Technology businesses handle significant volumes of customer data, intellectual property and commercially sensitive information. Clients want assurance that those risks are being managed properly, particularly when choosing software providers, managed service providers (MSPs) and other businesses that become part of their digital supply chain.
For tech companies that already have an Information Security Management System (ISMS) certified to ISO 27001, many are now looking to ISO 14001 Environmental Management Systems certification as a logical next step.
Technology has an environmental footprint
It's easy to associate environmental management with industries such as construction, manufacturing, mining or transport.
The environmental impacts are visible.
Technology businesses can look very different. There may be no factory floor, heavy machinery or large quantities of physical waste leaving the site.
But that doesn't mean there isn't an environmental footprint to manage.
Depending on the organisation, environmental considerations might include:
- energy consumption from offices, servers and IT infrastructure
- use of cloud and data centre services
- electronic waste and disposal of obsolete equipment
- procurement of computers, networking equipment and other technology
- business travel
- packaging and consumables
- supplier environmental performance
- lifecycle impacts associated with hardware
- electricity use and associated greenhouse gas emissions.
The nature and significance of those impacts will differ considerably between a small software company and a large managed IT or infrastructure provider.
That's part of the point of ISO 14001.
The standard isn't about applying the same environmental program to every organisation. It's about understanding the environmental aspects relevant to your operations, identifying risks and opportunities, establishing controls and objectives, and continually improving environmental performance.
Why are customers asking more environmental questions?
Technology companies rarely operate in isolation.
They sit inside increasingly complex supply chains, providing software, infrastructure, cloud services, cybersecurity, managed IT and other services to much larger organisations.
Those customers may have their own environmental objectives and commitments.
As a result, procurement teams aren't necessarily looking only at what a technology provider can deliver. They're also interested in how the business operates.
Questions about environmental policies, emissions, waste, energy use, environmental targets and management systems are becoming increasingly familiar within supplier questionnaires and tender processes.
Having an Environmental Management System certified to ISO 14001 provides independent assurance that there is a structured system behind your environmental commitments.
In much the same way that ISO 27001 can provide confidence in the way information security is handled, ISO 14001 can provide confidence in the way environmental responsibilities are managed.
Moving beyond environmental claims
Most businesses today can say that sustainability matters to them.
The harder question is:
What systems are actually in place to manage it?
ISO 14001 provides a framework for turning broad environmental intentions into a structured management approach.
That includes identifying environmental aspects and compliance obligations, setting objectives, establishing responsibilities, monitoring performance, reviewing results and identifying opportunities for improvement.
For a technology company, that could mean setting measurable objectives around energy consumption, improving e-waste management, introducing environmental requirements into procurement decisions or gaining better visibility over significant suppliers.
Certification doesn't mean an organisation has zero environmental impact.
It demonstrates that the organisation has established a management system to understand, control and improve that impact.
You've already done some of the hard work
There's another reason ISO 14001 can make sense for companies already certified to ISO 27001.
You aren't necessarily starting from scratch.
ISO management system standards share a common high-level structure. While the subject matter is different, many of the underlying management processes will already be familiar.
If you have an established ISO 27001 management system, you're likely to already have processes covering areas such as:
- organisational context
- leadership and responsibilities
- risk-based thinking
- objectives
- competence and awareness
- documented information
- internal audits
- management reviews
- corrective action
- continual improvement
ISO 14001 introduces environmental-specific requirements, but many of the broader management system foundations can potentially be integrated rather than duplicated.
One business, not two management systems
This is where an Integrated Management System (IMS) becomes valuable.
Instead of maintaining completely separate systems for information security and environmental management, organisations can integrate common processes.
For example, rather than conducting separate management reviews for every standard, an organisation may be able to review information security and environmental performance within the same broader management review process.
The same principle can apply to internal audits, document control, corrective actions, objectives and organisational responsibilities.
The aim of an Integrated Management System isn't simply to reduce paperwork. It's to build a management system that reflects the way the organisation actually operates.
And if ISO 9001 Quality Management is added to the mix, the organisation can potentially manage quality, environmental performance and information security through one integrated framework.
The business case beyond certification
For some technology companies, the initial motivation for ISO 14001 will be straightforward: a customer or tender asks for it. But there can be broader benefits.
A well-designed Environmental Management System can help an organisation better understand resource use, identify inefficiencies, improve environmental risk management and create clearer accountability for environmental performance.
It can also give sales and tender teams something more substantial to point to when customers ask about environmental credentials.
Rather than relying solely on policies or statements of intent, the business can demonstrate that its environmental management approach has been independently assessed against an internationally recognised standard.
Is ISO 14001 the right next step after ISO 27001?
The decision to pursue ISO 14001 will not be the same for every technology company. It will come back to your organisation's context.
Consider what your customers are asking for, the environmental impacts associated with your operations, the markets you're trying to enter and the requirements appearing in tenders and supplier assessments.
If environmental performance is becoming more important to your customers and stakeholders, adding ISO 14001 to an existing ISO 27001-certified management system may be worth considering.
And because the ISO management system standards are designed to work together, the step from one certification to two may be more achievable than you expect.
Already certified to ISO 27001?
Southpac Certifications provides JAS-ANZ accredited certification to ISO 27001:2022 Information Security Management Systems and ISO 14001:2015 Environmental Management Systems.
If you're already certified to ISO 27001 and are considering adding ISO 14001, talk to our team about how additional certification can be incorporated into your existing certification program.
Get in touch to discuss adding ISO 14001 certification to your existing management system.
.png?width=732&name=Copy%20of%20SP+%20Feature%20Image%20Blog%20(2).png)
