Sustainable finance is built for the long term. But long-term impact requires something that rarely appears in an investment headline: resilience. In a recent episode of syracom’s “Security first, coffee second …” podcast, we discussed why cyber security, compliance and good governance ultimately come down to one essential asset – trust.
For an impact investor, sustainability is naturally associated with the investments it makes and the positive change it seeks to enable. Yet sustainability also has an important organisational dimension: a financial institution must itself be capable of operating responsibly, securely and reliably over the long term.
This is where information security, compliance and operational resilience become part of the bigger picture.
When an IT risk becomes a business risk
Digitalisation has fundamentally changed financial services. Business processes rely on technology, data and external service providers. As a result, an IT disruption is rarely just an IT problem. It can quickly affect business continuity, clients, reputation and an organisation’s ability to deliver.
This is one of the central ideas I explored in my conversation with Darius and Tino from syracom AG. My perspective is deliberately practical: technology is an important tool, but resilience is a management responsibility. Management determines priorities and responsibilities; IT provides solutions and implements controls. Or, as put in the podcast:
“Resilient companies are not defined by the fact that nothing happens – but by how they respond.”
DORA: looking beyond regulation
The EU’s Digital Operational Resilience Act, or DORA, in force since January 2025, has brought this question into sharper focus for the financial sector. In our discussion I was challenging a common misconception: DORA should not be regarded simply as another IT regulation or documentation exercise. Its underlying question is much more fundamental: can an organisation continue to operate when something serious happens? That means understanding critical business processes, the technology supporting them, dependencies on external providers and, crucially, who is responsible.
Seen from this perspective, regulation can provide an opportunity to strengthen the organisation itself. Clear responsibilities, greater transparency and a structured understanding of risks can support better management decisions – rather than simply satisfying a regulatory requirement.
Security is also about people
One of the most interesting themes in the conversation is that effective security is not primarily about buying more technology. Cyber criminals increasingly target people through phishing, social engineering and identity theft. At the same time, employees can be an organisation’s strongest security resource when they understand risks and know how to respond.
This changes the purpose of security awareness. Phishing simulations, for example, should not be designed to catch employees making mistakes. They should help an organisation learn. Or to use another quote from the podcast:
We don’t test employees. We train resilience.
That distinction matters. A sustainable security culture depends on openness, communication and continuous learning – not simply on controls.
Governance as an enabler
The same philosophy applies to compliance.
Good compliance should not sit at the end of a business process merely to approve or reject decisions. When involved early, it can help identify risks, improve transparency and support better decisions. The best compliance does not prevent business – it enables good business.
For FS Impact Finance, this perspective has a natural connection to its broader purpose. Responsible finance requires more than considering financial returns and impact. It also requires an organisation capable of making sound decisions, understanding its dependencies and managing risks responsibly. That is particularly relevant in a financial environment where technology, outsourcing, cloud services and increasingly artificial intelligence are changing how organisations operate.
Trust has to be earned
Perhaps the strongest connection between impact finance, compliance and cyber security is trust.
Investors and business partners need confidence not only in an investment strategy, but also in the organisation implementing it. Governance, compliance and IT security contribute to that confidence by creating clarity around responsibilities, risks and decisions.
The podcast therefore goes well beyond firewalls, regulation and technical controls. It is ultimately a conversation about how organisations remain dependable in a changing environment. Compliance can be documented. Trust has to be earned. For an organisation focused on sustainable finance and long-term impact, that may be one of the most important forms of resilience of all.
Want to hear the full conversation?
Listen to me discussing DORA, cyber security, governance, AI, the human factor and more in syracom’s “Security first, coffee second …” podcast. Available at:
