Galp has implemented a third-party cyber-risk management process based on questionnaires aligned with the National Institute of Standards and Technology (NIST) Cybersecurity Framework and using a risk-based approach through three service tiers based on the potential cyber risks. These questionnaires are evaluated in parallel with a technical assessment of the proposals, considering both the answers given and the risk vectors observed using a cybersecurity-rating tool. In addition, awareness sessions are conducted regularly to ensure that internal stakeholders have a clear understanding of the process and of service-level agreements (SLAs), by providing access to a dashboard that presents the cyber-risk evaluation stage in near real time. Awareness materials are also developed and distributed to the suppliers. As a result of the evaluation, when relevant risks are identified following the standard enterprise risk management process, the business unit can accept the risks and endorse the service if its benefits outweigh the potential impacts. However, it is also possible to reduce the identified risks through the mitigation and remediation plans developed between Galp’s cyber-risk team and suppliers. Despite some expected initial internal resistance, Galp’s business units have quickly understood the value of this approach. The key to this success has been to follow a risk-based approach and not be compliance-driven – working side-by-side with businesses both to give them visibility on supplier risks and to help them work with the supplier they want. The real surprise of this programme has been the buy-in from suppliers, which perceived the process as a means of improvement and provided little resistance to implementing the agreed mitigation measures. This has also led to an improvement in Galp’s overall portfolio cybersecurity rating."