A number of money management executives said some clients view cybersecurity as an ESG issue, while others said the questions are not yet being asked. "We are seeing clients take a greater interest in cybersecurity, which is increasingly becoming a talking point at client meetings and asked about in client communications," said David Sheasby, Edinburgh-based head of stewardship and ESG at Martin Currie Investment Management Ltd. "As investors, we take cybersecurity very seriously and are assigning an increasing weight to this issue in our analysis and company engagement." The firm is part of the PRI's collaborative work on the topic. For the managers themselves, the issue is a consideration within investment portfolios. "Whether it is an ESG or a business issue is less of a concern for us, what matters is the relevancy to the companies in our portfolio," said David Shammai, senior responsible investment and governance specialist at APG Asset Management in Amsterdam, which runs assets for the €394 billion ($470.4 billion) ABP, Heerlen, Netherlands. "It can be viewed as an ESG issue given the marketwide applicability, the need for collaboration regardless of the investment strategy and perhaps also the ethical dimension. At the same time, this is really a business matter that for most companies is a lot to do with risk management and systems — clear business issues." APG has an "integrative approach with members of the ESG team and the investment teams working collaboratively, sharing knowledge and working jointly on engagements with our portfolio companies," added Mr. Shammai. Regarding where it fits on the ESG spectrum, sources locate cybersecurity across both social and governance factors. Cybersecurity is a wide issue, said Felipe Gordillo, Paris-based senior ESG analyst at BNP Paribas Asset Management, speaking on a panel discussion on the topic at the PRI in Person annual conference in Berlin on Sept. 25. Thinking about the relationship with climate change, for example, autonomous cars are a much-cited development. "You need data for that, but (you need) cybersecurity to know the car won't get hacked," he said. "I think about cybersecurity from two pillars: It is a social issue, about the quality and safety of products" and there is a corporate governance angle," he said. Speaking on the same panel, Adam Black, head of ESG and sustainability at Coller Capital in London, added executives are "looking for competence" at companies when it comes to the issue of cybersecurity. "And due diligence … it is a living issue, and needs to be embedded in the lifecycle of an investment." Coller Capital's latest Global Private Equity Barometer, released in June, found 45% of limited partners will require their general partners to undertake cybersecurity risk assessments for their portfolio companies within three to five years. Currently only 9% require this of their GPs. Insight Investment executives view cybersecurity as an ESG issue because "responsibility for ensuring IT security is as good as it can be rests with the board of directors. Strong governance by the board, typically through the audit and risk function, should ensure the right questions are being asked and executive management is challenged. But cybersecurity is also a social issue — it has to be when there is the potential for so many customers and non-customers to be impacted," said Mr. Averre. The issue has been on the agenda for some time at BlueBay Asset Management, which signed on to the PRI's cybersecurity working group. "Cybersecurity is an ESG issue in the sense that it raises ethical and human rights concerns about data privacy and data security," such as who has control or ownership of personal data and whether consent has been sought and gained on the use of that data, said My-Linh Ngo, senior ESG analyst with BlueBay in London. "It also links to issues of customer relations in terms of impact on trust and loyalty." She said high-profile attacks have raised investor awareness.
Institutions focus on environmental , social and governance factors when picking investments are scrutinising companies 's cyber polices . Such investors want to see investors take a proactive approach when it comes to cyber security issues , recognising cyber risk is an important factor of firms to pay attention to . Institutional investors are also recognising the damage a major cyber breach can have on a company 's stock price .