# Empowering Organizations for Sustainable Digitalization: a Corporate Digital Responsibility Maturity Model Approach

Aiste Rugeviciute, Vincent Courboulay

## ► To cite this version:

Aiste Rugeviciute, Vincent Courboulay. Empowering Organizations for Sustainable Digitalization: a Corporate Digital Responsibility Maturity Model Approach. 2024. hal-04554663

HAL Id: hal-04554663

https://hal.science/hal-04554663

Preprint submitted on 22 Apr 2024

HAL is a multi-disciplinary open access archive for the deposit and dissemination of scientific research documents, whether they are published or not. The documents may come from teaching and research institutions in France or abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est destinée au dépôt et à la diffusion de documents scientifiques de niveau recherche, publiés ou non, émanant des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

<figure><img src="image_1.png" /></figure>

Distributed under a Creative Commons Attribution 4.0 International License
# Empowering Organizations for Sustainable Digitalization: a Corporate Digital Responsibility Maturity Model Approach

Aiste Rugeviciute, Vincent Courboulay

► To cite this version:

Aiste Rugeviciute, Vincent Courboulay. Empowering Organizations for Sustainable Digitalization: a Corporate Digital Responsibility Maturity Model Approach. 2024. hal-04554663

HAL Id: hal-04554663

https://hal.science/hal-04554663v1

Preprint submitted on 22 Apr 2024

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>

Distributed under a Creative Commons Attribution 4.0 International License
# Empowering Organizations for Sustainable Digitalization: a Corporate Digital Responsibility Maturity Model Approach

1st Aiste Rugeviciute

L3i laboratory, La Rochelle University

Square Research Center, Square Management

Neuilly-sur-Seine, France

aiste.rugeviciute@univ-lr.fr

2nd Vincent Courboulay

L3i laboratory

La Rochelle University

La Rochelle, France

vcourbou@univ-lr.fr

**Abstract**—Corporate Digital Responsibility can contribute to guiding organizations toward responsible digitalization and organizational resiliency. Yet, due to the novelty of this subject, few guidelines and frameworks exist. We propose a Corporate Digital Responsibility Maturity Model (CDR MM) as a systematic approach for organizations to assess and enhance their capabilities in integrating digital responsibility into their operations. Developed through design research methodology, the CDR MM comprises five dimensions and 18 focus areas. The model is the first of its kind in the context of CDR, addressing both the social and environmental aspects of digitalization. Our study diversifies the geographical scope by conducting research within the French context, contributing to the global understanding of CDR. For decision-makers, the CDR MM serves as an evaluative tool, offering insights into problematic areas and guiding organizational efforts to align digitalization with sustainable development. The proposed model also lays the groundwork for future research in the field, potentially leading to the development of prescriptive maturity models.

**Index Terms**—Corporate Digital Responsibility, maturity model, Sustainable Digitalization

## I. INTRODUCTION

Digitalization has the potential to increase the resilience of an organization and contribute to sustainable development [1]–[3]. Yet it also feeds into a process of societal changes with far-reaching potentially negative implications for the environment and society [4]–[6]. Thus, an organization’s digital actions influence the resilience of social-ecological systems, either intentionally or not [7]. As organizations operate in an increasingly digital world, they need to adopt practices that would allow them to:

* accomplish digitalization aligned with the sustainable development challenges [8];

* respond to the new expectations from their stakeholders [9], [10];

* ensure long-term organizational resilience [9], [10].

Yet there is limited research done to understand how organizations should develop a set of capabilities that can help to achieve digitalization toward more sustainable development pathways [8]. The concept of sustainable development itself is subject to a range of interpretations; in our study, we align with

the arguments outlined in [11] adopting a socio-ecological approach as framed by the Doughnut model [12]. This framework promotes the integration of economic activities within the planetary and social boundaries.

By guiding responsible development, deployment, and utilization of digital technologies and data, Corporate Digital Responsibility (CDR)<fnref n="1" /> can contribute to ensuring that the advantages of digitalization align with these planetary and social boundaries, contributing to a more sustainable and socially responsible digital ecosystem [13], [14].

Yet, given the early stages of the academic engagement with CDR, there is a lack of tools and frameworks available for organizations and researchers alike that would guide them towards the CDR adoption and investigation respectively [15]. Lobschat et al. [16, p. 12] raised a question for future research: “How should we capture and assess an organization’s CDR readiness and degree of CDR implementation?”. If the body of literature around CDR has significantly expanded in the last few years [17], this question yet remains to be answered. Previous scholars have proposed frameworks and best practices to guide organizations in their strategies to mitigate the negative environmental impact of digital products and services [18]–[21]. Other scholars have deliberated on how organizations could address the social impacts of digitalization, particularly concerning data and AI [22], [23]. However, there is a lack of research on how organizations could address both the social and environmental effects of digitalization [24]. [25] has also stressed the need to engage with ethical considerations, like corporate social responsibility (CSR), to gain a more comprehensive and theoretically richer understanding of digital transformations while addressing questions that are highly relevant for practitioners. Authors’ discussions with industrial partners have confirmed that many practitioners are interested

<footnote n="1">¹While there is a growing number of papers and practitioners alike using the term Corporate Digital Responsibility, other terms like digital sustainability or Sustainable IT/ICT are also used in the same context. It is out of the scope of this paper to reflect on their usage. In this paper we prefer CDR but other terms are mentioned interchangeably, depending on how they appear in their original sources.</footnote>
# Empowering Organizations for Sustainable Digitalization: a Corporate Digital Responsibility Maturity Model Approach

1st Aiste Rugeviciute

L3i laboratory, La Rochelle University

Square Research Center, Square Management

Neuilly-sur-Seine, France

aiste.rugeviciute@univ-lr.fr

2nd Vincent Courboulay

L3i laboratory

La Rochelle University

La Rochelle, France

vcourbou@univ-lr.fr

**Abstract**—Corporate Digital Responsibility can contribute to guiding organizations toward responsible digitalization and organizational resiliency. Yet, due to the novelty of this subject, few guidelines and frameworks exist. We propose a Corporate Digital Responsibility Maturity Model (CDR MM) as a systematic approach for organizations to assess and enhance their capabilities in integrating digital responsibility into their operations. Developed through design research methodology, the CDR MM comprises five dimensions and 18 focus areas. The model is the first of its kind in the context of CDR, addressing both the social and environmental aspects of digitalization. Our study diversifies the geographical scope by conducting research within the French context, contributing to the global understanding of CDR. For decision-makers, the CDR MM serves as an evaluative tool, offering insights into problematic areas and guiding organizational efforts to align digitalization with sustainable development. The proposed model also lays the groundwork for future research in the field, potentially leading to the development of prescriptive maturity models.

**Index Terms**—Corporate Digital Responsibility, maturity model, Sustainable Digitalization

## I. INTRODUCTION

Digitalization has the potential to increase the resilience of an organization and contribute to sustainable development [1]–[3]. Yet it also feeds into a process of societal changes with far-reaching potentially negative implications for the environment and society [4]–[6]. Thus, an organization’s digital actions influence the resilience of social-ecological systems, either intentionally or not [7]. As organizations operate in an increasingly digital world, they need to adopt practices that would allow them to:

* accomplish digitalization aligned with the sustainable development challenges [8];

* respond to the new expectations from their stakeholders [9], [10];

* ensure long-term organizational resilience [9], [10].

Yet there is limited research done to understand how organizations should develop a set of capabilities that can help to achieve digitalization toward more sustainable development pathways [8]. The concept of sustainable development itself is subject to a range of interpretations; in our study, we align with

the arguments outlined in [11] adopting a socio-ecological approach as framed by the Doughnut model [12]. This framework promotes the integration of economic activities within the planetary and social boundaries.

By guiding responsible development, deployment, and utilization of digital technologies and data, Corporate Digital Responsibility (CDR)<fnref n="1" /> can contribute to ensuring that the advantages of digitalization align with these planetary and social boundaries, contributing to a more sustainable and socially responsible digital ecosystem [13], [14].

Yet, given the early stages of the academic engagement with CDR, there is a lack of tools and frameworks available for organizations and researchers alike that would guide them towards the CDR adoption and investigation respectively [15]. Lobschat et al. [16, p. 12] raised a question for future research: “How should we capture and assess an organization’s CDR readiness and degree of CDR implementation?”. If the body of literature around CDR has significantly expanded in the last few years [17], this question yet remains to be answered. Previous scholars have proposed frameworks and best practices to guide organizations in their strategies to mitigate the negative environmental impact of digital products and services [18]–[21]. Other scholars have deliberated on how organizations could address the social impacts of digitalization, particularly concerning data and AI [22], [23]. However, there is a lack of research on how organizations could address both the social and environmental effects of digitalization [24]. [25] has also stressed the need to engage with ethical considerations, like corporate social responsibility (CSR), to gain a more comprehensive and theoretically richer understanding of digital transformations while addressing questions that are highly relevant for practitioners. Authors’ discussions with industrial partners have confirmed that many practitioners are interested

<footnote n="1">¹While there is a growing number of papers and practitioners alike using the term Corporate Digital Responsibility, other terms like digital sustainability or Sustainable IT/ICT are also used in the same context. It is out of the scope of this paper to reflect on their usage. In this paper we prefer CDR but other terms are mentioned interchangeably, depending on how they appear in their original sources.</footnote>
in initializing CDR projects or pilots, but do not have the
knowledge to start an analysis of the as-is and to-be situation,
as well as the first roadmap. The intention to adopt CDR does
not necessarily translate into the capability to do so.

Maturity models (MM) can respond to the above-mentioned
challenges by providing guidance for organizations and sup-
porting them in identifying improvement activities that have
the potential to reshape the capabilities needed for CDR
implementation [26]. According to [27], the notion of maturity
is used to “define, assess and form a guideline and a basis
for evaluating the progress in business”. Yet, to date, no
maturity models have been proposed for CDR. Descriptive
maturity models enable the assessment of the current state
for strategic planning and serve as foundational frameworks
for developing prescriptive models with specific improvement
measures and best practices [28]. In this paper, we follow a
design research methodology, to propose a descriptive MM
aiming to help organizations identify areas in which they
should assess their capabilities in order to implement CDR.
Based on an iterative design process that included a systematic
literature review, a case study, focus groups, and a Delphi study
[29] we aim to respond to the following research question:
“What are the focus areas that are important, according to the
actors implicated in CDR, to sustain a CDR posture in an
organization and how can they be evaluated?”. The elicitation
of beliefs and thoughts about CDR allowed us to conceptualize
the descriptive MM comprised of five dimensions and 18 focus
areas.

Through our research, we contribute to the question of
capabilities needed for the implementation of CDR strategies
– an area that has so far received little academic research
attention. The derived focus areas are based on both the social
and environmental aspects of digitalization and therefore the
results might be insightful for ICT for Sustainability (ICT4S),
responsible digital transformation, and sustainable develop-
ment researchers. Furthermore, up to now the prevalence
of CDR publications and empirical studies originated from
Germany, potentially introducing bias in the conceptualization
of CDR’s scope. In our work, we introduce a novel perspective
by conducting a study within the context of France, thereby
diversifying the geographical scope of research in this field.
To enhance the robustness and global applicability of our
findings, we validate our results through the Delphi study
with international experts in the field. The descriptive maturity
model also aims to respond to the needs of decision-makers
by providing them with a tool to observe their problematic
areas in CDR implementation. It also enables organizations to
identify improvement areas in developing their capabilities to
align digitalization with sustainable development. Finally, the
proposed descriptive maturity model, being the first of its kind
in the realm of CDR, may provide a foundational reference
for future researchers aiming to advance and expand upon the
field, potentially leading to the development of prescriptive
maturity models.

In this publication, we explain the steps taken from the
literature review, through the development of the initial model

until the validation of its key elements.

II. THEORETICAL BACKGROUND

A. Corporate Digital Responsibility

The notion of Corporate Digital Responsibility has gained
growing significance in both business practice and scholarly
inquiry [13]. Institutes of Sustainable IT emerged in France,
Belgium, and Switzerland grouping organizations interested
in succeeding in their digital transitions while reducing the
environmental and social footprint of their IT services and
usages [30]. The concept has been also embraced at the
political level by both the German and French governments
[31], [32]. Simultaneously, researchers from diverse fields have
started engaging with this term and the volume of publications
has been on the rise since 2018 [17].

The conceptual roots of CDR draw from various disciplines,
including business ethics, Corporate Social Responsibility, and
Information Technology (IT) [15], [17]. It shares conceptual
similarities with other research communities such as ICT4S,
Green Information Systems, and sustainable and ethical AI, all
of which explore the ethical and sustainable aspects of digital
technologies [11]. Based on the systematic literature review,
[17] define CDR as a framework that *guides an organization's
operations by providing a business orientation with a set
of practices, behaviors, policies, and governance structures
based on a set of shared values and norms to achieve eco-
nomic, social and environmental goals when engaging with
stakeholders or shaping the digital world with responsible
digital innovation for the advancement of society*.

Despite the overarching recognition that CDR should ad-
dress both the social and environmental challenges, much
of the existing literature has predominantly concentrated on
social aspects [17]. The proposed Digital Responsibility Goals
by [33], for example, include digital literacy, cybersecurity,
privacy, data fairness, trustworthy algorithms, transparency,
human agency, and identity. [34] argue that ethics, privacy,
and fairness are the key principles of CDR. [14] and [22] take
a similar angle – they reuse eight dimensions of consumer-
only issues in the digital world proposed by [35]: Access,
Education and awareness, Information and transparency, Eco-
nomic interests, Product safety and liability, Privacy and data
security, Dispute resolution and awareness, Governance, and
participation mechanisms. Reducing the discourse about digi-
tal responsibilities to social-only issues seems to be the inverse
phenomenon of what is observed in the ICT4S community.
[24] argue that sustainable development within this research
community is framed predominantly as an environmental
challenge and subsequently reduced to energy or carbon is-
sues. They invite the researchers to prioritize “socioecological
restoration”, taking the position that systems are equally social
as biophysical. Based on [17] proposed definition, we believe
that this argument should be extended to the CDR field. Some
of the scholars already include both social and environmental
dimensions of sustainability in their CDR research [6], [13],
[36]–[38]. Their work remains to be expanded and strength-
ened through further empirical research.
in initializing CDR projects or pilots, but do not have the
knowledge to start an analysis of the as-is and to-be situation,
as well as the first roadmap. The intention to adopt CDR does
not necessarily translate into the capability to do so.

Maturity models (MM) can respond to the above-mentioned
challenges by providing guidance for organizations and sup-
porting them in identifying improvement activities that have
the potential to reshape the capabilities needed for CDR
implementation [26]. According to [27], the notion of maturity
is used to “define, assess and form a guideline and a basis
for evaluating the progress in business”. Yet, to date, no
maturity models have been proposed for CDR. Descriptive
maturity models enable the assessment of the current state
for strategic planning and serve as foundational frameworks
for developing prescriptive models with specific improvement
measures and best practices [28]. In this paper, we follow a
design research methodology, to propose a descriptive MM
aiming to help organizations identify areas in which they
should assess their capabilities in order to implement CDR.
Based on an iterative design process that included a systematic
literature review, a case study, focus groups, and a Delphi study
[29] we aim to respond to the following research question:
“What are the focus areas that are important, according to the
actors implicated in CDR, to sustain a CDR posture in an
organization and how can they be evaluated?”. The elicitation
of beliefs and thoughts about CDR allowed us to conceptualize
the descriptive MM comprised of five dimensions and 18 focus
areas.

Through our research, we contribute to the question of
capabilities needed for the implementation of CDR strategies
– an area that has so far received little academic research
attention. The derived focus areas are based on both the social
and environmental aspects of digitalization and therefore the
results might be insightful for ICT for Sustainability (ICT4S),
responsible digital transformation, and sustainable develop-
ment researchers. Furthermore, up to now the prevalence
of CDR publications and empirical studies originated from
Germany, potentially introducing bias in the conceptualization
of CDR’s scope. In our work, we introduce a novel perspective
by conducting a study within the context of France, thereby
diversifying the geographical scope of research in this field.
To enhance the robustness and global applicability of our
findings, we validate our results through the Delphi study
with international experts in the field. The descriptive maturity
model also aims to respond to the needs of decision-makers
by providing them with a tool to observe their problematic
areas in CDR implementation. It also enables organizations to
identify improvement areas in developing their capabilities to
align digitalization with sustainable development. Finally, the
proposed descriptive maturity model, being the first of its kind
in the realm of CDR, may provide a foundational reference
for future researchers aiming to advance and expand upon the
field, potentially leading to the development of prescriptive
maturity models.

In this publication, we explain the steps taken from the
literature review, through the development of the initial model

until the validation of its key elements.

II. THEORETICAL BACKGROUND

A. Corporate Digital Responsibility

The notion of Corporate Digital Responsibility has gained
growing significance in both business practice and scholarly
inquiry [13]. Institutes of Sustainable IT emerged in France,
Belgium, and Switzerland grouping organizations interested
in succeeding in their digital transitions while reducing the
environmental and social footprint of their IT services and
usages [30]. The concept has been also embraced at the
political level by both the German and French governments
[31], [32]. Simultaneously, researchers from diverse fields have
started engaging with this term and the volume of publications
has been on the rise since 2018 [17].

The conceptual roots of CDR draw from various disciplines,
including business ethics, Corporate Social Responsibility, and
Information Technology (IT) [15], [17]. It shares conceptual
similarities with other research communities such as ICT4S,
Green Information Systems, and sustainable and ethical AI, all
of which explore the ethical and sustainable aspects of digital
technologies [11]. Based on the systematic literature review,
[17] define CDR as a framework that *guides an organization's
operations by providing a business orientation with a set
of practices, behaviors, policies, and governance structures
based on a set of shared values and norms to achieve eco-
nomic, social and environmental goals when engaging with
stakeholders or shaping the digital world with responsible
digital innovation for the advancement of society*.

Despite the overarching recognition that CDR should ad-
dress both the social and environmental challenges, much
of the existing literature has predominantly concentrated on
social aspects [17]. The proposed Digital Responsibility Goals
by [33], for example, include digital literacy, cybersecurity,
privacy, data fairness, trustworthy algorithms, transparency,
human agency, and identity. [34] argue that ethics, privacy,
and fairness are the key principles of CDR. [14] and [22] take
a similar angle – they reuse eight dimensions of consumer-
only issues in the digital world proposed by [35]: Access,
Education and awareness, Information and transparency, Eco-
nomic interests, Product safety and liability, Privacy and data
security, Dispute resolution and awareness, Governance, and
participation mechanisms. Reducing the discourse about digi-
tal responsibilities to social-only issues seems to be the inverse
phenomenon of what is observed in the ICT4S community.
[24] argue that sustainable development within this research
community is framed predominantly as an environmental
challenge and subsequently reduced to energy or carbon is-
sues. They invite the researchers to prioritize “socioecological
restoration”, taking the position that systems are equally social
as biophysical. Based on [17] proposed definition, we believe
that this argument should be extended to the CDR field. Some
of the scholars already include both social and environmental
dimensions of sustainability in their CDR research [6], [13],
[36]–[38]. Their work remains to be expanded and strength-
ened through further empirical research.
While theoretical frameworks for CDR implementation have been proposed [6], [13], [16], empirical studies and methodologies to evaluate the current state of CDR within organizations and guide its development remain scarce. At the time of writing, a significant corpus of literature originates from Germany, primarily addressing the social scope of CDR [17]. [17] also note that empirical studies examining the scope of responsibility and activities are needed to refine and validate the comprehensiveness, applicability, and reliability of frameworks.

This study aims to address the above-mentioned research gaps by investigating factors that can guide companies in the adoption of CDR and by proposing the first descriptive maturity model for CDR.

## B. Maturity Models

In Information Systems (IS) research, maturity models are understood as tools that can aid in the continuous improvement of processes and as means of benchmarking or self-assessment [26], [39]. They provide guidelines through the evolutionary process of organizational development and growth [39], support in evaluating as-is situations, and help to monitor the digitalization process [26].

The MM can be categorized into three types [40]:

1) Descriptive maturity models - used to evaluate a current state. They are less likely to encourage organizations to focus on a sequence of levels towards a predefined end state, which could incite a tick-off exercise. Instead, attention is towards evolution [28];

2) Prescriptive models - offer more granular recommendations for maturity improvement. However, in the rapidly evolving landscape of technology, new best practices continually emerge. Given their inherently normative nature, prescriptive models run the risk of swiftly becoming obsolete in response to these dynamic changes;

3) Comparative models - allow the comparison of similar practices between organizations and benchmark them in different industries or regions.

[40] underline that these models, though appearing different, reflect sequential stages in a model's lifecycle. Initially, a model provides a descriptive function, enhancing comprehension of the current state of a domain. It can then evolve into a prescriptive model. Finally, for valid cross-organizational comparisons, a model needs to be agreed on and deployed across diverse organizations to gather sufficient data.

Despite their different application types, typically MM consists of several focus areas or dimensions, as well as a number of maturity levels and their features describing what has to be performed at each level of maturity [39]. Advancing to higher maturity levels signifies greater effectiveness in achieving objectives, guided by an organization's capabilities in mobilizing and deploying resources to achieve a goal [41]. Different procedures, such as fuzzy numbers or simple score setting, exist that enable the identification of the maturity level in their respective models. [42] note that procedures that are too complex to apply make it difficult to propagate maturity

models within organizations. The importance of striking a balance between oversimplification and complexity has also been underlined by [40]. They stressed that while an oversimplified model might not provide sufficient meaningful information for the audience, a complicated model may limit interest or even create confusion.

## C. Maturity Models in CDR

Since its introduction in the 1990s, the Capability Maturity Model (CMM), consistently popular in IS, has spurred a proliferation of publications interested in maturity models. This surge in literature, both academic and practitioner-oriented, spans a wide spectrum of domains which demonstrates the ongoing significance and relevance of the subject [39], [42]. Yet, to our best knowledge, no maturity model exists for CDR.

Previous literature on CDR, however, has provided different elements that could be used as building blocks for a maturity model. [13] proposed that CDR performance could be assessed according to 5 levels: (1) denying (no CDR commitment), (2) passive (economic and legal commitment), (3) social (social sponsoring and loose measures), (4) strategic (part of value creation and competitive advantage) and (5) transformative (proactive policymakers). [43], under the term "Sustainable IT", proposed a value curve that could guide managers to assess the state of sustainable IT readiness. [34] suggested factors shaping CDR in service firms. [44] discussed practices oriented towards data and privacy, and few scholars discussed best practices that aim to address both the environmental and social implications of digital transformations [6], [13].

The closest proposition to the CDR maturity model can be attributed to Curry and Donnellan [45]. Their suggested Sustainable ICT Capability Maturity Framework (SICT-CMF), consists of five levels of maturity applied to nine capability building blocks across the four categories: Strategy and planning, Process Management, People and Culture, and Governance. This framework allows to question the alignment of IT strategies with the sustainability goals of an organization. Notably, a decade ago, when recommended best practices in this domain were still emerging, this model was created using a top-down approach. The capability building blocks were initially formulated through extensive consultations with both industry experts and academia, and subsequently refined based on field experiments [46]. However, ten years later, a re-evaluation of this framework becomes pertinent to assimilate newly emerged concepts related to CDR. Such reassessment would contribute to ensuring that the capability blocks align with the current understanding of constructing effective CDR strategies for organizations.. As highlighted by [47] the existing SICT-CMF model, for example, lacks a comprehensive consideration of workforce-related aspects. This prompts further exploration to identify potential gaps in its coverage of other critical dimensions.

Other related propositions of maturity models exist in the fields of Green IT and Green IS. They typically focus on specific organizational areas, predominantly the IT departments, neglecting the high-level capability areas needed for
While theoretical frameworks for CDR implementation have been proposed [6], [13], [16], empirical studies and methodologies to evaluate the current state of CDR within organizations and guide its development remain scarce. At the time of writing, a significant corpus of literature originates from Germany, primarily addressing the social scope of CDR [17]. [17] also note that empirical studies examining the scope of responsibility and activities are needed to refine and validate the comprehensiveness, applicability, and reliability of frameworks.

This study aims to address the above-mentioned research gaps by investigating factors that can guide companies in the adoption of CDR and by proposing the first descriptive maturity model for CDR.

## B. Maturity Models

In Information Systems (IS) research, maturity models are understood as tools that can aid in the continuous improvement of processes and as means of benchmarking or self-assessment [26], [39]. They provide guidelines through the evolutionary process of organizational development and growth [39], support in evaluating as-is situations, and help to monitor the digitalization process [26].

The MM can be categorized into three types [40]:

1) Descriptive maturity models - used to evaluate a current state. They are less likely to encourage organizations to focus on a sequence of levels towards a predefined end state, which could incite a tick-off exercise. Instead, attention is towards evolution [28];

2) Prescriptive models - offer more granular recommendations for maturity improvement. However, in the rapidly evolving landscape of technology, new best practices continually emerge. Given their inherently normative nature, prescriptive models run the risk of swiftly becoming obsolete in response to these dynamic changes;

3) Comparative models - allow the comparison of similar practices between organizations and benchmark them in different industries or regions.

[40] underline that these models, though appearing different, reflect sequential stages in a model's lifecycle. Initially, a model provides a descriptive function, enhancing comprehension of the current state of a domain. It can then evolve into a prescriptive model. Finally, for valid cross-organizational comparisons, a model needs to be agreed on and deployed across diverse organizations to gather sufficient data.

Despite their different application types, typically MM consists of several focus areas or dimensions, as well as a number of maturity levels and their features describing what has to be performed at each level of maturity [39]. Advancing to higher maturity levels signifies greater effectiveness in achieving objectives, guided by an organization's capabilities in mobilizing and deploying resources to achieve a goal [41]. Different procedures, such as fuzzy numbers or simple score setting, exist that enable the identification of the maturity level in their respective models. [42] note that procedures that are too complex to apply make it difficult to propagate maturity

models within organizations. The importance of striking a balance between oversimplification and complexity has also been underlined by [40]. They stressed that while an oversimplified model might not provide sufficient meaningful information for the audience, a complicated model may limit interest or even create confusion.

## C. Maturity Models in CDR

Since its introduction in the 1990s, the Capability Maturity Model (CMM), consistently popular in IS, has spurred a proliferation of publications interested in maturity models. This surge in literature, both academic and practitioner-oriented, spans a wide spectrum of domains which demonstrates the ongoing significance and relevance of the subject [39], [42]. Yet, to our best knowledge, no maturity model exists for CDR.

Previous literature on CDR, however, has provided different elements that could be used as building blocks for a maturity model. [13] proposed that CDR performance could be assessed according to 5 levels: (1) denying (no CDR commitment), (2) passive (economic and legal commitment), (3) social (social sponsoring and loose measures), (4) strategic (part of value creation and competitive advantage) and (5) transformative (proactive policymakers). [43], under the term "Sustainable IT", proposed a value curve that could guide managers to assess the state of sustainable IT readiness. [34] suggested factors shaping CDR in service firms. [44] discussed practices oriented towards data and privacy, and few scholars discussed best practices that aim to address both the environmental and social implications of digital transformations [6], [13].

The closest proposition to the CDR maturity model can be attributed to Curry and Donnellan [45]. Their suggested Sustainable ICT Capability Maturity Framework (SICT-CMF), consists of five levels of maturity applied to nine capability building blocks across the four categories: Strategy and planning, Process Management, People and Culture, and Governance. This framework allows to question the alignment of IT strategies with the sustainability goals of an organization. Notably, a decade ago, when recommended best practices in this domain were still emerging, this model was created using a top-down approach. The capability building blocks were initially formulated through extensive consultations with both industry experts and academia, and subsequently refined based on field experiments [46]. However, ten years later, a re-evaluation of this framework becomes pertinent to assimilate newly emerged concepts related to CDR. Such reassessment would contribute to ensuring that the capability blocks align with the current understanding of constructing effective CDR strategies for organizations.. As highlighted by [47] the existing SICT-CMF model, for example, lacks a comprehensive consideration of workforce-related aspects. This prompts further exploration to identify potential gaps in its coverage of other critical dimensions.

Other related propositions of maturity models exist in the fields of Green IT and Green IS. They typically focus on specific organizational areas, predominantly the IT departments, neglecting the high-level capability areas needed for
a systematic and widespread adoption. For a comprehensive analysis of Green IT/IS maturity models, readers are encouraged to refer to the literature review by [18] revealing that no single model is all-encompassing and most of them overlook social dimensions. Additionally, many of these models rely on literature reviews and interviews, missing a more empirical approach.

Given the absence of any existing maturity model for CDR, the model we introduce possesses a descriptive nature, paving the way for subsequent evolution into a prescriptive phase within a specific domain. Our proposal aims to bridge several gaps identified in the literature:

1) The scarcity of empirical research in the realm of CDR, particularly from non-German contexts.

2) The lack of frameworks and models designed to assist organizations in evaluating, enhancing, and cultivating the necessary organization-wide capabilities for CDR adoption.

3) The insufficiency of approaches that integrate both environmental and social considerations for guiding digitalization within organizations.

### III. METHODOLOGY

Design science research aims to create and evaluate innovative artifacts, such as methods, models, or tools, in order to solve practical problems and improve the existing state of practice, as well as existing research knowledge [48]. In the domain of IT, Becker, Knackstedt and Pöppelbuß introduced guidelines for designing maturity models by leveraging the principles of design science research [26]. To ensure the robust development of maturity models these guidelines are being increasingly adopted by scholars [49]. For the same reason, we also chose to adhere to them and followed the defined phases:

(1) Problem definition. The original problem was identified in [16]. In addition to the literature analysis, discussed in Section 2, the need for guidelines or frameworks on how to assess the current state of CDR was further confirmed through consultations with industry practitioners. The initial literature review allowed us to define the following objectives for our artifact:

* The artifact should delineate organization-wide capability areas that are considered to be important in CDR adoption.

* The artifact should enable the integration of both social and environmental dimensions within its evaluative framework.

* It should enable organizations to conduct an assessment of their current state concerning CDR adoption, including the identification of organizational strengths and weaknesses relative to CDR adoption.

* The artifact should be easy to understand for decision-makers to facilitate its adoption.

* Considering the dynamic nature of organizational landscapes and technological advancements, the artifact should be mutable and industry-agnostic.

(2) Comparison of existing maturity models. While CDR remains a relatively novel subject with no existing maturity models, we analyzed maturity models put forth by the Green IT/IS community. Although these models predominantly focus on environmental responsibility, we deemed their insights invaluable for our analysis. Furthermore, the SICT-CMF framework, incorporating high-level capabilities for socio-environmental dimensions of digitalization, was chosen as the foundation for our model.

(3) Determination of development strategy. Leveraging the SICT-CMF model as a foundational framework ensures the grounding of our model in established principles. Through the analysis of CDR best practices and insights gathered from experts engaged in the field, the developed model aims to reflect the current understanding of the essential capability areas necessary for organizations to effectively implement CDR.

(4) Iterative maturity model development. This phase involves a series of iterative sub-steps (Fig. 1). Since this is a central phase within the guidelines, it is discussed in greater detail in the following section. Detailed methodological material, such as a full description of a Systematic Literature Review, interview protocol, and results from the Delphi study, is excluded from this paper due to space constraints. An interested reader can consult them via: http://l3i-share.univ-lr.fr/2024CDR/Appendix-CDR-MM.pdf

<figure><img src="image_2.png" /><figcaption>Fig. 1. Iterative CDR maturity model development</figcaption></figure>

(5) Conception of transfer and evaluation. During this stage, the modes of transferring results to academic and user communities need to be defined. Academic communities will gain access to the model through articles and conferences. Additionally, the model has been developed in collaboration with the Square Management consulting company, where one of the authors performs her Ph.D. research, providing practitioners, particularly consultants in strategy and management, with a valuable tool for industry application.
a systematic and widespread adoption. For a comprehensive analysis of Green IT/IS maturity models, readers are encouraged to refer to the literature review by [18] revealing that no single model is all-encompassing and most of them overlook social dimensions. Additionally, many of these models rely on literature reviews and interviews, missing a more empirical approach.

Given the absence of any existing maturity model for CDR, the model we introduce possesses a descriptive nature, paving the way for subsequent evolution into a prescriptive phase within a specific domain. Our proposal aims to bridge several gaps identified in the literature:

1) The scarcity of empirical research in the realm of CDR, particularly from non-German contexts.

2) The lack of frameworks and models designed to assist organizations in evaluating, enhancing, and cultivating the necessary organization-wide capabilities for CDR adoption.

3) The insufficiency of approaches that integrate both environmental and social considerations for guiding digitalization within organizations.

### III. METHODOLOGY

Design science research aims to create and evaluate innovative artifacts, such as methods, models, or tools, in order to solve practical problems and improve the existing state of practice, as well as existing research knowledge [48]. In the domain of IT, Becker, Knackstedt and Pöppelbuß introduced guidelines for designing maturity models by leveraging the principles of design science research [26]. To ensure the robust development of maturity models these guidelines are being increasingly adopted by scholars [49]. For the same reason, we also chose to adhere to them and followed the defined phases:

(1) Problem definition. The original problem was identified in [16]. In addition to the literature analysis, discussed in Section 2, the need for guidelines or frameworks on how to assess the current state of CDR was further confirmed through consultations with industry practitioners. The initial literature review allowed us to define the following objectives for our artifact:

* The artifact should delineate organization-wide capability areas that are considered to be important in CDR adoption.

* The artifact should enable the integration of both social and environmental dimensions within its evaluative framework.

* It should enable organizations to conduct an assessment of their current state concerning CDR adoption, including the identification of organizational strengths and weaknesses relative to CDR adoption.

* The artifact should be easy to understand for decision-makers to facilitate its adoption.

* Considering the dynamic nature of organizational landscapes and technological advancements, the artifact should be mutable and industry-agnostic.

(2) Comparison of existing maturity models. While CDR remains a relatively novel subject with no existing maturity models, we analyzed maturity models put forth by the Green IT/IS community. Although these models predominantly focus on environmental responsibility, we deemed their insights invaluable for our analysis. Furthermore, the SICT-CMF framework, incorporating high-level capabilities for socio-environmental dimensions of digitalization, was chosen as the foundation for our model.

(3) Determination of development strategy. Leveraging the SICT-CMF model as a foundational framework ensures the grounding of our model in established principles. Through the analysis of CDR best practices and insights gathered from experts engaged in the field, the developed model aims to reflect the current understanding of the essential capability areas necessary for organizations to effectively implement CDR.

(4) Iterative maturity model development. This phase involves a series of iterative sub-steps (Fig. 1). Since this is a central phase within the guidelines, it is discussed in greater detail in the following section. Detailed methodological material, such as a full description of a Systematic Literature Review, interview protocol, and results from the Delphi study, is excluded from this paper due to space constraints. An interested reader can consult them via: http://l3i-share.univ-lr.fr/2024CDR/Appendix-CDR-MM.pdf

<figure><img src="image_2.png" /><figcaption>Fig. 1. Iterative CDR maturity model development</figcaption></figure>

(5) Conception of transfer and evaluation. During this stage, the modes of transferring results to academic and user communities need to be defined. Academic communities will gain access to the model through articles and conferences. Additionally, the model has been developed in collaboration with the Square Management consulting company, where one of the authors performs her Ph.D. research, providing practitioners, particularly consultants in strategy and management, with a valuable tool for industry application.
(6) Implementation of the transfer media. The maturity model will be shared through academic articles.

(7) Evaluation. This phase is intended to confirm whether the maturity model delivers the anticipated benefits and offers an improved solution to the defined problem. It is a continuously ongoing phase to ensure the relevance of the model.

(8) Rejection. In cases where negative results emerge, leading to the model's rejection, removal of the model from the market may be necessary.

## A. Iterative maturity model development

1) **Conceptual Development:** The research began with a literature review, leading to the development of an initial model architecture, forming the foundation for the CDR maturity model. Data collection involved a Systematic Literature Review (SLR)[50] with content analysis principles [51]. Our bibliographic research primarily drew from the SCOPUS database, augmented with results from Google Scholar. After applying exclusion criteria, we found and analyzed 23 articles that contained the term "Corporate Digital Responsibility". The scope was expanded by incorporating secondary and grey literature, such as reports published by think tanks or working groups, on best practices in GreenIT/IS and CDR.

Using an inductive content analysis approach [51], and guided by our research question, we constructed dimensions and sub-dimensions by categorizing similar "best practices" and ideas from the literature. This resulted in our initial maturity model comprising five general categories and 19 sub-categories of focus areas for CDR assessment.

2) **Empirical Development:** In a relatively new domain, such as CDR, a literature review is considered only sufficient in providing a theoretical starting point for a maturity model and other means of construct identification are necessary [40]. Thus, to confirm and identify further focus areas, deemed to be important for CDR implementation and its assessment, we carried out an empirical development.

The first step involved putting the initial model into practice within the IT department of a French company, SAUR, specializing in water management. We conducted semi-structured interviews with nine individuals representing various teams, while an additional six collaborators provided responses via email. The interview sessions, lasting between 30 minutes and two hours, commenced with a foundational question: "According to you, what is Digital Responsibility?" Subsequent inquiries probed into the specific digital responsibility actions implemented within their respective business lines and teams, as well as suggestions for improvement. To conclude, participants were invited to provide feedback on the comprehensiveness of the questions posed. All the transcriptions and notes were communicated back to the interviewees. This provided an opportunity for the interviewees to clarify some of their statements if they felt it was needed.

Drawing on insights derived from these interviews, the maturity model underwent slight modifications to enhance alignment with the company's context. Specifically, a sub-category addressing *Digital Well-being* was introduced within

the *Workplace* category. Furthermore, concerns were raised regarding the oversight of responsible digital practices in industrial printing—an area crucial to their operations. In response, these practices were subsequently integrated under a *Client Relationship* sub-category. This feedback-driven evolution resulted in the model’s second version.

Complementing the qualitative approach, we analyzed both internal and external company documents to assess the organization's maturity using the developed model. The model's utility was confirmed as it facilitated the formulation of a high-level roadmap for CDR implementation within the company. While practitioners found the model comprehensible and valuable, their feedback was invaluable in refining and enhancing its applicability.

Subsequently, the model underwent further refinement through a year-long sequence of focus group discussions held within the Square Management consulting company. These discussions involved 12 strategy consultants possessing diverse expertise in areas such as CSR, IT architecture, and change management. Consultants were presented with Version 2 of the CDR maturity model, and organized into five groups of 2 to 3 consultants each. Each group examined a specific general category along with its underlying sub-categories. They engaged in discussions to identify best practices that align with their expectations for each category, critically assessed the proposed best practices, and evaluated whether the sub-categories accurately represented the realities known to the consultants through their client interactions. Noteworthy is that these discussions occurred without the direct involvement of a supervising researcher. Once consensus was reached within each group, the results were presented to the whole group, where other participants could challenge or contribute suggestions regarding the taxonomy or model structure. Throughout this iterative process, the supervising researcher was present in six sessions, with the first being introductory and the subsequent five dedicated to the discussion of each category. This stage culminated in the development of the model's third version.

3) **Validation:** In this stage, our objective was to assess the construct validity of the model, a critical aspect of its development [26]. Leveraging the Delphi method, we engaged a panel of experts in the field to evaluate the model's relevance, gather valuable feedback, and assess the model's representation of the CDR domain, as seen by experts.

The Delphi study is often used in developing MM [26], [41], [49] and was chosen as particularly advantageous in our research since we were interested in 1) identifying and elaborating a set of constructs 2) classification and taxonomy development [40]. It is a method for organizing structured group communication processes to gather insights and feedback on existing challenges, particularly in contexts with limited information, facilitating consensus among a group of experts [52]. The methodology involves iterative rounds, wherein each successive set of statements or questions evolves based on the responses and feedback to the preceding ones. The Delphi process concludes upon achieving consensus
(6) Implementation of the transfer media. The maturity model will be shared through academic articles.

(7) Evaluation. This phase is intended to confirm whether the maturity model delivers the anticipated benefits and offers an improved solution to the defined problem. It is a continuously ongoing phase to ensure the relevance of the model.

(8) Rejection. In cases where negative results emerge, leading to the model's rejection, removal of the model from the market may be necessary.

## A. Iterative maturity model development

1) **Conceptual Development:** The research began with a literature review, leading to the development of an initial model architecture, forming the foundation for the CDR maturity model. Data collection involved a Systematic Literature Review (SLR)[50] with content analysis principles [51]. Our bibliographic research primarily drew from the SCOPUS database, augmented with results from Google Scholar. After applying exclusion criteria, we found and analyzed 23 articles that contained the term "Corporate Digital Responsibility". The scope was expanded by incorporating secondary and grey literature, such as reports published by think tanks or working groups, on best practices in GreenIT/IS and CDR.

Using an inductive content analysis approach [51], and guided by our research question, we constructed dimensions and sub-dimensions by categorizing similar "best practices" and ideas from the literature. This resulted in our initial maturity model comprising five general categories and 19 sub-categories of focus areas for CDR assessment.

2) **Empirical Development:** In a relatively new domain, such as CDR, a literature review is considered only sufficient in providing a theoretical starting point for a maturity model and other means of construct identification are necessary [40]. Thus, to confirm and identify further focus areas, deemed to be important for CDR implementation and its assessment, we carried out an empirical development.

The first step involved putting the initial model into practice within the IT department of a French company, SAUR, specializing in water management. We conducted semi-structured interviews with nine individuals representing various teams, while an additional six collaborators provided responses via email. The interview sessions, lasting between 30 minutes and two hours, commenced with a foundational question: "According to you, what is Digital Responsibility?" Subsequent inquiries probed into the specific digital responsibility actions implemented within their respective business lines and teams, as well as suggestions for improvement. To conclude, participants were invited to provide feedback on the comprehensiveness of the questions posed. All the transcriptions and notes were communicated back to the interviewees. This provided an opportunity for the interviewees to clarify some of their statements if they felt it was needed.

Drawing on insights derived from these interviews, the maturity model underwent slight modifications to enhance alignment with the company's context. Specifically, a sub-category addressing *Digital Well-being* was introduced within

the *Workplace* category. Furthermore, concerns were raised regarding the oversight of responsible digital practices in industrial printing—an area crucial to their operations. In response, these practices were subsequently integrated under a *Client Relationship* sub-category. This feedback-driven evolution resulted in the model’s second version.

Complementing the qualitative approach, we analyzed both internal and external company documents to assess the organization's maturity using the developed model. The model's utility was confirmed as it facilitated the formulation of a high-level roadmap for CDR implementation within the company. While practitioners found the model comprehensible and valuable, their feedback was invaluable in refining and enhancing its applicability.

Subsequently, the model underwent further refinement through a year-long sequence of focus group discussions held within the Square Management consulting company. These discussions involved 12 strategy consultants possessing diverse expertise in areas such as CSR, IT architecture, and change management. Consultants were presented with Version 2 of the CDR maturity model, and organized into five groups of 2 to 3 consultants each. Each group examined a specific general category along with its underlying sub-categories. They engaged in discussions to identify best practices that align with their expectations for each category, critically assessed the proposed best practices, and evaluated whether the sub-categories accurately represented the realities known to the consultants through their client interactions. Noteworthy is that these discussions occurred without the direct involvement of a supervising researcher. Once consensus was reached within each group, the results were presented to the whole group, where other participants could challenge or contribute suggestions regarding the taxonomy or model structure. Throughout this iterative process, the supervising researcher was present in six sessions, with the first being introductory and the subsequent five dedicated to the discussion of each category. This stage culminated in the development of the model's third version.

3) **Validation:** In this stage, our objective was to assess the construct validity of the model, a critical aspect of its development [26]. Leveraging the Delphi method, we engaged a panel of experts in the field to evaluate the model's relevance, gather valuable feedback, and assess the model's representation of the CDR domain, as seen by experts.

The Delphi study is often used in developing MM [26], [41], [49] and was chosen as particularly advantageous in our research since we were interested in 1) identifying and elaborating a set of constructs 2) classification and taxonomy development [40]. It is a method for organizing structured group communication processes to gather insights and feedback on existing challenges, particularly in contexts with limited information, facilitating consensus among a group of experts [52]. The methodology involves iterative rounds, wherein each successive set of statements or questions evolves based on the responses and feedback to the preceding ones. The Delphi process concludes upon achieving consensus
among the participating experts. The element of anonymity within the Delphi methodology is instrumental in establishing an environment that fosters open expression of opinions by participants, thereby mitigating inhibitions commonly associated with decision-making processes [53]. In order to gather insights that reflect current knowledge and perceptions, the heterogeneity and the level of expertise of panel members are deemed to be crucial factors in this method [52], [54].

Given the objective of the CDR Maturity Model to guide organizations in implementing and assessing CDR, we deliberately focused on involving its primary audience – practitioners, in the panel. Selected experts bring practical experience in CDR, sustainable IT, or Green IT, and actively participate in digital transformation initiatives. The inclusion of professionals from diverse sectors and companies of varying sizes allows to gather insights into the model’s applicability across different organizational contexts. Given that the empirical development initially involved French practitioners, we intentionally selected experts with international experience to validate the model’s relevance beyond France. Considering the model’s empirical derivation through feedback from practitioners, we’ve also solicited academics specializing in CDR to challenge the proposed model’s theoretical validity.

In our validation approach, we employed a two-stage process. First, one-hour brainstorming sessions were conducted with each participant using a Miro board to present the maturity model. Participants shared their initial insights and suggestions for improvement. These sessions aimed to ensure participant familiarity with the model, clarify study objectives, and identify early feedback for guiding subsequent Delphi rounds. Recurring themes, like the lack of "digital marketing" practices and the need for additional sub-categories within the "Ecosystems" dimension, emerged during these sessions.

The second stage comprised three rounds of online anonymous questionnaires to gauge convergence among experts on the comprehensiveness and consistency of proposed constructs. In the first two rounds, participants could comment and introduce new elements, while the third round served as a confirmatory phase with no opportunity for additional elements. In the first round, experts voted on whether an element should "include as it is," "change," or be removed, with open-ended questions to clarify feedback. The questionnaire was refined based on the first-round feedback. Participants were also provided with the feedback received from their peers and invited to share their thoughts. Consensus to include a construct was reached if over 50% of the participants voted in favor [55]; elements not meeting this threshold were modified or removed. Due to time constraints, the questionnaire concluded after three rounds.

In the next section, we present the final version of the CDR MM followed by a discussion and limitations.

## IV. DESCRIPTIVE CDR MATURITY MODEL

The final version of the CDR MM (Fig. 2) is comprised of 18 focus areas where an organization should develop its capabilities for CDR along the following 5 dimensions:

<table><caption>TABLE I
ATTRIBUTES OF CDR MM BASED ON [39] GUIDELINES, TO ENCOURAGE REUSABILITY OF THE MODEL.</caption><thead><tr><th></th><th></th></tr></thead><tbody><tr><td>Name</td><td>CDR maturity model</td></tr><tr><td>Addressed topics</td><td>Corporate Digital Responsibility</td></tr><tr><td>Origin of the model</td><td>Academic and practice</td></tr><tr><td>The targeted audience of the model</td><td>Management-oriented</td></tr><tr><td>Concept of maturity</td><td>Process maturity</td></tr><tr><td>Composition</td><td>Maturity grids - illustrating a number of levels of maturity in a simple, textual manner</td></tr><tr><td>Reliability</td><td>Partially validated</td></tr><tr><td>Mutability</td><td>The underlying meta-model and best practices can be easily changed and modified</td></tr><tr><td>Method of application</td><td>Self-assessment of third-party assisted assessment</td></tr><tr><td>Support of application</td><td>Textual description</td></tr><tr><td>Practicality of evidence</td><td>Implicit recommendations</td></tr></tbody></table>

1) CDR governance – includes the organization’s commitment to CDR, CDR strategy, and its alignment with the broader sustainability strategy of the organization. It also involves the establishment of cross-functional governance mechanisms to ensure that CDR initiatives are not confined to a single department but are deployed and monitored across the entire organization in a continuous manner. Additionally, compliance with both local and global regulatory frameworks is a consideration, as is a comprehensive risk and opportunities assessment related to digital business activities.

2) Workplace & Culture – defines the responsible practices adopted by collaborators as they use digital solutions in their day-to-day operations. Simultaneously it includes harnessing digitalization within the company to generate positive impacts. Central to this endeavor is the cultivation of a responsible digital culture through awareness initiatives, targeted employee training, supporting grassroots CDR initiatives, and implementing diversity and inclusion within digital solution teams.

3) IT assets management – includes digital assets employed by the organization to run its operational activities. It encompasses on-site infrastructure and networks, as well as Infrastructure as a Service (IaaS). It extends to the scrutiny of requirements, maintenance, and the decommissioning of employee-specific, shared, and industry-specific equipment so that the practices would adhere to CDR principles.

4) Digital Services – pertains to the entire life cycle of digital services created and provided by an organization for its internal and external clients. It encompasses responsible practices from questioning the need for solutions and their potential impacts, all the way to their design and development, and maintenance until they reach their end-of-life phase.

5) Ecosystems - covers the spectrum of procurement practices and supplier relationships. It further encompasses customer communications and considerations of scope 3 emissions. It also includes collaborative efforts, such
among the participating experts. The element of anonymity within the Delphi methodology is instrumental in establishing an environment that fosters open expression of opinions by participants, thereby mitigating inhibitions commonly associated with decision-making processes [53]. In order to gather insights that reflect current knowledge and perceptions, the heterogeneity and the level of expertise of panel members are deemed to be crucial factors in this method [52], [54].

Given the objective of the CDR Maturity Model to guide organizations in implementing and assessing CDR, we deliberately focused on involving its primary audience – practitioners, in the panel. Selected experts bring practical experience in CDR, sustainable IT, or Green IT, and actively participate in digital transformation initiatives. The inclusion of professionals from diverse sectors and companies of varying sizes allows to gather insights into the model’s applicability across different organizational contexts. Given that the empirical development initially involved French practitioners, we intentionally selected experts with international experience to validate the model’s relevance beyond France. Considering the model’s empirical derivation through feedback from practitioners, we’ve also solicited academics specializing in CDR to challenge the proposed model’s theoretical validity.

In our validation approach, we employed a two-stage process. First, one-hour brainstorming sessions were conducted with each participant using a Miro board to present the maturity model. Participants shared their initial insights and suggestions for improvement. These sessions aimed to ensure participant familiarity with the model, clarify study objectives, and identify early feedback for guiding subsequent Delphi rounds. Recurring themes, like the lack of "digital marketing" practices and the need for additional sub-categories within the "Ecosystems" dimension, emerged during these sessions.

The second stage comprised three rounds of online anonymous questionnaires to gauge convergence among experts on the comprehensiveness and consistency of proposed constructs. In the first two rounds, participants could comment and introduce new elements, while the third round served as a confirmatory phase with no opportunity for additional elements. In the first round, experts voted on whether an element should "include as it is," "change," or be removed, with open-ended questions to clarify feedback. The questionnaire was refined based on the first-round feedback. Participants were also provided with the feedback received from their peers and invited to share their thoughts. Consensus to include a construct was reached if over 50% of the participants voted in favor [55]; elements not meeting this threshold were modified or removed. Due to time constraints, the questionnaire concluded after three rounds.

In the next section, we present the final version of the CDR MM followed by a discussion and limitations.

## IV. DESCRIPTIVE CDR MATURITY MODEL

The final version of the CDR MM (Fig. 2) is comprised of 18 focus areas where an organization should develop its capabilities for CDR along the following 5 dimensions:

<table><caption>TABLE I
ATTRIBUTES OF CDR MM BASED ON [39] GUIDELINES, TO ENCOURAGE REUSABILITY OF THE MODEL.</caption><thead><tr><th></th><th></th></tr></thead><tbody><tr><td>Name</td><td>CDR maturity model</td></tr><tr><td>Addressed topics</td><td>Corporate Digital Responsibility</td></tr><tr><td>Origin of the model</td><td>Academic and practice</td></tr><tr><td>The targeted audience of the model</td><td>Management-oriented</td></tr><tr><td>Concept of maturity</td><td>Process maturity</td></tr><tr><td>Composition</td><td>Maturity grids - illustrating a number of levels of maturity in a simple, textual manner</td></tr><tr><td>Reliability</td><td>Partially validated</td></tr><tr><td>Mutability</td><td>The underlying meta-model and best practices can be easily changed and modified</td></tr><tr><td>Method of application</td><td>Self-assessment of third-party assisted assessment</td></tr><tr><td>Support of application</td><td>Textual description</td></tr><tr><td>Practicality of evidence</td><td>Implicit recommendations</td></tr></tbody></table>

1) CDR governance – includes the organization’s commitment to CDR, CDR strategy, and its alignment with the broader sustainability strategy of the organization. It also involves the establishment of cross-functional governance mechanisms to ensure that CDR initiatives are not confined to a single department but are deployed and monitored across the entire organization in a continuous manner. Additionally, compliance with both local and global regulatory frameworks is a consideration, as is a comprehensive risk and opportunities assessment related to digital business activities.

2) Workplace & Culture – defines the responsible practices adopted by collaborators as they use digital solutions in their day-to-day operations. Simultaneously it includes harnessing digitalization within the company to generate positive impacts. Central to this endeavor is the cultivation of a responsible digital culture through awareness initiatives, targeted employee training, supporting grassroots CDR initiatives, and implementing diversity and inclusion within digital solution teams.

3) IT assets management – includes digital assets employed by the organization to run its operational activities. It encompasses on-site infrastructure and networks, as well as Infrastructure as a Service (IaaS). It extends to the scrutiny of requirements, maintenance, and the decommissioning of employee-specific, shared, and industry-specific equipment so that the practices would adhere to CDR principles.

4) Digital Services – pertains to the entire life cycle of digital services created and provided by an organization for its internal and external clients. It encompasses responsible practices from questioning the need for solutions and their potential impacts, all the way to their design and development, and maintenance until they reach their end-of-life phase.

5) Ecosystems - covers the spectrum of procurement practices and supplier relationships. It further encompasses customer communications and considerations of scope 3 emissions. It also includes collaborative efforts, such
<figure><img src="image_3.png" /><figcaption>Fig. 2. Proposed CDR Maturity Model</figcaption></figure>

as working with peers, academic institutions, and gov-
ernment partners, to collectively advance responsible
digitalization practices.

Table III provides descriptions of each focus area perceived, by actors presently engaged in CDR discussions, as important to be considered when evaluating and implementing CDR actions. The concrete CDR actions and principles, grounded in a set of shared values and norms, should be tailored to the organization's specific operational context.

A. Maturity Levels

Building upon the SICT-CMF and Dörr (2021), as well as
discussions with practitioners in the empirical development
stage and insights for the Delphi study participants, 6 maturity
levels are proposed (Fig. 3):

Level 0: Non-existent. No CDR actions taken.

Level 1: Initial awareness. At this level, an organization has minimal awareness of CDR and is at the starting point of its CDR journey across all themes. There is no structured approach in place, and CDR-related activities are ad hoc. The organization lacks a clear understanding of CDR concepts, and there are no established policies or strategies. Accountabilities for CDR are not defined. The organization is just beginning to understand the relevance of CDR.

Level 2: Reactive measures. At this stage, an organization has taken initial steps toward CDR implementation. There is a recognition of the need for CDR, and reactive measures are in place in response to specific circumstances or external pressures. However, these measures are often inconsistent and lack a formalized and systematized approach. CDR is not yet fully integrated into the organization's strategy and operations.

Level 3: Proactive and standardized measures. The organ-
ization has embraced a proactive approach to CDR. CDR
initiatives and policies are in place, and there is a growing

emphasis on standardization and a structured approach. The
organization has developed skills related to CDR across differ-
ent themes. Capacity building, responsibilities, and resources
supporting CDR practices are in place. Targets and metrics
(KPIs) are tracked at a project level and CDR is becoming an
integral part of the organization's operations.

Level 4. Continuous and measured improvement. The organ-
ization demonstrates a commitment to continuous improve-
ment in CDR. A well-prioritized CDR policy is consistently
integrated into the organization's operations and strategies.
CDR progress is actively measured, and there is an ongoing
effort to enhance CDR practices based on data-driven insights.
The organization is focused on achieving excellence in CDR.

Level 5. Industry Leadership and Innovation. CDR is fully integrated into the organization's strategic planning and core business processes. There is an alignment between CDR goals and broader business objectives. The organization is an innovator in the field, implementing best practices, sharing their knowledge, and driving industry standards and legislation. CDR practices extend beyond organizational boundaries, involving customers, suppliers, and partners in responsible initiatives.

Since CDR is a relatively new field we used a top-down
approach, defining what represents the maturity [40]. Rep-
resentation of one-dimensional scales is widely accepted for
descriptive maturity models [42]. This form of assessment
results in an ‘average’ maturity level for each dimension.
While this approach might face criticism due to its inherent
simplicity as opposed to having different types of maturity
levels for different dimensions [42], it does not limit the
potential for an organization to gain a deeper understanding
of their relative strengths and weaknesses in a particular
area since each focus area is evaluated separately. Thus, the
<figure><img src="image_3.png" /><figcaption>Fig. 2. Proposed CDR Maturity Model</figcaption></figure>

as working with peers, academic institutions, and gov-
ernment partners, to collectively advance responsible
digitalization practices.

Table III provides descriptions of each focus area perceived, by actors presently engaged in CDR discussions, as important to be considered when evaluating and implementing CDR actions. The concrete CDR actions and principles, grounded in a set of shared values and norms, should be tailored to the organization's specific operational context.

A. Maturity Levels

Building upon the SICT-CMF and Dörr (2021), as well as
discussions with practitioners in the empirical development
stage and insights for the Delphi study participants, 6 maturity
levels are proposed (Fig. 3):

Level 0: Non-existent. No CDR actions taken.

Level 1: Initial awareness. At this level, an organization has minimal awareness of CDR and is at the starting point of its CDR journey across all themes. There is no structured approach in place, and CDR-related activities are ad hoc. The organization lacks a clear understanding of CDR concepts, and there are no established policies or strategies. Accountabilities for CDR are not defined. The organization is just beginning to understand the relevance of CDR.

Level 2: Reactive measures. At this stage, an organization has taken initial steps toward CDR implementation. There is a recognition of the need for CDR, and reactive measures are in place in response to specific circumstances or external pressures. However, these measures are often inconsistent and lack a formalized and systematized approach. CDR is not yet fully integrated into the organization's strategy and operations.

Level 3: Proactive and standardized measures. The organ-
ization has embraced a proactive approach to CDR. CDR
initiatives and policies are in place, and there is a growing

emphasis on standardization and a structured approach. The
organization has developed skills related to CDR across differ-
ent themes. Capacity building, responsibilities, and resources
supporting CDR practices are in place. Targets and metrics
(KPIs) are tracked at a project level and CDR is becoming an
integral part of the organization's operations.

Level 4. Continuous and measured improvement. The organ-
ization demonstrates a commitment to continuous improve-
ment in CDR. A well-prioritized CDR policy is consistently
integrated into the organization's operations and strategies.
CDR progress is actively measured, and there is an ongoing
effort to enhance CDR practices based on data-driven insights.
The organization is focused on achieving excellence in CDR.

Level 5. Industry Leadership and Innovation. CDR is fully integrated into the organization's strategic planning and core business processes. There is an alignment between CDR goals and broader business objectives. The organization is an innovator in the field, implementing best practices, sharing their knowledge, and driving industry standards and legislation. CDR practices extend beyond organizational boundaries, involving customers, suppliers, and partners in responsible initiatives.

Since CDR is a relatively new field we used a top-down
approach, defining what represents the maturity [40]. Rep-
resentation of one-dimensional scales is widely accepted for
descriptive maturity models [42]. This form of assessment
results in an ‘average’ maturity level for each dimension.
While this approach might face criticism due to its inherent
simplicity as opposed to having different types of maturity
levels for different dimensions [42], it does not limit the
potential for an organization to gain a deeper understanding
of their relative strengths and weaknesses in a particular
area since each focus area is evaluated separately. Thus, the
<figure><img src="image_4.png" /><figcaption>Fig. 3. CDR Maturity Levels</figcaption></figure>

model design offers a balance between a complex reality and model over-simplification. The ability to drill down through the maturity assessment enables reports to be tailored to the varying needs of multiple audiences. If dimensions could be more interesting for C-level management, maturity in different focus areas could be more relevant for managers and staff.

## B. Method of application

Both qualitative and quantitative measures can be used to assess CDR maturity. Our proposed model presents focus areas, deemed by actors currently involved in CDR implementation, as necessary to assess when evaluating CDR efforts. Notably, we have refrained from introducing specific, prescriptive questionnaires or best practices. Existing industry standards and guidelines put forward by academics, such as those mentioned in Table III, can provide a basis for the analysis of specific MM areas. While validating their role in CDR falls beyond the scope of this paper, these standards and principles can be employed as a foundation for developing a more prescriptive MM, tailored to each organization's unique nature and context.

Since the impacts of digitalization span a wide spectrum, with varying relevance to different organizations, an organization needs to define its CDR scope and identify the most important CDR principles for its business and stakeholders prior to employing the maturity model. The proposed descriptive model, designed with mutability in mind, serves as the foundational step in the development of more comprehensive frameworks, encompassing precise questions customized to specific contexts.

## V. DISCUSSION AND THREATS TO VALIDITY

Following [26] guidelines, we employed different research methods to extract assessment criteria, considered to be important in the CDR evaluation. While the basic structural design resulted from the SLR and content analysis, the focus areas have been refined and confirmed through the feedback of actors involved in CDR development. In this section we share our observations derived from the iterative stages of CDR MM development, suggesting areas for future investigation.

The five dimensions resulting from the initial SLR remained consistent throughout development. Nevertheless, we acknowledge the subjective nature of coding that could lead to different categorizations by other researchers, potentially shaping subsequent stages differently.

The most consistent consensus across iterations has been on the *CDR Governance* dimension. It incorporates and extends *Strategy and planning*, as well as, *Governance* categories from the SICT-CMF. Delphi participants have particularly appreciated the *Ecosystems* dimension. This is the most significant departure from the SICT-CMF, where capability building blocks concerning clients and suppliers have been omitted. The newly introduced *IT assets management* dimension, on the other hand, proved to be more controversial. If the need for a separate focus area for *Industrial equipment* emerged during empirical development and was reinforced by Delphi participants' feedback, the general dimension of *IT assets management* prompted debates on its relevance. Participants challenged the categorization of actions regarding cloud services and questioned whether certain practices should not be excluded from the CDR altogether and incorporated into traditional CSR strategies. Debates also emerged around AI technologies, with participants ultimately agreeing on the importance of flexibility in accommodating any emerging technologies within the model. As one of the participants commented: "An effective maturity model would be flexible enough to account for emerging technologies while also guiding what individuals and organizations can do today to safeguard against tomorrow's unintended consequences."

Regarding maturity levels, we initially proposed five, based on SICT-CMF and Dörr [13]. Yet, Delphi participants advocated for an even number of levels to avoid a bias towards the middle ground. In the current descriptive model, the maturity levels remain generic. As part of the prescriptive maturity model development, further empirical research is required to identify the specific actions necessary for attaining each level.

Overall, the feedback received from the Delphi study participants has been positive regarding the proposed CDR Maturity Model. They saw its potential utility, addressing the initial
<figure><img src="image_4.png" /><figcaption>Fig. 3. CDR Maturity Levels</figcaption></figure>

model design offers a balance between a complex reality and model over-simplification. The ability to drill down through the maturity assessment enables reports to be tailored to the varying needs of multiple audiences. If dimensions could be more interesting for C-level management, maturity in different focus areas could be more relevant for managers and staff.

## B. Method of application

Both qualitative and quantitative measures can be used to assess CDR maturity. Our proposed model presents focus areas, deemed by actors currently involved in CDR implementation, as necessary to assess when evaluating CDR efforts. Notably, we have refrained from introducing specific, prescriptive questionnaires or best practices. Existing industry standards and guidelines put forward by academics, such as those mentioned in Table III, can provide a basis for the analysis of specific MM areas. While validating their role in CDR falls beyond the scope of this paper, these standards and principles can be employed as a foundation for developing a more prescriptive MM, tailored to each organization's unique nature and context.

Since the impacts of digitalization span a wide spectrum, with varying relevance to different organizations, an organization needs to define its CDR scope and identify the most important CDR principles for its business and stakeholders prior to employing the maturity model. The proposed descriptive model, designed with mutability in mind, serves as the foundational step in the development of more comprehensive frameworks, encompassing precise questions customized to specific contexts.

## V. DISCUSSION AND THREATS TO VALIDITY

Following [26] guidelines, we employed different research methods to extract assessment criteria, considered to be important in the CDR evaluation. While the basic structural design resulted from the SLR and content analysis, the focus areas have been refined and confirmed through the feedback of actors involved in CDR development. In this section we share our observations derived from the iterative stages of CDR MM development, suggesting areas for future investigation.

The five dimensions resulting from the initial SLR remained consistent throughout development. Nevertheless, we acknowledge the subjective nature of coding that could lead to different categorizations by other researchers, potentially shaping subsequent stages differently.

The most consistent consensus across iterations has been on the *CDR Governance* dimension. It incorporates and extends *Strategy and planning*, as well as, *Governance* categories from the SICT-CMF. Delphi participants have particularly appreciated the *Ecosystems* dimension. This is the most significant departure from the SICT-CMF, where capability building blocks concerning clients and suppliers have been omitted. The newly introduced *IT assets management* dimension, on the other hand, proved to be more controversial. If the need for a separate focus area for *Industrial equipment* emerged during empirical development and was reinforced by Delphi participants' feedback, the general dimension of *IT assets management* prompted debates on its relevance. Participants challenged the categorization of actions regarding cloud services and questioned whether certain practices should not be excluded from the CDR altogether and incorporated into traditional CSR strategies. Debates also emerged around AI technologies, with participants ultimately agreeing on the importance of flexibility in accommodating any emerging technologies within the model. As one of the participants commented: "An effective maturity model would be flexible enough to account for emerging technologies while also guiding what individuals and organizations can do today to safeguard against tomorrow's unintended consequences."

Regarding maturity levels, we initially proposed five, based on SICT-CMF and Dörr [13]. Yet, Delphi participants advocated for an even number of levels to avoid a bias towards the middle ground. In the current descriptive model, the maturity levels remain generic. As part of the prescriptive maturity model development, further empirical research is required to identify the specific actions necessary for attaining each level.

Overall, the feedback received from the Delphi study participants has been positive regarding the proposed CDR Maturity Model. They saw its potential utility, addressing the initial
<table><caption>TABLE II
VALIDATION STAGE OF THE OBJECTIVES OF THE DEVELOPED ARTIFACT</caption><thead><tr><th>Objectives of the artifact</th><th>Validation of Objectives</th></tr></thead><tbody><tr><td>1) The artifact should delineate organization-wide capability areas that are considered to be important in CDR adoption.</td><td>Partially Validated</td></tr><tr><td>2) The artifact should enable the integration of both social and environmental dimensions within its evaluative framework.</td><td>Validated</td></tr><tr><td>3) It should enable organizations to conduct an assessment of their current state concerning CDR adoption, including the identification of organizational strengths and weaknesses relative to CDR adoption.</td><td>Partially Validated - Future research should extend the evaluation by testing the model in non-French companies.</td></tr><tr><td>4) The artifact should be easy to understand for decision-makers to facilitate its adoption.</td><td>Validated</td></tr><tr><td>5) Considering the dynamic nature of organizational landscapes and technological advancements, the artifact should be mutable and industry-agnostic</td><td>Partially Validated - The model has been empirically applied in one industry; further empirical tests are necessary for more complete validation.</td></tr></tbody></table>

problem adequately, and stressed the importance of the fact that from its structure it was easy to see who would be responsible in an organization for each of the focus areas. During discussions on the scope of each MM dimension, participants from the empirical development phase and the majority of those in the Delphi study stressed the necessity of integrating both the environmental and social questions, as well as assessing the dual impacts — positive and negative — of digitalization. However, the Delphi study, initially with 10 participants, fell below the suggested minimum of 8 participants [54] in the first and third rounds of the questionnaire, warranting partial validation of the constructs (Table II).

Finally, it is important to note, that we do not assume that the derived model presents the reality of CDR. Rather it is a reflection of researchers' and study participants' view of their realities. Even if we tried limiting the researcher's bias by adopting multiple methodological techniques, we refrain from assuming that the results represent the perfect and the right suite of CDR constructs. Given the continuous evolution of the field, evidenced by the emergence of new literature on Green IT maturity models (e.g.: [56]) since the model's development, it becomes evident that changing conditions, technological advancements, and fresh scientific insights necessitate an ongoing process of validation and scrutiny for the model. Consequently, new versions of the model should be deemed not only desired but also necessary to stay relevant for practitioners and to advance the academic discourse around CDR and responsible digital transformations.

## VI. CONCLUSIONS

The developed CDR MM is designed to enhance organizations' comprehension of the complexities surrounding CDR and, in turn, strengthen their capabilities within this domain. Functioning as a diagnostic instrument, the model's core purpose lies in assessing and elucidating an organization's current state ('as-is') in terms of CDR positioning. The proposed model is a departure from existing GreenIT maturity models that predominantly emphasize environmental responsibility; our proposition broadens the scope to accommodate social

dimensions on an organizational-wide scale. It also enriches the theoretical understanding of CDR, confirming that practitioners expect the inclusion of both environmental and social topics within the scope of CDR initiatives. The initial version of the model received positive feedback from practitioners, proving its utility by facilitating the formulation of a high-level roadmap for CDR implementation within the French company. The affirming response from Delphi study participants towards the final iteration of the model further validates its utility.

We hope that the CDR MM will contribute to understanding how CDR implementation can be systematically assessed and will increase organizations' capacity to proactively anticipate and navigate the challenges posed by the evolving landscape of sustainable development and digitalization. The developed model has also the potential to serve as a foundation for future prescriptive maturity models tailored to specific contextual needs and expand the existing academic discourse on CDR. Finally, the results of this study will inform the broader research initiative we are carrying out, which is focused on decision-aiding methodologies that help to anticipate the socio-environmental impacts of IT decisions while leveraging digitalization for sustainable development.

## VII. ACKNOWLEDGEMENT

We are grateful for all participants in the study, who dedicated their time and shared their insights on the model: collaborators of SAUR company, consultants of Square Management, Christophe Debuysscher, Gaël Duez, Tim Frick, Rainer Karcher, François Moriamez, Rob Price, Olivier Vergeynst, Grégoire Wallenborn, Prof Jochen Wirtz, and one other Delphi participant who preferred to stay anonymous. We would also like to thank Alexis Louaas for his valuable feedback on an earlier version of this article.
<table><caption>TABLE II
VALIDATION STAGE OF THE OBJECTIVES OF THE DEVELOPED ARTIFACT</caption><thead><tr><th>Objectives of the artifact</th><th>Validation of Objectives</th></tr></thead><tbody><tr><td>1) The artifact should delineate organization-wide capability areas that are considered to be important in CDR adoption.</td><td>Partially Validated</td></tr><tr><td>2) The artifact should enable the integration of both social and environmental dimensions within its evaluative framework.</td><td>Validated</td></tr><tr><td>3) It should enable organizations to conduct an assessment of their current state concerning CDR adoption, including the identification of organizational strengths and weaknesses relative to CDR adoption.</td><td>Partially Validated - Future research should extend the evaluation by testing the model in non-French companies.</td></tr><tr><td>4) The artifact should be easy to understand for decision-makers to facilitate its adoption.</td><td>Validated</td></tr><tr><td>5) Considering the dynamic nature of organizational landscapes and technological advancements, the artifact should be mutable and industry-agnostic</td><td>Partially Validated - The model has been empirically applied in one industry; further empirical tests are necessary for more complete validation.</td></tr></tbody></table>

problem adequately, and stressed the importance of the fact that from its structure it was easy to see who would be responsible in an organization for each of the focus areas. During discussions on the scope of each MM dimension, participants from the empirical development phase and the majority of those in the Delphi study stressed the necessity of integrating both the environmental and social questions, as well as assessing the dual impacts — positive and negative — of digitalization. However, the Delphi study, initially with 10 participants, fell below the suggested minimum of 8 participants [54] in the first and third rounds of the questionnaire, warranting partial validation of the constructs (Table II).

Finally, it is important to note, that we do not assume that the derived model presents the reality of CDR. Rather it is a reflection of researchers' and study participants' view of their realities. Even if we tried limiting the researcher's bias by adopting multiple methodological techniques, we refrain from assuming that the results represent the perfect and the right suite of CDR constructs. Given the continuous evolution of the field, evidenced by the emergence of new literature on Green IT maturity models (e.g.: [56]) since the model's development, it becomes evident that changing conditions, technological advancements, and fresh scientific insights necessitate an ongoing process of validation and scrutiny for the model. Consequently, new versions of the model should be deemed not only desired but also necessary to stay relevant for practitioners and to advance the academic discourse around CDR and responsible digital transformations.

## VI. CONCLUSIONS

The developed CDR MM is designed to enhance organizations' comprehension of the complexities surrounding CDR and, in turn, strengthen their capabilities within this domain. Functioning as a diagnostic instrument, the model's core purpose lies in assessing and elucidating an organization's current state ('as-is') in terms of CDR positioning. The proposed model is a departure from existing GreenIT maturity models that predominantly emphasize environmental responsibility; our proposition broadens the scope to accommodate social

dimensions on an organizational-wide scale. It also enriches the theoretical understanding of CDR, confirming that practitioners expect the inclusion of both environmental and social topics within the scope of CDR initiatives. The initial version of the model received positive feedback from practitioners, proving its utility by facilitating the formulation of a high-level roadmap for CDR implementation within the French company. The affirming response from Delphi study participants towards the final iteration of the model further validates its utility.

We hope that the CDR MM will contribute to understanding how CDR implementation can be systematically assessed and will increase organizations' capacity to proactively anticipate and navigate the challenges posed by the evolving landscape of sustainable development and digitalization. The developed model has also the potential to serve as a foundation for future prescriptive maturity models tailored to specific contextual needs and expand the existing academic discourse on CDR. Finally, the results of this study will inform the broader research initiative we are carrying out, which is focused on decision-aiding methodologies that help to anticipate the socio-environmental impacts of IT decisions while leveraging digitalization for sustainable development.

## VII. ACKNOWLEDGEMENT

We are grateful for all participants in the study, who dedicated their time and shared their insights on the model: collaborators of SAUR company, consultants of Square Management, Christophe Debuysscher, Gaël Duez, Tim Frick, Rainer Karcher, François Moriamez, Rob Price, Olivier Vergeynst, Grégoire Wallenborn, Prof Jochen Wirtz, and one other Delphi participant who preferred to stay anonymous. We would also like to thank Alexis Louaas for his valuable feedback on an earlier version of this article.
<table><caption>TABLE III: Focus areas of CDR MM</caption><thead><tr><th>Dimension</th><th>Focus area</th><th>Description</th><th>Examples of area-specific guidelines</th></tr></thead><tbody><tr><td rowspan="3">CDR Governance</td><td>Strategy &amp; Commitment</td><td>Develop a shared CDR vision and strategy aligned with the organization's values and other internal strategies. Demonstrate the long-term commitment to CDR by dedicating enough financial and human resources to drive continuous improvement. Ensure that CDR objectives are communicated transparently with internal and external stakeholders. Identify new business opportunities that may result from CDR actions.</td><td rowspan="3">[57]</td></tr><tr><td>Interdepartmental Governance</td><td>Include governance mechanisms to ensure and monitor that CDR would be applied in day-to-day processes across different business lines. Set up appropriate KPIs to measure the progress and impact of digitalization within the whole company. Strive for "CDR by design" adoption across all teams. Require accountability for CDR decision-making across the organization.</td></tr><tr><td>Risk &amp; Compliance</td><td>Enable and demonstrate compliance with local and global legislation and regulation on CDR topics. Have mechanisms in place to evaluate and prevent digitalization risks from a double materiality perspective (for business, employees, clients, and society at large).</td></tr><tr><td rowspan="2">Workplace &amp; Culture</td><td>Office &amp; Collaborative Tools</td><td>Minimize the adverse effects on both the environment and the digital well-being of collaborators arising from the use of office and collaborative tools. Create provisions for digital solutions to enable positive CDR outcomes across the organization.</td><td rowspan="2">[58]</td></tr><tr><td>CDR culture</td><td>Implement CDR principles, defined in CDR Governance, across the organization through awareness and job-specific training, by putting in place participatory and collaborative mechanisms. Include collaborators in change management processes and encourage diversity and inclusion in digital service teams. Prioritize ongoing engagement, capacity building, and continuous improvement on CDR topics.</td></tr><tr><td rowspan="6">IT asset management</td><td>Industrial equipment</td><td>Adopt internal policies and actions to operate and decommission industrial equipment, such as IoT or industrial printers, according to CDR principles. Continuously verify the need and utility of the equipment.</td><td rowspan="6">[59], [60]</td></tr><tr><td>Employee equipment</td><td>Adopt internal policies and actions to maintain and decommission employee equipment, such as laptops or company-owned mobile phones, according to CDR principles.</td></tr><tr><td>Shared equipment</td><td>Adopt internal policies and actions to operate and decommission shared equipment, such as printers or audio-visual equipment in conference rooms, according to CDR principles. Continuously verify the need and utility of the equipment.</td></tr><tr><td>Cloud</td><td>Choose the IaaS or private Cloud providers adhering to CDR principles. Include mechanisms in place to monitor the real-time impacts of the usage of cloud services.</td></tr><tr><td>Onsite Data Centres</td><td>Source, operate and dispose of equipment in own and co-located Data Centres in a way to reduce their negative impacts. Manage own Data Centre facilities (cooling, managing physical security, etc.) to reduce the negative impacts on the environment, collaborators, and local communities. Ensure the minimum and necessary requirements to ensure the resilience of Data Centres.</td></tr><tr><td>Networks</td><td>Ensure cybersecurity, manage network equipment, and operate all types of networks (LAN, WAN, cellular, etc.) between different sites and entities so that their negative impacts on the environment are minimized.</td></tr><tr><td rowspan="4">Digital Services</td><td>Project Initiation &amp; Management</td><td>Put mechanisms in place to ensure that CDR principles are considered during the business modeling and requirements gathering phase, as well as during the standardization of digital processes.</td><td rowspan="4">[22], [61]–[63]</td></tr><tr><td>Maintenance, Operations &amp; EOL</td><td>Adopt internal policies and actions to maintain, operate, and decommission digital solutions according to CDR principles. Continuously verify the need and utility of the proposed solutions and functionalities.</td></tr><tr><td>Design &amp; Build</td><td>Design and build digital solutions for internal and external clients using responsible design principles. Adopt international standards and guidelines when possible.</td></tr><tr><td>Data Management</td><td>Ensure that CDR principles are adopted in all stages of the data lifecycle - from its creation and operation to refinement and retention. Adopt international standards and guidelines to ensure that data is used, especially in emerging technologies, such as AI, according to a shared set of values of the society.</td></tr><tr><td rowspan="3">Ecosystems</td><td>Procurement</td><td>Define and adopt responsible purchasing policies for each type of product and digital service. Give preference to providers that have a proven CDR record and transparently share their progress. Have mechanisms in place that favor resiliency and flexibility to reduce dependency on a handful of providers. Work with suppliers to actively implement CDR principles across the entire value chain. Have mechanisms in place to continuously screen and monitor the CDR performance of the main vendors.</td><td rowspan="3">ISO 20400:2017</td></tr><tr><td>Market &amp; Customer</td><td>Communicate transparently and ethically with customers, ensure their fair treatment, aligned with CDR principles. Account for the impact of digital solutions on customers and generated by customers. Ensure the processes and governance mechanisms are in place to manage digital marketing practices, such as social media policies or new digital ways of targeting customers, aligned with CDR principles.</td></tr><tr><td>External Collaboration</td><td>Work together with peers, academic, governmental, and other actors to share, promote CDR practices and contribute to industry best practices.</td></tr></tbody></table>
<table><caption>TABLE III: Focus areas of CDR MM</caption><thead><tr><th>Dimension</th><th>Focus area</th><th>Description</th><th>Examples of area-specific guidelines</th></tr></thead><tbody><tr><td rowspan="3">CDR Governance</td><td>Strategy &amp; Commitment</td><td>Develop a shared CDR vision and strategy aligned with the organization's values and other internal strategies. Demonstrate the long-term commitment to CDR by dedicating enough financial and human resources to drive continuous improvement. Ensure that CDR objectives are communicated transparently with internal and external stakeholders. Identify new business opportunities that may result from CDR actions.</td><td rowspan="3">[57]</td></tr><tr><td>Interdepartmental Governance</td><td>Include governance mechanisms to ensure and monitor that CDR would be applied in day-to-day processes across different business lines. Set up appropriate KPIs to measure the progress and impact of digitalization within the whole company. Strive for "CDR by design" adoption across all teams. Require accountability for CDR decision-making across the organization.</td></tr><tr><td>Risk &amp; Compliance</td><td>Enable and demonstrate compliance with local and global legislation and regulation on CDR topics. Have mechanisms in place to evaluate and prevent digitalization risks from a double materiality perspective (for business, employees, clients, and society at large).</td></tr><tr><td rowspan="2">Workplace &amp; Culture</td><td>Office &amp; Collaborative Tools</td><td>Minimize the adverse effects on both the environment and the digital well-being of collaborators arising from the use of office and collaborative tools. Create provisions for digital solutions to enable positive CDR outcomes across the organization.</td><td rowspan="2">[58]</td></tr><tr><td>CDR culture</td><td>Implement CDR principles, defined in CDR Governance, across the organization through awareness and job-specific training, by putting in place participatory and collaborative mechanisms. Include collaborators in change management processes and encourage diversity and inclusion in digital service teams. Prioritize ongoing engagement, capacity building, and continuous improvement on CDR topics.</td></tr><tr><td rowspan="6">IT asset management</td><td>Industrial equipment</td><td>Adopt internal policies and actions to operate and decommission industrial equipment, such as IoT or industrial printers, according to CDR principles. Continuously verify the need and utility of the equipment.</td><td rowspan="6">[59], [60]</td></tr><tr><td>Employee equipment</td><td>Adopt internal policies and actions to maintain and decommission employee equipment, such as laptops or company-owned mobile phones, according to CDR principles.</td></tr><tr><td>Shared equipment</td><td>Adopt internal policies and actions to operate and decommission shared equipment, such as printers or audio-visual equipment in conference rooms, according to CDR principles. Continuously verify the need and utility of the equipment.</td></tr><tr><td>Cloud</td><td>Choose the IaaS or private Cloud providers adhering to CDR principles. Include mechanisms in place to monitor the real-time impacts of the usage of cloud services.</td></tr><tr><td>Onsite Data Centres</td><td>Source, operate and dispose of equipment in own and co-located Data Centres in a way to reduce their negative impacts. Manage own Data Centre facilities (cooling, managing physical security, etc.) to reduce the negative impacts on the environment, collaborators, and local communities. Ensure the minimum and necessary requirements to ensure the resilience of Data Centres.</td></tr><tr><td>Networks</td><td>Ensure cybersecurity, manage network equipment, and operate all types of networks (LAN, WAN, cellular, etc.) between different sites and entities so that their negative impacts on the environment are minimized.</td></tr><tr><td rowspan="4">Digital Services</td><td>Project Initiation &amp; Management</td><td>Put mechanisms in place to ensure that CDR principles are considered during the business modeling and requirements gathering phase, as well as during the standardization of digital processes.</td><td rowspan="4">[22], [61]–[63]</td></tr><tr><td>Maintenance, Operations &amp; EOL</td><td>Adopt internal policies and actions to maintain, operate, and decommission digital solutions according to CDR principles. Continuously verify the need and utility of the proposed solutions and functionalities.</td></tr><tr><td>Design &amp; Build</td><td>Design and build digital solutions for internal and external clients using responsible design principles. Adopt international standards and guidelines when possible.</td></tr><tr><td>Data Management</td><td>Ensure that CDR principles are adopted in all stages of the data lifecycle - from its creation and operation to refinement and retention. Adopt international standards and guidelines to ensure that data is used, especially in emerging technologies, such as AI, according to a shared set of values of the society.</td></tr><tr><td rowspan="3">Ecosystems</td><td>Procurement</td><td>Define and adopt responsible purchasing policies for each type of product and digital service. Give preference to providers that have a proven CDR record and transparently share their progress. Have mechanisms in place that favor resiliency and flexibility to reduce dependency on a handful of providers. Work with suppliers to actively implement CDR principles across the entire value chain. Have mechanisms in place to continuously screen and monitor the CDR performance of the main vendors.</td><td rowspan="3">ISO 20400:2017</td></tr><tr><td>Market &amp; Customer</td><td>Communicate transparently and ethically with customers, ensure their fair treatment, aligned with CDR principles. Account for the impact of digital solutions on customers and generated by customers. Ensure the processes and governance mechanisms are in place to manage digital marketing practices, such as social media policies or new digital ways of targeting customers, aligned with CDR principles.</td></tr><tr><td>External Collaboration</td><td>Work together with peers, academic, governmental, and other actors to share, promote CDR practices and contribute to industry best practices.</td></tr></tbody></table>
REFERENCES

[1] M. Ghobakhloo, "Industry 4.0, digitization, and opportunities for sustainability," *Journal of Cleaner Production*, vol. 252, p. 119869, Apr. 2020. DOI: 10.1016/j.jclepro.2019.119869.

[2] A. Miceli, B. Hagen, M. P. Riccardi, F. Sotti, and D. Settembre-Blundo, "Thriving, Not Just Surviving in Changing Times: How Sustainability, Agility and Digitalization Interwine with Organizational Resilience," *Sustainability*, vol. 13, no. 4, p. 2052, Feb. 2021. DOI: 10.3390/su13042052.

[3] J. D. Sachs, G. Schmidt-Traub, M. Mazzucato, D. Messner, N. Nakicenovic, and J. Rockström, "Six Transformations to achieve the Sustainable Development Goals," *Nature Sustainability*, vol. 2, no. 9, pp. 805-814, Aug. 2019. DOI: 10.1038/s41893-019-0352-9.

[4] V. C. Coroamă and F. Mattern, "Digital Rebound – Why Digitalization Will Not Redeem Us Our Environmental Sins," *Proceedings of the 6th International Conference on ICT for Sustainability (ICT4S 2019)*, CEUR Workshop Proceedings, vol. 2382, p. 31, 2019.

[5] D. F. S. (D4S), "Digital Reset. Redirecting Technologies for the Deep Sustainability Transformation," Technische Universität Berlin, Berlin, Tech. Rep., 2022.

[6] C. Herden, E. Alliu, A. Cakici, et al., ""Corporate Digital Responsibility": New corporate responsibilities in the digital age," *Sustainability Management Forum – Nachhaltigkeits-ManagementForum*, vol. 29, pp. 13–29, 2021. DOI: 10.1007/s00550-020-00509-x.

[7] C. Folke, "Resilience: The emergence of a perspective for social-ecological systems analyses," *Global Environmental Change*, vol. 16, no. 3, pp. 253–267, 2006. DOI: 10.1016/j.gloenvcha.2006.04.002.

[8] M. P. Zimmer, J. Järveläinen, B. C. Stahl, and B. Mueller, "Responsibility of/in digital transformation," *Journal of Responsible Technology*, p. 100068, Sep. 2023. DOI: 10.1016/j.jrt.2023.100068.

[9] M. Alojail and S. B. Khan, "Impact of Digital Transformation toward Sustainable Development," *Sustainability*, vol. 15, no. 20, p. 14697, Oct. 2023. DOI: 10.3390/su152014697.

[10] N. Ortiz-de-Mandojana and P. Bansal, "The long-term benefits of organizational resilience through sustainable business practices," *Strategic Management Journal*, vol. 37, no. 8, pp. 1615-1631, 2016. DOI: 10.1002/smj.2410.

[11] A. Rugeviciute, V. Courboulay, and L. M. Hilty, "The Research Landscape of ICT for Sustainability: Harnessing Digital Technology for Sustainable Development," in *2023 International Conference on ICT for Sustainability (ICT4S)*, 2023, pp. 97-107. DOI: 10.1109/ICT4S58814.2023.00019.

[12] K. Raworth, *Doughnut Economics: Seven Ways to Think Like a 21st-Century Economist*, Penguin Random House. London, 2017.

[13] S. Dörr, *Corporate Digital Responsibility. Managing Corporate Responsibility and Sustainability in the Digital Age* (CSR, Sustainability, Ethics & Governance), 1st ed. Germany: Springer Berlin, Heidelberg, 2021.

[14] C. A. Mihale-Wilson, D. J. Zibuschka, R. Bosch, J. Zibuschka, and K. V. Carl, "Corporate Digital Responsibility – extended conceptualization and empirical assessment," *ECIS 2021 Research Papers*, no. 80, p. 17, 2021.

[15] B. Mueller, "Corporate Digital Responsibility," *Business & Information Systems Engineering*, no. 64, pp. 689-700, 2022. DOI: 10.1007/s12599-022-00760-0.

[16] L. Lobschat, B. Mueller, F. Eggers, et al., "Corporate digital responsibility," *Journal of Business Research*, vol. 122, pp. 875-888, 2021. DOI: //doi.org/10.1016/j.jbusres.2019.10.006.

[17] T. Knopf and D. Pick, "Corporate Responsibility for Digital Innovation: A systematic Review of the Literature," *European Conference on Innovation and Entrepreneurship*, vol. 18, no. 1, pp. 469-477, 2023. DOI: 10.34190/ecie.18.1.1601.

[18] D. Lautenschutz, S. España, A. Hankel, S. Overbeek, and P. Lago, "A Comparative Analysis of Green ICT Maturity Models," in *ICT4S2018. 5th International Conference on Information and Communication Technology for Sustainability*, ser. EPiC Series in Computing, vol. 52, 2018, pp. 153-137. DOI: 10.29007/5hgz.

[19] F. Loeser, "Green IT and Green IS: Definition of Constructs and Overview of Current Practices," in *AMCIS 2013 Proceedings*, vol. 4, Chicago, Illinois, 2013, p. 13. DOI: 10.13140/2.1.3065.6962.

[20] A. Molla and V. Cooper, "Green IT Readiness: A Framework and Preliminary Proof of Concept," *Australasian Journal of Information Systems*, vol. 16, no. 2, Mar. 2010. DOI: 10.3127/ajis.v16i2.545.

[21] S. Murugesan, "Harnessing Green IT: Principles and Practices," *Green Computing*, p. 10, 2008.

[22] K. V. Carl, "Corporate Digital Responsibility: Evaluating Privacy and Data Security Activities on Company-level," in *INFORMATIK 2021*, Bonn: Gesellschaft für Informatik, 2021, pp. 757-771. DOI: 10.18420/informatik2021-065.

[23] B. Weber-Lewerenz, "Corporate digital responsibility (CDR) in construction engineering—ethical guidelines for the application of digital transformation and artificial intelligence (AI) in user practice," *SN Applied Sciences*, vol. 3, no. 10, p. 801, Oct. 2021. DOI: 10.1007/s42452-021-04776-1.

[24] S. Mann, O. Bates, and R. Maher, "Shifting the maturity needle of ICT for Sustainability," in *5th International Conference on Information and Communication Technology for Sustainability*, ser. EPiC Series in Computing, vol. 52, EasyChair, 2018, pp. 209-226. DOI: 10.29007/d6g3.

[25] G. Vial, "Understanding digital transformation: A review and a research agenda," *The Journal of Strategic Information Systems*, vol. 28, no. 2, pp. 118-144, Jun. 2019. DOI: 10.1016/j.jsis.2019.01.003.

[26] J. Becker, R. Knackstedt, and J. Pöppelbuß, "Developing Maturity Models for IT Management: A Procedure Model and its Application," *Business & Information Systems Engineering*, vol. 1, no. 3, pp. 213-222, 2009. DOI: 10.1007/s12599-009-0044-5.

[27] E. Gökalp, U. Şener, and P. E. Eren, "Development of an Assessment Model for Industry 4.0: Industry 4.0-MM," in *Software Process Improvement and Capability Determination*, A. Mas, A. Mesquida, R. V. O'Connor, T. Rout, and A. Dorling, Eds., ser. Communications in Computer and Information Science, Cham: Springer International Publishing, 2017, pp. 128-142. DOI: 10.1007/978-3-319-67383-7_10.

[28] M. Röglinger and J. Pöppelbuß, "What makes a useful maturity model? a framework of general design principles for maturity models and its demonstration in business process management," in *ECIS 2011 Proceedings*, vol. 28, 2011.

[29] C. Okoli and S. D. Pawlowski, "The Delphi method as a research tool: An example, design considerations and applications," *Information & Management*, vol. 42, no. 1, pp. 15-29, Dec. 2004. DOI: 10.1016/j.im.2003.11.002.

[30] *ISIT Europe – The european network of Institutes for Sustainable IT*, https://isit-europe.org/.

[31] Bundesministerium der Justiz, BMJ, CDR – Corporate Digital Responsibility Initiative, https://cdr-initiative.de/en/initiative.

[32] F. Stratégie, "Responsabilité numérique des entreprises : enjeux des données, environnementaux et sociaux," La Plate-forme RSE France Stratégie, Tech. Rep., 2021.
REFERENCES

[1] M. Ghobakhloo, "Industry 4.0, digitization, and opportunities for sustainability," *Journal of Cleaner Production*, vol. 252, p. 119869, Apr. 2020. DOI: 10.1016/j.jclepro.2019.119869.

[2] A. Miceli, B. Hagen, M. P. Riccardi, F. Sotti, and D. Settembre-Blundo, "Thriving, Not Just Surviving in Changing Times: How Sustainability, Agility and Digitalization Interwine with Organizational Resilience," *Sustainability*, vol. 13, no. 4, p. 2052, Feb. 2021. DOI: 10.3390/su13042052.

[3] J. D. Sachs, G. Schmidt-Traub, M. Mazzucato, D. Messner, N. Nakicenovic, and J. Rockström, "Six Transformations to achieve the Sustainable Development Goals," *Nature Sustainability*, vol. 2, no. 9, pp. 805-814, Aug. 2019. DOI: 10.1038/s41893-019-0352-9.

[4] V. C. Coroamă and F. Mattern, "Digital Rebound – Why Digitalization Will Not Redeem Us Our Environmental Sins," *Proceedings of the 6th International Conference on ICT for Sustainability (ICT4S 2019)*, CEUR Workshop Proceedings, vol. 2382, p. 31, 2019.

[5] D. F. S. (D4S), "Digital Reset. Redirecting Technologies for the Deep Sustainability Transformation," Technische Universität Berlin, Berlin, Tech. Rep., 2022.

[6] C. Herden, E. Alliu, A. Cakici, et al., ""Corporate Digital Responsibility": New corporate responsibilities in the digital age," *Sustainability Management Forum – Nachhaltigkeits-ManagementForum*, vol. 29, pp. 13–29, 2021. DOI: 10.1007/s00550-020-00509-x.

[7] C. Folke, "Resilience: The emergence of a perspective for social-ecological systems analyses," *Global Environmental Change*, vol. 16, no. 3, pp. 253–267, 2006. DOI: 10.1016/j.gloenvcha.2006.04.002.

[8] M. P. Zimmer, J. Järveläinen, B. C. Stahl, and B. Mueller, "Responsibility of/in digital transformation," *Journal of Responsible Technology*, p. 100068, Sep. 2023. DOI: 10.1016/j.jrt.2023.100068.

[9] M. Alojail and S. B. Khan, "Impact of Digital Transformation toward Sustainable Development," *Sustainability*, vol. 15, no. 20, p. 14697, Oct. 2023. DOI: 10.3390/su152014697.

[10] N. Ortiz-de-Mandojana and P. Bansal, "The long-term benefits of organizational resilience through sustainable business practices," *Strategic Management Journal*, vol. 37, no. 8, pp. 1615-1631, 2016. DOI: 10.1002/smj.2410.

[11] A. Rugeviciute, V. Courboulay, and L. M. Hilty, "The Research Landscape of ICT for Sustainability: Harnessing Digital Technology for Sustainable Development," in *2023 International Conference on ICT for Sustainability (ICT4S)*, 2023, pp. 97-107. DOI: 10.1109/ICT4S58814.2023.00019.

[12] K. Raworth, *Doughnut Economics: Seven Ways to Think Like a 21st-Century Economist*, Penguin Random House. London, 2017.

[13] S. Dörr, *Corporate Digital Responsibility. Managing Corporate Responsibility and Sustainability in the Digital Age* (CSR, Sustainability, Ethics & Governance), 1st ed. Germany: Springer Berlin, Heidelberg, 2021.

[14] C. A. Mihale-Wilson, D. J. Zibuschka, R. Bosch, J. Zibuschka, and K. V. Carl, "Corporate Digital Responsibility – extended conceptualization and empirical assessment," *ECIS 2021 Research Papers*, no. 80, p. 17, 2021.

[15] B. Mueller, "Corporate Digital Responsibility," *Business & Information Systems Engineering*, no. 64, pp. 689-700, 2022. DOI: 10.1007/s12599-022-00760-0.

[16] L. Lobschat, B. Mueller, F. Eggers, et al., "Corporate digital responsibility," *Journal of Business Research*, vol. 122, pp. 875-888, 2021. DOI: //doi.org/10.1016/j.jbusres.2019.10.006.

[17] T. Knopf and D. Pick, "Corporate Responsibility for Digital Innovation: A systematic Review of the Literature," *European Conference on Innovation and Entrepreneurship*, vol. 18, no. 1, pp. 469-477, 2023. DOI: 10.34190/ecie.18.1.1601.

[18] D. Lautenschutz, S. España, A. Hankel, S. Overbeek, and P. Lago, "A Comparative Analysis of Green ICT Maturity Models," in *ICT4S2018. 5th International Conference on Information and Communication Technology for Sustainability*, ser. EPiC Series in Computing, vol. 52, 2018, pp. 153-137. DOI: 10.29007/5hgz.

[19] F. Loeser, "Green IT and Green IS: Definition of Constructs and Overview of Current Practices," in *AMCIS 2013 Proceedings*, vol. 4, Chicago, Illinois, 2013, p. 13. DOI: 10.13140/2.1.3065.6962.

[20] A. Molla and V. Cooper, "Green IT Readiness: A Framework and Preliminary Proof of Concept," *Australasian Journal of Information Systems*, vol. 16, no. 2, Mar. 2010. DOI: 10.3127/ajis.v16i2.545.

[21] S. Murugesan, "Harnessing Green IT: Principles and Practices," *Green Computing*, p. 10, 2008.

[22] K. V. Carl, "Corporate Digital Responsibility: Evaluating Privacy and Data Security Activities on Company-level," in *INFORMATIK 2021*, Bonn: Gesellschaft für Informatik, 2021, pp. 757-771. DOI: 10.18420/informatik2021-065.

[23] B. Weber-Lewerenz, "Corporate digital responsibility (CDR) in construction engineering—ethical guidelines for the application of digital transformation and artificial intelligence (AI) in user practice," *SN Applied Sciences*, vol. 3, no. 10, p. 801, Oct. 2021. DOI: 10.1007/s42452-021-04776-1.

[24] S. Mann, O. Bates, and R. Maher, "Shifting the maturity needle of ICT for Sustainability," in *5th International Conference on Information and Communication Technology for Sustainability*, ser. EPiC Series in Computing, vol. 52, EasyChair, 2018, pp. 209-226. DOI: 10.29007/d6g3.

[25] G. Vial, "Understanding digital transformation: A review and a research agenda," *The Journal of Strategic Information Systems*, vol. 28, no. 2, pp. 118-144, Jun. 2019. DOI: 10.1016/j.jsis.2019.01.003.

[26] J. Becker, R. Knackstedt, and J. Pöppelbuß, "Developing Maturity Models for IT Management: A Procedure Model and its Application," *Business & Information Systems Engineering*, vol. 1, no. 3, pp. 213-222, 2009. DOI: 10.1007/s12599-009-0044-5.

[27] E. Gökalp, U. Şener, and P. E. Eren, "Development of an Assessment Model for Industry 4.0: Industry 4.0-MM," in *Software Process Improvement and Capability Determination*, A. Mas, A. Mesquida, R. V. O'Connor, T. Rout, and A. Dorling, Eds., ser. Communications in Computer and Information Science, Cham: Springer International Publishing, 2017, pp. 128-142. DOI: 10.1007/978-3-319-67383-7_10.

[28] M. Röglinger and J. Pöppelbuß, "What makes a useful maturity model? a framework of general design principles for maturity models and its demonstration in business process management," in *ECIS 2011 Proceedings*, vol. 28, 2011.

[29] C. Okoli and S. D. Pawlowski, "The Delphi method as a research tool: An example, design considerations and applications," *Information & Management*, vol. 42, no. 1, pp. 15-29, Dec. 2004. DOI: 10.1016/j.im.2003.11.002.

[30] *ISIT Europe — The european network of Institutes for Sustainable IT*, https://isit-europe.org/.

[31] Bundesministerium der Justiz, BMJ, CDR – Corporate Digital Responsibility Initiative, https://cdr-initiative.de/en/initiative.

[32] F. Stratégie, "Responsabilité numérique des entreprises : enjeux des données, environnementaux et sociaux," La Plate-forme RSE France Stratégie, Tech. Rep., 2021.
[33] J. J. Meier, *The Digital Responsibility Goals – It’s All About Trust*, https://www.dotmagazine.online/issues/the-heart-of-it/the-digital-responsibility-goals, Jan. 2022.

[34] J. Wirtz, W. H. Kunz, N. Hartley, and J. Tarbit, "Corporate Digital Responsibility in Service Firms and Their Ecosystems," *Journal of Service Research*, vol. 26, no. 2, 2022. DOI: 10.1177/10946705221130467.

[35] C. Thorun, M. Vetter, L. Reisch, and A. K. Zimmer, "Indicators of consumer protection and empowerment in the digital world," Institute for Consumer Policy, Berlin, Tech. Rep., 2017.

[36] M. Aitken, M. Ng, D. Horsfall, K. P. Coopamootoo, A. van Moorsel, and K. Elliott, "In pursuit of socially-minded data-intensive innovation in banking: A focus group study of public expectations of digital innovation in banking," *Technology in Society*, vol. 66, p. 101666, 2021. DOI: 10.1016/j.techsoc.2021.101666.

[37] K. Elliott, R. Price, P. Shaw, et al., "Towards an Equitable Digital Society: Artificial Intelligence (AI) and Corporate Digital Responsibility (CDR)," *Society*, vol. 58, no. 3, pp. 179–188, Jun. 2021. DOI: 10.1007/s12115-021-00594-8.

[38] H. Trittin-Ulbrich and A. Böckel, "Institutional entrepreneurship for responsible digital innovation: The case of corporate digital responsibility," *Creativity and Innovation Management*, vol. 31, no. 3, pp. 447–459, 2022. DOI: 10.1111/caim.12513.

[39] T. Mettler, P. Rohner, and R. Winter, "Towards a Classification of Maturity Models in Information Systems," in *Management of the Interconnected World*, A. D’Atri, M. De Marco, A. M. Braccini, and F. Cabiddu, Eds., Heidelberg: Physica-Verlag HD, 2010, pp. 333–340.

[40] T. de Bruin, R. Freeze, U. Kulkarni, and M. Rosemann, "Understanding the Main Phases of Developing a Maturity Assessment Model," *ACIS 2005 Proceedings*, vol. 109, 2005.

[41] D. Smits and J. Van Hillegersberg, "IT Governance Maturity: Developing a Maturity Model Using the Delphi Method," in *2015 48th Hawaii International Conference on System Sciences*, Kauai, HI: IEEE, Jan. 2015, pp. 4534–4543. DOI: 10.1109/HICSS.2015.541.

[42] J. B. S. D. Santos-Neto and A. P. C. S. Costa, "Enterprise maturity models: A systematic literature review," *Enterprise Information Systems*, vol. 13, no. 5, pp. 719–769, May 2019. DOI: 10.1080/17517575.2019.1575986.

[43] R. R. Harmon and N. Moolenkamp, "Sustainable IT services: Developing a strategy framework," *International Journal of Innovation and Technology Management*, vol. 09, no. 02, p. 1250014, 2012. DOI: 10.1142/S0219877012500149.

[44] K. V. Carl, T. M. C. Zilcher, and O. Hinz, "Corporate Digital Responsibility and the current Corporate Social Responsibility standard: An analysis of applicability," in *Open Identity Summit 2022*, H. Roßnagel, C. Schunck, and S. Mödersheim, Eds., Bonn: Gesellschaft für Informatik e.V., 2022, pp. 75–86.

[45] E. Curry and B. Donnellan, "Understanding the Maturity of Sustainable ICT," in *Green Business Process Management*, J. vom Brocke, S. Seidel, and J. Recker, Eds., Berlin, Heidelberg: Springer Berlin Heidelberg, 2012, pp. 203–216. DOI: 10.1007/978-3-642-27488-6_12.

[46] M. Helfert, B. Donnellan, and L. Ostrowski, "The case for design science utility and quality - Evaluation of design science artifact within the sustainable ICT capability maturity framework," *An International Journal on Information Technology, Action, Communication and Workpractices*, vol. 6, no. 1, 2012.

[47] A. Sambhanthan and V. Potdar, "Business sustainability frameworks a survey," in *2016 IEEE 14th International Conference on Software Engineering Research, Management and Applications (SERA)*, Towson, MD, USA: IEEE, Jun. 2016, pp. 171–177. DOI: 10.1109/SERA.2016.7516143.

[48] V. Vaishnavi and B. Kuechler, *Design Science Research in Information Systems*, http://www.desrist.org/design-research-in-information-systems/, 2004, (updated in 2017 and 2019 by Vaishnavi, V. and Stacey, P.); last updated November 24, 2021.

[49] R. Pereira and J. Serrano, "A review of methods used on IT maturity models development: A systematic literature review and a critical analysis," *Journal of Information Technology*, vol. 35, no. 2, pp. 161–178, Jun. 2020. DOI: 10.1177/0268396219886874.

[50] B. Kitchenham and S. M. Charters, "Guidelines for performing systematic literature reviews in software engineering version 2.3," *Engineering*, EBSE Technical Report, vol. 45, no. 4ve, p. 1051, 2007.

[51] S. Elo and H. Kyngäs, "The qualitative content analysis process," *Journal of Advanced Nursing*, vol. 62, no. 1, pp. 107–115, 2008. DOI: 10.1111/j.1365-2648.2007.04569.x.

[52] D. Beiderbeck, N. Frevel, H. A. von der Gracht, S. L. Schmidt, and V. M. Schweitzer, "Preparing, conducting, and analyzing Delphi surveys: Cross-disciplinary practices, new directions, and advancements," *MethodsX*, vol. 8, p. 101401, Jan. 2021. DOI: 10.1016/j.mex.2021.101401.

[53] H. Liang, J. Ren, S. Gao, L. Dong, and Z. Gao, "Comparison of Different Multicriteria Decision-Making Methodologies for Sustainability Decision Making," in *Hydrogen Economy*, Elsevier, 2017, pp. 189–224. DOI: 10.1016/B978-0-12-811132-1.00008-0.

[54] M. Hallowell and J. Gambatese, "Qualitative Research: Application of the Delphi Method to CEM Research," *Journal of Construction Engineering and Management-asce - J CONSTR ENG MANAGE-ASCE*, vol. 136, Jan. 2010. DOI: 10.1061/(ASCE)CO.1943-7862.0000137.

[55] H. A. von der Gracht, "Consensus measurement in Delphi studies: Review and implications for future quality assurance," *Technological Forecasting and Social Change*, vol. 79, no. 8, pp. 1525–1536, 2012. DOI: 10.1016/j.techfore.2012.04.013.

[56] V. Brand, M. Razavian, and B. Ozkan, "Development of a Capability Maturity Model for Organization-Wide Green IT Adoption," in *Business Modeling and Software Design*, B. Shishkov, Ed., vol. 483, Cham: Springer Nature Switzerland, 2023, pp. 163–179. DOI: 10.1007/978-3-031-36757-1_10.

[57] J. Price and N. Lankton, "A Framework and Guidelines for Assessing and Developing Board-Level Information Technology Committee Charters," *Journal of Information Systems*, vol. 32, no. 1, pp. 109–129, 2018. DOI: 10.2308/isys-51674.

[58] M. Madon and P. Lago, ""We are Always on, is That Really Necessary?" Exploring the Path to Digital Sufficiency in Flexible Work," in *2023 International Conference on ICT for Sustainability (ICT4S)*, 2023, pp. 24–34. DOI: 10.1109/ICT4S58814.2023.00012.

[59] M. Acton, P. Bertoldi, and J. Booth, "2024 Best Practice Guidelines for the EU Code of Conduct on Data Centre Energy Efficiency," European Commission, Ispra, JRC Technical Report JRC136986, 2024.

[60] "Green data centers: Towards a sustainable digital transformation. A practitioner's guide," ITU and The World Bank, Geneva and Washington, D.C, Tech. Rep., 2023.

[61] S. Naumann, M. Dick, E. Kern, and T. Johann, "The GREEN-SOFT Model: A reference model for green and sustainable software and its engineering," *Sustainable Computing: Informatics and Systems*, vol. 1, no. 4, pp. 294–304, 2011. DOI: 10.1016/j.suscom.2011.06.004.

[62] Sustainable Web Design Community Group, *Web Sustainability Guidelines (WSG)*, https://w3c.github.io/sustyweb/, 2023.

[63] N. Condori-Fernandez and P. Lago, "Characterizing the contribution of quality requirements to software sustainability," *Journal of Systems and Software*, vol. 137, pp. 289–305, 2018. DOI: 10.1016/j.jss.2017.12.005.
[33] J. J. Meier, *The Digital Responsibility Goals – It’s All About Trust*, https://www.dotmagazine.online/issues/the-heart-of-it/the-digital-responsibility-goals, Jan. 2022.

[34] J. Wirtz, W. H. Kunz, N. Hartley, and J. Tarbit, “Corporate Digital Responsibility in Service Firms and Their Ecosystems,” *Journal of Service Research*, vol. 26, no. 2, 2022. DOI: 10.1177/10946705221130467.

[35] C. Thorun, M. Vetter, L. Reisch, and A. K. Zimmer, “Indicators of consumer protection and empowerment in the digital world,” Institute for Consumer Policy, Berlin, Tech. Rep., 2017.

[36] M. Aitken, M. Ng, D. Horsfall, K. P. Coopamootoo, A. van Moorsel, and K. Elliott, “In pursuit of socially-minded data-intensive innovation in banking: A focus group study of public expectations of digital innovation in banking,” *Technology in Society*, vol. 66, p. 101666, 2021. DOI: 10.1016/j.techsoc.2021.101666.

[37] K. Elliott, R. Price, P. Shaw, et al., “Towards an Equitable Digital Society: Artificial Intelligence (AI) and Corporate Digital Responsibility (CDR),” *Society*, vol. 58, no. 3, pp. 179–188, Jun. 2021. DOI: 10.1007/s12115-021-00594-8.

[38] H. Trittin-Ulbrich and A. Böckel, “Institutional entrepreneurship for responsible digital innovation: The case of corporate digital responsibility,” *Creativity and Innovation Management*, vol. 31, no. 3, pp. 447–459, 2022. DOI: 10.1111/caim.12513.

[39] T. Mettler, P. Rohner, and R. Winter, “Towards a Classification of Maturity Models in Information Systems,” in *Management of the Interconnected World*, A. D’Atri, M. De Marco, A. M. Braccini, and F. Cabiddu, Eds., Heidelberg: Physica-Verlag HD, 2010, pp. 333–340.

[40] T. de Bruin, R. Freeze, U. Kulkarni, and M. Rosemann, “Understanding the Main Phases of Developing a Maturity Assessment Model,” *ACIS 2005 Proceedings*, vol. 109, 2005.

[41] D. Smits and J. Van Hillegersberg, “IT Governance Maturity: Developing a Maturity Model Using the Delphi Method,” in *2015 48th Hawaii International Conference on System Sciences*, Kauai, HI: IEEE, Jan. 2015, pp. 4534–4543. DOI: 10.1109/HICSS.2015.541.

[42] J. B. S. D. Santos-Neto and A. P. C. S. Costa, “Enterprise maturity models: A systematic literature review,” *Enterprise Information Systems*, vol. 13, no. 5, pp. 719–769, May 2019. DOI: 10.1080/17517575.2019.1575986.

[43] R. R. Harmon and N. Moolenkamp, “Sustainable IT services: Developing a strategy framework,” *International Journal of Innovation and Technology Management*, vol. 09, no. 02, p. 1250014, 2012. DOI: 10.1142/S0219877012500149.

[44] K. V. Carl, T. M. C. Zilcher, and O. Hinz, “Corporate Digital Responsibility and the current Corporate Social Responsibility standard: An analysis of applicability,” in *Open Identity Summit 2022*, H. Roßnagel, C. Schunck, and S. Mödersheim, Eds., Bonn: Gesellschaft für Informatik e.V., 2022, pp. 75–86.

[45] E. Curry and B. Donnellan, “Understanding the Maturity of Sustainable ICT,” in *Green Business Process Management*, J. vom Brocke, S. Seidel, and J. Recker, Eds., Berlin, Heidelberg: Springer Berlin Heidelberg, 2012, pp. 203–216. DOI: 10.1007/978-3-642-27488-6_12.

[46] M. Helfert, B. Donnellan, and L. Ostrowski, “The case for design science utility and quality - Evaluation of design science artifact within the sustainable ICT capability maturity framework,” *An International Journal on Information Technology, Action, Communication and Workpractices*, vol. 6, no. 1, 2012.

[47] A. Sambhanthan and V. Potdar, “Business sustainability frameworks a survey,” in *2016 IEEE 14th International Conference on Software Engineering Research, Management and Applications (SERA)*, Towson, MD, USA: IEEE, Jun. 2016, pp. 171–177. DOI: 10.1109/SERA.2016.7516143.

[48] V. Vaishnavi and B. Kuechler, *Design Science Research in Information Systems*, http://www.desrist.org/design-research-in-information-systems/, 2004, (updated in 2017 and 2019 by Vaishnavi, V. and Stacey, P.); last updated November 24, 2021.

[49] R. Pereira and J. Serrano, “A review of methods used on IT maturity models development: A systematic literature review and a critical analysis,” *Journal of Information Technology*, vol. 35, no. 2, pp. 161–178, Jun. 2020. DOI: 10.1177/0268396219886874.

[50] B. Kitchenham and S. M. Charters, “Guidelines for performing systematic literature reviews in software engineering version 2.3,” *Engineering*, EBSE Technical Report, vol. 45, no. 4ve, p. 1051, 2007.

[51] S. Elo and H. Kyngäs, “The qualitative content analysis process,” *Journal of Advanced Nursing*, vol. 62, no. 1, pp. 107–115, 2008. DOI: 10.1111/j.1365-2648.2007.04569.x.

[52] D. Beiderbeck, N. Frevel, H. A. von der Gracht, S. L. Schmidt, and V. M. Schweitzer, “Preparing, conducting, and analyzing Delphi surveys: Cross-disciplinary practices, new directions, and advancements,” *MethodsX*, vol. 8, p. 101401, Jan. 2021. DOI: 10.1016/j.mex.2021.101401.

[53] H. Liang, J. Ren, S. Gao, L. Dong, and Z. Gao, “Comparison of Different Multicriteria Decision-Making Methodologies for Sustainability Decision Making,” in *Hydrogen Economy*, Elsevier, 2017, pp. 189–224. DOI: 10.1016/B978-0-12-811132-1.00008-0.

[54] M. Hallowell and J. Gambatese, “Qualitative Research: Application of the Delphi Method to CEM Research,” *Journal of Construction Engineering and Management-asce - J CONSTR ENG MANAGE-ASCE*, vol. 136, Jan. 2010. DOI: 10.1061/(ASCE)CO.1943-7862.0000137.

[55] H. A. von der Gracht, “Consensus measurement in Delphi studies: Review and implications for future quality assurance,” *Technological Forecasting and Social Change*, vol. 79, no. 8, pp. 1525–1536, 2012. DOI: 10.1016/j.techfore.2012.04.013.

[56] V. Brand, M. Razavian, and B. Ozkan, “Development of a Capability Maturity Model for Organization-Wide Green IT Adoption,” in *Business Modeling and Software Design*, B. Shishkov, Ed., vol. 483, Cham: Springer Nature Switzerland, 2023, pp. 163–179. DOI: 10.1007/978-3-031-36757-1_10.

[57] J. Price and N. Lankton, “A Framework and Guidelines for Assessing and Developing Board-Level Information Technology Committee Charters,” *Journal of Information Systems*, vol. 32, no. 1, pp. 109–129, 2018. DOI: 10.2308/isys-51674.

[58] M. Madon and P. Lago, ““We are Always on, is That Really Necessary?” Exploring the Path to Digital Sufficiency in Flexible Work,” in *2023 International Conference on ICT for Sustainability (ICT4S)*, 2023, pp. 24–34. DOI: 10.1109/ICT4S58814.2023.00012.

[59] M. Acton, P. Bertoldi, and J. Booth, “2024 Best Practice Guidelines for the EU Code of Conduct on Data Centre Energy Efficiency,” European Commission, Ispra, JRC Technical Report JRC136986, 2024.

[60] “Green data centers: Towards a sustainable digital transformation. A practitioner’s guide,” ITU and The World Bank, Geneva and Washington, D.C, Tech. Rep., 2023.

[61] S. Naumann, M. Dick, E. Kern, and T. Johann, “The GREEN-SOFT Model: A reference model for green and sustainable software and its engineering,” *Sustainable Computing: Informatics and Systems*, vol. 1, no. 4, pp. 294–304, 2011. DOI: 10.1016/j.suscom.2011.06.004.

[62] Sustainable Web Design Community Group, *Web Sustainability Guidelines (WSG)*, https://w3c.github.io/sustyweb/, 2023.

[63] N. Condori-Fernandez and P. Lago, “Characterizing the contribution of quality requirements to software sustainability,” *Journal of Systems and Software*, vol. 137, pp. 289–305, 2018. DOI: 10.1016/j.jss.2017.12.005.