Supply-chain cyberattacks have become more prevalent in 2021. With the ever-growing sophistication of attacks combined with the wide variety of new techniques in use, third-party risk management needs to be addressed as a top priority, at the same level as other enterprise strategic risks. The conventional third-party risk management approach is no longer effective in enabling a proactive response to emerging supplychain risks. Supply-chain risk requires a new, multifaceted approach. Third-party risk management at Shell is fully integrated across sourcing, assurance and IT. Sourcing plays a pivotal role in robust supplychain management. The initial screening of third parties is considered equally as important as imposing strong contractual obligations and managing a contract after it has been awarded. Shell’s assurance process aims to validate the ability of third parties to adhere to contractually agreed terms in ensuring security across the business environment. Shell uses data analytics across its vendor risk-management platform, security ratings and sourcing engine. This integrated approach to supply-chain risk management helps Shell to ensure a robust and comprehensive view of constantly changing supply-chain risk vectors. In case these evolving risks are not within Shell’s risk appetite, preventive measures can be implemented to safeguard information assets. When coordinated action is required across the business environment, an established communication protocol enables timely cooperation with individual service organizations. Only when acting in a fully aligned manner with suppliers can Shell successfully tackle the ever-growing challenge of keeping its business systems healthy and resilient against emerging supply-chain attacks