Before 2020, isolated initiatives alone addressed third-party cybersecurity risks stemming from suppliers at Schneider Electric. To manage cybersecurity risks from third parties consistently and efficiently, the company set up a crossfunctional programme and enforced a new policy, targeting a large range of suppliers, from product component producers such as original equipment manufacturers (OEMs) to technology providers such as cloud and infrastructure hosting services. A risk-based approach classifies suppliers into four categories (critical, high, moderate and low) and introduces security requirements and consequence management for noncompliance. The policy tailors the requirements and mitigation measures based on supplier risk profile. The benefits include: Making cybersecurity “top-of-mind” in supplier interactions and for high-ranking executives up to C level; systematically embedding cybersecurity provisions in supplier agreements. Enforcing collaborative and continuous monitoring, threat and risk vectors identification with critical suppliers (using cyber-scoring platforms, cyberthreat intelligence platforms). Performing security and privacy checks on delivered platforms within the frame of an internal security certification process; systematically enforcing internal and external cyber assessments (e.g. shared assessments platforms) using a riskbased approach. Enabling a transparency mindset to ensure supplier vulnerabilities and incidents are known by the company before they are publicly known; documenting supplier incidents to capture and respond to any other incidents in a structured and collaborative way across the company."