WAF-SUS-100 – Sustainability Debt Register & Quarterly Review

Pillar: Sustainability | Severity: Low | Category: Cost Governance | Automatable: High

Description

Organizations MUST maintain a Sustainability Debt Register documenting all known gaps between current sustainability posture and target state across all WAF-SUS controls. The register MUST be reviewed and updated at least quarterly. Each entry MUST include: estimated carbon impact, remediation priority, owner, and target resolution date. Sustainability debt MUST be treated as a governance risk item and reported in the organization’s ESG or sustainability report. Quarterly reviews MUST produce measurable progress against reduction targets.

Rationale

Risk	Description
Risk	Undocumented sustainability debt prevents targeted optimization and budget approvals.
Risk	Missing prioritization of green-debt items lets inefficient workloads run unchanged.

Risk

Description

Risk

Undocumented sustainability debt prevents targeted optimization and budget approvals.

Risk

Missing prioritization of green-debt items lets inefficient workloads run unchanged.

Requirements

Organizations MUST maintain a Sustainability Debt Register documenting all known gaps between current sustainability posture and target state across all WAF-SUS controls.
The register MUST be reviewed and updated at least quarterly.
Each entry MUST include: estimated carbon impact, remediation priority, owner, and target resolution date.
Sustainability debt MUST be treated as a governance risk item and reported in the organization’s ESG or sustainability report.
Quarterly reviews MUST produce measurable progress against reduction targets.

Implementation Guidance

Document the requirement in a version-controlled policy or standard.
Assign ownership and establish a review cadence (e.g., quarterly).
Implement the required configuration as code in Terraform or equivalent IaC.

Maturity Levels

Level	Name	Criteria
L1	Ad hoc – control not consistently applied	* Manual evidence exists for some workloads, but coverage is unknown.
L2	Standardised – policy defined and communicated	* A version-controlled policy, ADR, or standard describes the requirement.
L3	Integrated – automated validation in CI/CD	* Terraform checks run automatically on pull requests and report results.
L4	Auditable – metrics and exceptions tracked	* Control coverage, failures, and approved exceptions are reported quarterly.
L5	Optimised – continuous improvement based on data	* Control effectiveness is measured and iteratively improved.

Level

Name

Criteria

Ad hoc – control not consistently applied

* Manual evidence exists for some workloads, but coverage is unknown.

Standardised – policy defined and communicated

* A version-controlled policy, ADR, or standard describes the requirement.

Integrated – automated validation in CI/CD

* Terraform checks run automatically on pull requests and report results.

Auditable – metrics and exceptions tracked

* Control coverage, failures, and approved exceptions are reported quarterly.

Optimised – continuous improvement based on data

* Control effectiveness is measured and iteratively improved.

Checks

waf-sus-100.tf.aws.config-rule-sustainability-governance

Engine: terraform | Provider: aws | Automated: Yes

AWS Config rules should be enabled for sustainability-relevant resource types

AWS Config provides continuous monitoring of resource configuration compliance. Enabling Config rules for sustainability-relevant resource types (EC2 instance types, S3 lifecycle policies, CloudWatch log retention) enables automated detection of sustainability debt as it is created.

Scope: resource — aws_config_config_rule

Assertions: * name attribute exists — AWS Config rule must have a name. * source attribute exists — AWS Config rule must have a source configuration.

Remediation: Enable AWS Config and create managed rules for: required-tags, ec2-instance-managed-by-ssm, cloudwatch-log-group-retention-period-check, s3-lifecycle-policy-check. These rules provide continuous monitoring of the most common sources of sustainability debt.

Compliant

resource "aws_config_config_rule" "log_retention" {
  name        = "cloudwatch-log-group-retention-period-check"
  description = "Checks that CloudWatch log groups have retention policy set (sustainability debt detection)"

  source {
    owner             = "AWS"
    source_identifier = "CLOUD_WATCH_LOG_GROUP_RETENTION_PERIOD_CHECK"
  }

  input_parameters = jsonencode({
    MinRetentionTime = "14"
  })

  tags = {
    purpose  = "sustainability-governance"
    control  = "WAF-SUS-100"
  }
}

Non-Compliant

# No AWS Config rules configured – WAF-SUS-100 Warning
# Sustainability debt accumulates undetected without automated config compliance

waf-sus-100.tf.aws.tag-sustainability-reviewed

Engine: terraform | Provider: aws | Automated: Yes

Compute resources should have sustainability-reviewed tag to indicate review date

Resources tagged with 'sustainability-reviewed' demonstrate active governance: the sustainability posture of the resource was explicitly reviewed on the given date. This tag drives the sustainability debt register by identifying stale reviews.

Scope: resource — aws_instance, aws_eks_cluster, aws_ecs_cluster

Assertions: * tags key exists — Resource has no sustainability-reviewed tag – add date of last sustainability review.

Remediation: Add sustainability-reviewed = "YYYY-MM-DD" tag to all major compute resources. Set up quarterly reminder to update this tag after sustainability review. Use AWS Config custom rule to alert when sustainability-reviewed tag is older than 180 days.

Compliant

resource "aws_instance" "app" {
  ami           = data.aws_ami.ubuntu_arm.id
  instance_type = "m7g.large"

  tags = {
    environment              = "production"
    workload                 = "payment-service"
    owner                    = "platform-team"
    sustainability-reviewed  = "2026-01-15"  # quarterly review date
  }
}

Non-Compliant

resource "aws_instance" "app" {
  ami           = data.aws_ami.ubuntu.id
  instance_type = "m4.large"

  tags = {
    Name        = "payment-app"
    # WAF-SUS-100 Warning: no sustainability-reviewed tag
  }
}

waf-sus-100.tf.azurerm.sustainability-tag

Engine: terraform | Provider: azurerm | Automated: Yes

Azure compute resources should have sustainability governance tags

Azure compute resources should carry a sustainability-reviewed tag indicating the last date the resource’s sustainability posture was reviewed as part of the quarterly sustainability debt register process.

Scope: resource — azurerm_linux_virtual_machine, azurerm_kubernetes_cluster, azurerm_container_group

Assertions: * tags key exists — Azure compute resource has no sustainability-reviewed tag – quarterly review required.

Remediation: Add sustainability-reviewed tag with format YYYY-MM-DD to all Azure compute resources. Use Azure Policy to enforce tag presence on resource creation and flag resources where the date is older than 180 days.

Compliant

resource "azurerm_linux_virtual_machine" "app" {
  name                = "vm-app-prod"
  resource_group_name = var.resource_group_name
  location            = var.location
  size                = "Standard_D4ps_v5"

  tags = {
    environment             = "production"
    workload                = "payment-service"
    sustainability-reviewed = "2026-01-15"
  }
}

Non-Compliant

resource "azurerm_linux_virtual_machine" "app" {
  name                = "vm-app-prod"
  resource_group_name = var.resource_group_name
  location            = var.location
  size                = "Standard_D4_v3"
  # WAF-SUS-100 Warning: old instance series AND no sustainability-reviewed tag
}

waf-sus-100.tf.google.sustainability-debt-label

Engine: terraform | Provider: google | Automated: Yes

GCP project resources must track sustainability debt via labels

GCP projects and compute resources should declare whether they carry known sustainability debt via a sustainability-debt-register label, linking to the central register.

Scope: resource — google_project

Assertions: * labels key exists — GCP project must have a sustainability-debt-register label referencing the central register.

Remediation: Add a sustainability-debt-register label to google_project resources. The label value should reference the central Sustainability Debt Register document.

Compliant

resource "google_project" "app" {
  name       = "Application Project"
  project_id = "app-prod-123"
  labels = {
    sustainability-debt-register = "docs/sustainability/debt-register.md"
  }
}

Non-Compliant

resource "google_project" "app" {
  name       = "Application Project"
  project_id = "app-prod-123"
  # Missing sustainability-debt-register label
}

Evidence

Kind Required Description

Kind	Required	Description
`iac`	Required	Terraform configuration implementing the control.
`governance`	Required	Policy, ADR, or standard documenting the requirement.
`config`	Optional	Cloud console or API output confirming runtime state.

iac

Required

Terraform configuration implementing the control.

governance

Required

Policy, ADR, or standard documenting the requirement.

config

Optional

Cloud console or API output confirming runtime state.

Related Controls

Framework	Controls
EU CSRD (Corporate Sustainability Reporting Directive)	* ESRS 2 – General Disclosures: Governance, strategy and management of sustainability matters * ESRS E1 – Climate Change: governance of climate-related risks and opportunities
GHG Protocol	* Corporate Standard – management and governance of GHG inventory
SBTi (Science Based Targets initiative)	* ICT Sector Guidance – progress tracking and governance
ISO 14001	* 10.3 – Continual improvement * 6.1 – Actions to address risks and opportunities

Framework

Controls

EU CSRD (Corporate Sustainability Reporting Directive)

* ESRS 2 – General Disclosures: Governance, strategy and management of sustainability matters * ESRS E1 – Climate Change: governance of climate-related risks and opportunities

GHG Protocol

* Corporate Standard – management and governance of GHG inventory

SBTi (Science Based Targets initiative)

* ICT Sector Guidance – progress tracking and governance

ISO 14001

* 10.3 – Continual improvement * 6.1 – Actions to address risks and opportunities