SIG (Shared Assessments) O: Answer the ESG risk domain

What does O require?

SIG risk domain O, Environmental, Social and Governance (ESG). Since the 2023 release ESG questions form their own risk domain, migrated from the former Compliance and Operations domains, covering the third party's environmental, social and governance practices relevant to the relationship. The documents name the domain and its origin but not its questions.

Maintained by Gerard BlokdykVerified against the published standard 31 May 2026Control text last updated 21 May 2026

Other controls in SIG risk domains (2024 release) – SIG (Shared Assessments)

A Operate an enterprise risk management and risk governance program
B Manage the risk of the third party's own vendors (fourth and Nth parties)
C Maintain an information security program, policy and organisation
D Inventory, classify and handle information assets through their lifecycle
E Apply personnel controls before, during and after employment
F Protect facilities and equipment that support the service
G Run controlled IT operations: change, patch, capacity, database, problem and monitoring processes
H Control logical access across endpoints with authentication, least privilege and privileged access management

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpoint All SIG (Shared Assessments) controls