Repsol has followed a flexible yet robust third-party cybersecurity management approach. Different supply-chain cybersecurity risk scenarios are treated according to their third-party type, including: – IT and digital providers – OT providers with remote or physical access to ICS – Business providers receiving and keeping sensitive information from Repsol – Business providers that are critical for maintaining normal business operations In the search for security and agility, Repsol has also defined clear processes for each scenario. These include: – A specific internal triage questionnaire, which helps qualify the risk potential of the contract (independent of provider), assigning a risk tier level – If the tier is medium or high, providers are assessed through security rating tools and questionnaires, according to the type of service – If the tier is high, certifications are required, additional evidence may be requested, and penetration testing could be undertaken – Depending on the tier level and type of contract, specific clauses are included by default into the final contract with security requirements – Ensuring that different cases are treated differently is vital to making the process scalable and helps contract holders accept an additional step in the procurement process.