Scenario: Halliburton documents cyber-risk management and treats cyberthreats as a hazard to business operations. To ensure cybersecurity is a top priority, Halliburton performs security reviews as part of its procurement and building process with four distinct steps: request, assess, approve and track. When a request is made, Halliburton teams conduct a risk-based assessment grounded in a stable, reliable, repeatable and scalable controls library, taking into account factors like data classification and business process criticality. The process then requires formal approval from the business, legal and IT departments, with defined levels depending on the degree of risk. Finally, Halliburton uses monthly and quarterly executive reporting to track cyberthreats, including remediation and expiration. Key takeaways: This repeatable and scalable process ensures the consistent application of risk-based controls with clearly designated responsibilities for risk assessment and crossfunctional risk ownership.