error: the CISO absent from the materiality process
In organisations that have already produced a first CSRD report, a recurring pattern emerges. The double materiality analysis was conducted through multi-stakeholder workshops where the GRC and security teams were either absent or consulted at the end of the process. The result: cyber risk appears in the report, but is described in generic CSR language, without operational granularity, without any link to the NIS2/DORA registers, and without measurable indicators.
This is a governance problem before it is a technical one. The CSRD was seen as a CSR subject. Cybersecurity was seen as an IT subject. Regulatory compliance (GDPR, NIS2, DORA) was seen as a legal subject. These three silos produced three partial reports which, taken together, satisfy no rigorous auditor.
Statutory auditors are aware of this. The IAASB published the first assurance guidance on CSRD sustainability reports in 2025. Auditors trained in ISAE 3000 will ask for traceability between the materiality analysis and the operational data, precisely where the GRC/CSR silo becomes visible.
Four steps to align GRC and CSRD
1. Inventory of cyber IROs. Extract from your NIS2 or DORA mapping the risks with a non-negligible annual probability of occurrence and a documented potential financial impact. These elements form the basis of your contribution to ESRS 2 IRO-1. Expected format: risk, plus probability (qualitative or quantitative), plus measures in place, plus monitoring indicator.
2. Double materiality scoring. For each cyber risk identified, apply both dimensions: financial impact on the organisation (financial materiality) and impact on stakeholders, including customers, employees and society (impact materiality). A ransomware attack on a payroll system is doubly material. Four hours of unavailability of an internal collaboration tool probably is not. This granularity is what distinguishes a credible CSRD report from a communication document.
3. Integration into the sustainability statements. GRC indicators can feed the CSRD tables directly: number of security incidents reported to ANSSI (NIS2 Art. 23), availability rate of critical systems (DORA), number of ICT subcontractors assessed (DORA third-party risk management), MFA coverage on administrative accounts. These metrics are already in your dashboards. They deserve to be in your report.
4. Joint review with the statutory auditors. Plan a working session between the CISO, the DPO, the compliance officer and the statutory auditors before the financial year closes. The objective: align the narrative description of cyber risks in the report with the operational evidence available. If this session is held too late, it generates stressful requests for justification. If held in advance, it avoids 80 % of back-and-forth exchanges.
Assessing your GRC-CSRD alignment
Maturity on this topic can be tested with three direct questions. Does your CSR lead know that your NIS2 register exists? Are your operational security indicators (MFA rate, average time to patch critical vulnerabilities, number of reported incidents) integrated into the sustainability report? Did the double materiality analysis explicitly include cyber risks with their probability and estimated financial impact?
If the answer to any of these questions is "no" or "I don't know", your organisation has a CSRD blind spot that the next reporting cycle will expose. The Valtieri teams support organisations in building an aligned GRC-CSRD reporting process: see our analysis of GRC automation: ROI and reality and mapping supplier risks. For a diagnosis of your current situation: contact us.
Conclusion
Three points to take away. Cyber risk is doubly material within the meaning of the CSRD: a direct financial impact and a societal impact on stakeholders. The NIS2 and DORA mappings you have already built are a direct input for the IRO-1 analysis, provided you break down the GRC/CSR silo. Auditors trained in CSRD assurance will look for traceability between the narrative of the report and the operational data: the teams that have prepared this in advance will be the only ones not improvising.
Organisations that arrive at the next CSRD cycle with structured GRC-CSR alignment are not the ones that did the most extra work. They are the ones that avoided doing it twice.