Iberdrola Group’s cybersecurity transformation started in 2015 when the board of directors approved a cybersecurity risk policy recognizing the significance of cyber risk for the group. This policy expressed the company’s commitment to promoting adequate cybersecurity and resilience mechanisms across the IT and OT environments and to strengthening capabilities to detect, prevent, defend and respond to cyberattacks and incidents. The approach established by Iberdrola focuses on embedding cyber resilience into business strategies, operational decisions, and daily activities and improving implementation of the World Economic Forum’s 2017 and 2019 board principles to improve governance and oversight of cyber risk at a global level and promote collaboration across the group (IT, OT, physical and digital) and with the relevant ecosystem agents. To set the baseline for a culture change and ensure cyber-risk awareness in risk owners, the board defined an organizational strategy that would ensure strong leadership and oversight plus the effective integration of cybersecurity and resilience into all businesses and corporate areas. The group board’s Audit and Risk Supervision Committee was designated responsible for overseeing the group’s cyber-risk and resilience capabilities and a global chief information security officer was appointed to lead its cyber-resilience strategy, governance, and oversight across the group’s IT and OT environments. The global chief information security officer provides the board with specific cyber training, including best practices and an introduction to board principles, with quarterly updates about the cybersecurity risks specific to the company and the evolution and effectiveness of the programmes defined to address them. Local chief information security officers were appointed in all countries and cybersecurity experts were assigned by all businesses and corporate areas (including but not limited to IT) responsible for ensuring implementation of cybersecurity programmes and operations in alignment with the global cybersecurity strategy. A Global Cybersecurity Committee was constituted to ensure proper coordination across the group, encourage collaboration and information exchanges and ensure a coordinated incident response. The cybersecurity committee defined a global cybersecurity strategy and framework, including roles and responsibilities and global rules and procedures, to ensure a common language and a coordinated approach to cyber resilience across the group. Additional key metrics and dashboards have been established to facilitate risk-management decision-making and communication of cyber risk between business leadership, chief information security officer, and board members and to prioritize resource allocation by focusing on protecting critical business processes and infrastructures beyond the ones designated by existing regulations. With the increasing maturity of the implementation categories, Iberdrola aims to improve not only its own cyber-resilience posture and cyber-risk oversight capabilities, but also to enhance ecosystem-wide resilience through active collaboration with important public and private stakeholders.