What is California SB 253 and who does it apply to?

SB 253 is California's Climate Corporate Data Accountability Act, requiring companies with $1 billion or more in annual revenue that do business in California to publicly disclose Scope 1 and Scope 2 greenhouse gas emissions. The law uses the GHG Protocol as its required methodology. First reports are due August 10 of this year for Scope 1 and 2 data, with Scope 3 reporting requirements following in subsequent years.

What does GHG Protocol-aligned reporting mean for SB 253?

GHG Protocol is the internationally recognized standard for measuring and reporting greenhouse gas emissions. For SB 253, companies must calculate their Scope 1 and Scope 2 emissions using either the financial control or operational control consolidation approach defined by GHG Protocol. Choosing the right boundary for your organization is one of the first and most consequential decisions in building a compliant emissions inventory.

Does the rescission of the federal climate disclosure rule affect SB 253?

No. SB 253 is California state law and operates independently of any federal rulemaking. Companies that paused their sustainability reporting programs in anticipation of federal relief still face the California deadline. CARB has indicated enforcement discretion for good-faith first-year filers, but the August 10 deadline is not affected by federal action.

How does Europe's simplified ESRS connect to what U.S. companies need to do?

The finalized ESRS uses GHG Protocol-aligned methodology for emissions reporting — the same standard SB 253 requires. Companies building their carbon accounting infrastructure around GHG Protocol today are simultaneously positioning themselves for CSRD readiness if they have European operations or EU-headquartered customers. The frameworks are not identical, but the foundational data layer is shared.

What are the Scope 3 implications of the failed IMO shipping carbon framework?

Without a global maritime carbon standard, companies importing by sea face a growing patchwork of regional carbon pricing rules. EU ETS already covers international shipping; the UK is expanding coverage. This increases both the cost and complexity of Scope 3 Category 4 upstream transportation calculations. Companies should document their transport emissions methodology now, before regional rules create additional reporting obligations.

What is clean tech investment growth telling us about the energy transition?

Global energy transition investment reached $2.3 trillion in 2025, up 8% year over year, with solar, EVs, and grid spending leading. Combined with IRENA's confirmation that solar-plus-storage is now cost-competitive with fossil fuels on a 24/7 basis, the data signals that renewable energy is no longer a sustainability-premium decision — it's an increasingly standard capital allocation choice.

How should mid-market companies think about multi-jurisdictional sustainability reporting?

The most durable approach is to build your emissions inventory against the GHG Protocol standard first, then map it to the frameworks that apply to your specific jurisdictions and customer requirements. A GHG Protocol-aligned footprint can serve SB 253, inform CSRD readiness, and support CDP reporting, EcoVadis assessments, and SBTi target-setting — reducing the need to recollect and reformat data for each new requirement.

Trust Desk | The 2026 ISO 27000 update: where information security and environmental resilience meet

Information security and environmental resilience are no longer separate conversations. ISO’s latest update, released just this month, makes that clear.

When most people think about information security, they think about cyber threats like hackers, ransomware, insider risk, and data breaches. Increasingly, that’s only part of the picture.

This month, ISO and IEC published the sixth edition of ISO/IEC 27000, the foundational document for the ISO 27000 family of information security standards. While the update is largely structural, there’s one change that stands out. It reinforces something many organizations haven’t fully connected yet: information security and environmental resilience are becoming part of the same conversation.

The shift worth paying attention to

Information security has always accounted for physical threats. Fire, flooding, power loss, and facility disruptions have long been considered risks to information assets.

The latest revision expands that perspective. Alongside those traditional physical risks, the standard now explicitly references climate change and the broader environmental conditions that can impact facilities, infrastructure, and the systems organizations depend on. It also introduces the idea that environmental and societal responsibility should sit among the principles underpinning an effective information security management system.

That isn’t happening in isolation. In 2024, ISO amended ISO/IEC 27001, the certifiable standard organizations build their ISMS around, to require organizations to consider climate change and environmental conditions as part of understanding the context in which they operate. The 2026 revision to ISO/IEC 27000 is essentially the conceptual framework catching up.

Put those together, and the physical environment your information systems depend on is now part of the information security conversation.

Why this matters for Greenplaces customers

For organizations already investing in sustainability, resilience, or environmental risk management, this isn’t a brand-new capability. You’ve already been thinking about environmental exposure. What’s changing is that your security and compliance obligations are beginning to point in the same direction.

Think about what happens when:

A heat wave takes a cloud region or data center offline.
Flooding impacts a facility storing critical records.
Severe weather disrupts power, telecommunications, or key suppliers.
An extreme event interrupts business operations for days.

Historically, we’d label these as business continuity or disaster recovery issues. Today, they’re increasingly viewed as information security risks, because the confidentiality, integrity, and availability of your data ultimately rely on physical infrastructure that environmental conditions can disrupt.

If your organization already understands environmental risk, applying that same lens to your information systems is a much smaller leap than many realize, and it’s one many organizations haven’t made yet.

What organizations should do now

There’s no reason to overhaul your security program simply because an overview standard was updated. There are, however, a few practical steps worth taking.

Treat environmental risk as a real input. Incorporate environmental and physical risks into your next information security risk assessment as meaningful inputs rather than edge cases. Ask where critical systems reside, what infrastructure they depend on, and how those systems would perform under the same environmental scenarios your operations teams are already planning for.

Make your ISO 27001 context genuine. If you’re pursuing or maintaining ISO 27001 certification, make sure your organizational context genuinely reflects your environmental and physical operating conditions. Auditors are increasingly looking for evidence that this evaluation was genuine rather than a box ticked to satisfy a requirement.

Bring both disciplines under one roof. When environmental risk sits with one provider and information security with another, you end up evaluating the same operational risks twice through different lenses. Housing both under one roof keeps those views connected and closes the gaps that open up when they’re handled separately.

The bigger picture

The sixth edition of ISO/IEC 27000 probably won’t generate headlines. But direction matters.

Environmental resilience isn’t the only area where information security standards are evolving. ISO is also expanding guidance around responsible AI governance through ISO/IEC 42001 and developing new standards focused on securing AI systems themselves.

The broader trend is hard to miss. The definition of information security is expanding beyond traditional cybersecurity controls, out to the physical environments our systems operate in and the emerging technologies we increasingly depend on.

Organizations that already take environmental resilience seriously and are building thoughtful AI governance programs aren’t starting from scratch. They’re well positioned to lead while others are still catching up.

One roof for both

This is exactly where Greenplaces brings both disciplines under one roof. We help organizations run sustainability, resilience, trust, and compliance as one connected program, so environmental risk, ISO 27001 readiness, and AI governance strengthen each other instead of living in separate systems with separate owners. The convergence these standards are pointing toward is the program we already build with our customers.

This latest ISO update reinforces that reality. The organizations that recognize the convergence now will be far better prepared for where the standards, and customer expectations, are heading next.

Ready to align your security and sustainability programs?

Contact Greenplaces today for a demo and see how we connect ISO 27001 readiness, AI governance, and environmental risk in one program.

About the Author

Amanda Grady is Solutions Lead for Trust Services at GreenPlaces. She brings over a decade of experience in the technology assurance space at a Big 4 accounting firm, where she helped organizations build and prove out their internal IT controls. She holds a degree in Information Systems Management. Whether the work is SOC 2 readiness, ISO 27001 certification, or AI governance, Amanda’s focus stays the same: building programs that hold up to real scrutiny.