Cyber Resilience Initiative

Case Studies

Explore case studies of how our partners apply our insights to improve their processes, and get inspired by success stories of cybersecurity leaders dedicated to strengthening their resilience.

A finger pointing at a glowing node in a network of connected human figures, representing collaborative cybersecurity partnerships.
Saudi Aramco initiated its supply-chain cybersecurity programme in 2016 to combat third-party risk by embedding cybersecurity into its third-party engagement life cycle. The programme aimed to identify the necessary elements to ensure the security of Saudi Aramco data and assets entrusted to third parties by improving critical third parties’ cybersecurity readiness as well as minimizing potential disruption in the event of a cyberattack. The programme made sure cybersecurity would no longer be an afterthought when engaging with third parties by embedding cybersecurity requirements in the third-party engagement process. Nonetheless, continuous collaboration among cybersecurity, legal, procurement and business is important to ensure success in implementing such a programme. Through this effort, the company established crucial cybersecurity elements, including cybersecurity contractual terms, third-party cybersecurity policy and standards, cyber incident reporting and third-party risk-based classification. To sustain the programme efforts, third-party cybersecurity functions and processes were formalized. This included formalization of the Saudi Aramco Cybersecurity Compliance Certificate (CCC) with nine audit firms as authorized entities to assess and issue the CCC independently, based on the organization’s compliance with Saudi Aramco’s third-party cybersecurity standard.
Saudi Aramco: Instituting a holistic third-party cybersecurity framework and certification model – Saudi Aramco
Aramco
With the increased connectivity of supply chains, a modern and efficient third-party risk management programme is necessary to identify and remediate issues before they become an incident or breach. Proactive tools such as security ratings cannot mitigate this risk alone, but they are a necessary component of good cybersecurity programmes and governance. Creating an automated security incident workflow is common via a security, orchestration, automation and response (SOAR) solution. However, the cost of integrating and implementing this with traditional solutions for managing vulnerability to cyberattack is prohibitive because licence costs increase with the number of suppliers. Security assessments are combined with continuous monitoring of the internet to deliver automated “event-based” evaluations. Vulnerabilities discovered by scanning then link with third-party threat feeds to enable automated rules that trigger the sending of an assessment questionnaire immediately after a potential threat is detected. This event-based approach improves on the usual method of periodically sending questionnaires by: – Enabling immediate reassessment of a vendor with no input required by the cybersecurity team – Scaling to thousands of continuously monitored companies instead of choosing only a select few – Providing score-drop events, breach events and individual security vulnerabilities and exposures to trigger an assessment – Tailoring the assessment sent based on the vendor portfolio to specific standards and frameworks – Maintaining a small vendor risk management team while providing expanded coverage Learning that a vendor experienced a data breach 11 months ago when reading its annual response to your questionnaire is definitely not adequate. Cybersecurity monitoring needs to follow the continuous evolution of cyber threats with the addition of automation at scale.
SecurityScorecard: Scaling the automated security incident workflow – SecurityScorecard
SecurityScorecard
With a growing volume of business, acquisitions and new routes to market, businesses are constantly under threat from breaches that occur within their supply chains. It is vital to review not only the company’s own internal infrastructure but also that of vendors and partners. Palo Alto Networks follows this guideline by using three practices: 1. Review internal and external security procedures: At Palo Alto Networks, any new vendors or partners undergo a thorough vetting process to gain network access based on the connectivity standard, which includes: – A privacy review – An information security review (including a questionnaire, review of certifications, attestations, external views through tools such as Xpander, Bitsight and SecurityScorecard) – A capability rationalization review – A full integration/implementation review based on Palo Alto’s supply-chain management policy 2. Establish written security guidelines and controls: Palo Alto also has a Supplier Information Security Terms written agreement requiring suppliers to adhere to processes and protocols that minimize the likelihood of attacks – for example, cybercriminals using a supplier’s website to host malware. 3. Training/sharing security best practices with staff and vendors: Human error is still by far the most significant source of data breaches, which means it is crucial for organizations to train all staff in the best security methods. Palo Alto vets vendors and also incorporates it into the Supplier Information Security Terms. The above focuses more on the prevention side (i.e. vetting, reviewing, monitoring). On the monitoring side, Palo Alto Networks uses different tools (including third-party tools such as Xpander) that help monitor suppliers and detect supply-chain effects. Outside of technology, Zero Trust strategy is deployed across the environment to compartmentalize any potential supply-chain threat."
Palo Alto Networks: Setting three practices for third parties’ infrastructure review – Palo Alto Networks
Palo Alto Networks
The expansion of remote working due to COVID-19 has triggered unintended consequences for organizations worldwide. The pandemic led to an increase in the number of connected devices and democratized remote access across supply chains and operations, including critical infrastructure. Organizations became increasingly dependent on third parties to maintain business continuity, with remote access posing risks to oil and gas pipeline operations. These risks were particularly concerning for one pipeline operator that relies heavily on third parties to support the full spectrum of its oil and gas operations via remote access. Its operational technology personnel, including third-party service providers, must be able to command operations remotely while allowing security teams to maintain the same level of visibility, control and response within a maximum of six hours as required for onsite personnel. To safeguard operational networks from threats introduced via third-party remote users, Claroty and Schneider Electric partnered with the pipeline operator to equip its personnel and third parties with a highly secure and unified capability for remote maintenance. Any of the operator’s third-party service providers can now use this capability to access its operational network remotely – all the while upholding adequate security requirements and without posing any additional risks to pipeline operations. With such unified remote access requirements, the operator minimized risk exposure and improved the visibility and control of the large footprint of third parties remotely accessing pipeline operations
Schneider electric and Claroty: Securing remote connectivity across operational technology supply chains
Schneider Electric, Claroty
Scenario: Saudi Aramco’s board of directors views cyber risks as a business risk of paramount priority. To ensure it is prioritized throughout the organization, cybersecurity must be reported upon and overseen by the board of directors and executive management, to drive cultural resilience and accelerate risk-mitigation efforts. To enable these changes, the board established a corporate cyber-risk management function to identify, assess, manage and report on cyber risks, and integrated this function in the enterprise risk-management organization. To build a resilient culture, Saudi Aramco then established the Awareness and Behaviour Management function to create a cyber-aware culture, and implemented cyberattack simulation programmes tailored to various stakeholder segments, including executive management, to train them on how to respond and withstand social engineering and attack attempts. Key takeaway: This approach has resulted in a notable increase in corporate awareness of cybersecurity and resilience against social engineering tactics.
Saudi Aramco’s integrated approach drives home cyber-risk management
Aramco
Scenario: Halliburton documents cyber-risk management and treats cyberthreats as a hazard to business operations. To ensure cybersecurity is a top priority, Halliburton performs security reviews as part of its procurement and building process with four distinct steps: request, assess, approve and track. When a request is made, Halliburton teams conduct a risk-based assessment grounded in a stable, reliable, repeatable and scalable controls library, taking into account factors like data classification and business process criticality. The process then requires formal approval from the business, legal and IT departments, with defined levels depending on the degree of risk. Finally, Halliburton uses monthly and quarterly executive reporting to track cyberthreats, including remediation and expiration. Key takeaways: This repeatable and scalable process ensures the consistent application of risk-based controls with clearly designated responsibilities for risk assessment and crossfunctional risk ownership.
Halliburton’s scalable process on cyber-risk acceptance
Halliburton
Saudi Aramco encourages a culture of collaboration and information sharing at the highest levels of its leadership. Both within Saudi Aramco and with external partners, the company promotes the exchange of lessons learned from challenging cyber-resilience situations and success stories, to better foster collaboration, improvement, and knowledge sharing. For example, Saudi Aramco formed a consortium for information sharing with some of its regional partners to accelerate readiness against cyberattacks, and founded benchmarking groups in the industry to periodically exchange knowledge and best practices. Externally, Saudi Aramco has established or participated in multiple cybersecurity-focused partnerships to unlock new opportunities that will elevate the cyber maturity and posture of its organization. Saudi Aramco believes that these exchanges are necessary to accelerate solutions to the industry’s pressing challenges and risks. In addition, Saudi Aramco launched an annual seminar for its third parties to share cybersecurity best practices as part of its ecosystem collaboration to strengthen its supply chain’s cybersecurity posture. Key takeaway: By founding regional cybersecurity information-sharing consortiums and collaborating with various groups in the industry and the World Economic Forum, Saudi Aramco is able to continuously improve its cybersecurity programme, increase cyber hygiene across its supply chain, and shape the future of cybersecurity in the industry
Saudi Aramco promotes cybersecurity information sharing
Aramco
Scenario: Saudi Aramco took proactive measures to establish a new organizational structure and engage personnel to address cybersecurity oversight and implementation for IT and OT. Saudi Aramco decided that the best way to defend the organization was with a proactive and risk-based strategy and a dedicated structure to improve cyber hygiene and governance. As a crucial early step, the company appointed a CISO to institute cybersecurity governance and oversee the enterprise’s cybersecurity posture, including IT and OT. The CISO helped ensure security and the resilience of connected physical assets and technology devices that could be vulnerable to attack. The company established a risk-based cybersecurity programme and strategy to cover cyber resilience and aligned its structure to meet industry frameworks and standards, like the US National Institute of Standards and Technology’s Cybersecurity Framework (NIST CSF) and the Cybersecurity Capability Maturity Model (C2M2). A new oversight mechanism was put in place with the board of directors overseeing top corporate cyber risks and executive management overseeing cybersecurity performance through designated key performance indicators. This approach was designed to support managers and executives in making informed decisions in alignment with preset risk tolerance and appetite. Key takeaway: New personnel, protocols, oversight structures, and periodic reporting to the board and executive leadership helped to gain stakeholder buy-in as well as increase cybersecurity awareness and the overall level of cybersecurity at the company.
Saudi Aramco sets oversight
Aramco
Scenario: At petroleum company Ecopetrol, taking cybersecurity seriously means that it should be integrated throughout all aspects of the value chain, from IT devices to energy assets connected by OT control systems. This overarching principle has been cascaded throughout the company’s approach to integrate cyber-risk management at all points in its operations. To enforce the importance of cyber risk, board members and the CEO developed and endorsed key cyber principles in a memorandum that was communicated to the company by the chief operating officer and chief information officer. The memo’s central goal was to integrate cyber into all the enterprise’s operational tasks, beginning with IT and OT environments, as well as in all the processes in business units and holding companies. With the board leading oversight and the implementation of key guidelines, Ecopetrol prioritized cyber risks linked to the strategic risks. Key takeaway: With board support, the team was able to strengthen its cybersecurity programme by adding personnel and funding and establishing a “Cybersecurity Governance System” to better manage these risks.
Ecopetrol integrates cybersecurity risk
Ecopetrol
In recent years, Ecopetrol has developed a comprehensive cybersecurity strategy to improve its digital security posture. As part of this strategy, culture has been established as a priority to improve the general awareness of employees and the corporate mentality towards cybersecurity risks at the company. Transforming and strengthening cybersecurity culture and behaviors establish three pillars: Training (the development of new skills) Mobilization (driving and appropriating change) Communication (encouraging understanding and cyber-savvy behaviors) As part of the strategy of transformation and reduction of cyber risk, during the past year Ecopetrol has carried out some relevant actions: Established a Science, Technology, and Innovation month, where cybersecurity played a vital role in raising awareness about cyber risks. Various pieces of content were designed and distributed to more than 9,000 collaborators, 25,000 contractors, and officials of the subsidiaries of the Ecopetrol group on important topics such as phishing, secure passwords, good practice in corporate emails, and the use of information repositories. The company also created and strengthened a network of 300-plus champions or cyber guardians around the Ecopetrol group, with cybersecurity campaigns aimed at key processes in regard to, for example, exploration, projects, health, safety, and the environment. Generated innovative cybersecurity-related themes such as “the magic or thinking of Disney villains”, “in the minds of hackers” and “social engineering”. Held face-to-face conversations in different locations with more than 1,600 employees to promote the prevention of digital risks and the impact of cybersecurity in OT environments, using clear and simple language to explain the relevance of digital security in the day-to-day operations of the company. Ecopetrol is transforming the perception and culture of cybersecurity, making it innovative, close, and essential in the work and home environments. For this, the processes, resources, and support of senior management have been consolidated to implement short- and medium-term actions that make people the “human firewall” – the first and most relevant protection against digital threats.
Ecopetrol: People as a key element in the transformation of cybersecurity at Ecopetrol
Ecopetrol
Scenario: Many organizations harbor different cultures with various risk appetite levels, which can be detrimental to implementing company-wide cybersecurity policies and best practices. With the goal of reducing the potential impact of cyberattacks at Repsol, the CISO recognized the need to balance risk appetite levels within business units with stakeholder expectations in order to implement cyber resilience holistically throughout the company. Using the World Economic Forum’s principles for boards while building a trusted relationship with board members, the CISO shifted the company’s cybersecurity strategic plan from a technical-solutions approach to a business-resilience and risk-management approach. The board provided support for training and awareness as well as resources dedicated to developing Repsol’s cyber resilience further. The CISO was able to provide budget support to other departments for lighthouse projects on cyber resilience. Key takeaway: By ensuring the CISO had the appropriate resources, the board provided the means to build allies in implementing new cyber policies and practices.
Repsol shifts from cybersecurity to cyber resilience
Repsol
Scenario: Energy company Suncor’s dispersed ecosystem relies on different organizations, partnerships, and joint ventures throughout its upstream to downstream business. Each brings its own operating environmental norms and diverse approaches to cybersecurity, which can prove challenging when cyber-related incidents occur. To reduce cyber risk, Suncor launched a pilot initiative aimed at bridging the gap between these different operating environments and connecting the OT upstream and downstream teams together. During the pilot phase, the centralized team is being financed by the IT group to ensure common practices and approaches to cyber risk, a standard infrastructure, and consistent asset inventory tools, and aligned processes to continuously monitor the OT environment. Through this centralized team, Suncor can continuously improve the collective cyber-resilience controls and plans between upstream and downstream partner organizations. This methodology balances preparedness and protection while improving monitoring and response capabilities. Key takeaway: Collaborating and aligning on the adoption of unified approaches and controls improved the monitoring and visibility of the OT environment, reducing the detection and response time of IT/OT software versioning and patching from a few days to minutes.
Suncor: Establishing an ecosystem-wide approach at Suncor
Suncor Energy
Scenario: Under a company-wide digital transformation initiative at Repsol, the company also shaped a new cybersecurity strategy. Its vision focused on integrating resilience into the business design and improving the recovery time after a cyber incident. Instead of focusing only on technical solutions, the new strategy is based on business resilience and risk appetite, and on the World Economic Forum Cyber Resilience in Oil and Gas community’s principles for boards. To this end, the security and business teams collaborated to define resilience metrics and funded lighthouse projects, ensuring resilience was included from the inception phase. When deemed appropriate, the security team sought support from the board to improve training, awareness and resource allocation to deliver value. This collaborative process allowed Repsol to align the needs of the business and security sections and improve cyber-resilience controls. Key takeaway: Focusing on the business risks resulted in corporate integration and awareness of cybersecurity, while collecting insights and lessons from the World Economic Forum community to adopt a more holistic approach to cyber resilience.
Repsol funds lighthouse projects to build allies
Repsol
Before 2020, isolated initiatives alone addressed third-party cybersecurity risks stemming from suppliers at Schneider Electric. To manage cybersecurity risks from third parties consistently and efficiently, the company set up a crossfunctional programme and enforced a new policy, targeting a large range of suppliers, from product component producers such as original equipment manufacturers (OEMs) to technology providers such as cloud and infrastructure hosting services. A risk-based approach classifies suppliers into four categories (critical, high, moderate and low) and introduces security requirements and consequence management for noncompliance. The policy tailors the requirements and mitigation measures based on supplier risk profile. The benefits include: Making cybersecurity “top-of-mind” in supplier interactions and for high-ranking executives up to C level; systematically embedding cybersecurity provisions in supplier agreements. Enforcing collaborative and continuous monitoring, threat and risk vectors identification with critical suppliers (using cyber-scoring platforms, cyberthreat intelligence platforms). Performing security and privacy checks on delivered platforms within the frame of an internal security certification process; systematically enforcing internal and external cyber assessments (e.g. shared assessments platforms) using a riskbased approach. Enabling a transparency mindset to ensure supplier vulnerabilities and incidents are known by the company before they are publicly known; documenting supplier incidents to capture and respond to any other incidents in a structured and collaborative way across the company."
Schneider Electric: Maintaining a third-party risk classification based on scope – Schneider Electric
Schneider Electric
Adani Group began its IT and OT cybersecurity transformation programme in relation to more than 2,000 assets in approximately 80 locations and on 170 networks; these include areas such as power, renewables and transmission. The full programme aims to ensure business continuity by protecting critical infrastructure assets from attack, damage, unauthorized access and rejection of service. The programme has a centralized strategy, roadmap and planning governance that integrates business, IT and OT teams supported by original equipment manufacturers (OEMs) plus technology and process partners. The programme is overseen by management, and includes monthly reports and steering committee reviews. The integration of holistic cybersecurity management detection and response (MDR) capabilities among different parties represents one of the programme’s priorities, focusing on technology and process areas for global risk mitigation. In addition to the creation of common IT/OT policies, procedures and guidelines and clear IT/OT-integrated detection and responses, the programme includes the deployment of detection and monitoring technology and network segmentation for OT infrastructure, such as intrusion detection systems and OT firewall monitoring. With these, Adani aims to mitigate the risks and create proactive threat detection and response capabilities to better manage any possible future cyber incidents.
Adani Group Resilience plans – IT/OT transformation programme
Adani Group
The spate of attacks against the world’s critical infrastructure put into focus the urgent need to address industrial cybersecurity. Siemens is taking a leading role by ensuring secure design processes and certification on its products and solutions. As the electricity industry becomes increasingly interconnected, no company can address this complex challenge alone. Recognizing that resilience requires strengthening and building trust with customers, suppliers and the electricity community as a whole, Siemens has worked closely with the World Economic Forum to develop board principles as part of a joint mission to build trust for a secure digital world. To that end, Siemens established the Charter of Trust, bringing together leading energy companies, technology providers, insurers and manufacturers committed to advancing cybersecurity and digitalization. Highlights from this work include: – Initiating change from the top by hiring a chief security officer to report directly to the deputy chief executive officer and the Siemens board. – Implementing security processes andcertifications on Siemens technologies and establishing voluntary, third-party certifications throughout its supply chains. – Supporting the growth of a technology ecosystem of leading security companies to build novel industrial cyber technologies in the areas of monitoring and vulnerability management. – Collaborating with global standards and industry bodies to set global and national guidelines for securing critical assets. – Developing national workforce programmes to overcome the acute talent shortage of industrial cyber professionals in the electricity sector. – Quickly responding alongside Charter of Trust members to respond to COVID-19, ensuring safe and secure remote telework, all while maintaining critical operations for Siemens and its customers.
Siemens Collaborating to build a secure and trusted energy community
Siemens
The continuous increase of digital connectivity in the electricity sector increases exposure to potential cyber risks, in particular for global industrial companies operating in complex environments such as the Enel Group. To keep pace and better monitor cyber risks, the Enel Group embedded cybersecurity strategy into its corporate group strategy, developing a cybersecurity framework that encompasses eight processes (as depicted in the figure below). It is easy to observe the full match with the World Economic Forum’s Advancing Cyber Resilience: Principles and Tools for Boards. World Economic Forum’s cybersecurity electricity industry principles and Enel’s cybersecurity framework processes In its journey to cyber resilience, and in order to improve its oversight of enterprise cyber risk, Enel established its Cyber Security Risk Committee. Enel’s chief executive officer acts as chairperson, with the aim of addressing and approving the organization’s cybersecurity strategy as well as checking periodically on the progress of its implementation. This committee comprises key executive directors overseeing Enel’s critical businesses and services from different geographies along with the group Chief Information Officer and Chief Information Security Officer. In addition, Enel, within its cybersecurity cross-organization, defined the new “cyber-risk manager” organizational role – for each area of business – reporting to the Chief Information Security Officer and representing business priorities related to cyber-risk management. This governance allowed the extension and adoption of a group-wide, risk-based cybersecurity framework to all business areas and geographical locations, improving the control of the Enel Group’s cyber resilience. The expansion of a holistic cyber-risk management approach represents an ongoing priority at Enel to encourage ecosystem cyber maturity by employing and collaborating with external parties. Currently Enel is strongly engaged in the community working group developing a cyber security Network Code for the electricity ecosystem in Europe.
Enel: A journey to improve the oversight of cyber resilience
Enel
Scenario: In 2020, oil and gas company Eni reorganized and adopted a new organizational model to achieve significant decarbonization goals, with technological innovation and digitalization as the strategic drivers of its transformation process. To facilitate the decarbonization goals through digitalization, Eni initiated a large number of digital transformation projects, all of which present crosscutting challenges for cybersecurity. Consequently, the company developed a global cybersecurity approach to protect industrial control system (ICS) and information and communications technology (ICT) assets and let the IT/OT convergence happen, while protecting ICS from classic ICT threats and thus enabling the business transformation. Eni takes a risked-based approach to cybersecurity that is centred on its strategic vision and aligned with major corporate strategy drivers. It includes protecting key industrial assets, ensuring compliance readiness, employing performance models to ensure continuous improvement, using a resiliencyfirst approach to monitoring and a rapid services response to guarantee business continuity, and allowing business to leverage emerging technologies. Reporting and communicating with the Eni risk committee is an important part of the maturity model; providing continuous information and inducting new members are also key success factors. Consequently, a renewed reporting policy has been adapted to the new business needs, with an improved set of risk indicators and the inclusion of risks linked to the human factors of cybersecurity. Key takeaways: By ensuring continuous alignment with the organization’s strategy drivers and establishing clear responsibility, Eni guarantees cybersecurity is an enabler by adapting its cyber organization, culture and practices. Metrics to evaluate key outcomes include: more than 10 cybersecurity reports shared with the risk committee, and more than 10 key risk indicators updated quarterly. So far in 2021, almost 40 cyber projects have been aligned with the company strategy, and cybersecurity competencies have been involved in more the 600 ICT, digital, industrial and business activities.
Eni: Cybersecurity as a business enabler
Eni
The New York Power Authority (NYPA) focuses on security and resilience, implementing board principles through monitoring and implementing the toolkit for cyber resilience in the electricity sector. The NYPA has strong board engagement on the critical role the organization plays in New York State and an understanding of how security and resilience of the services provided need clear emphasis. In working towards improved oversight of cyber resilience, the NYPA has implemented a board-level security committee focused on cyber and physical security, including overall resilience. The committee is augmented at the business level by the NYPA Secure Committee, which includes top-level business leaders who intersect or partner with security teams. As part of this institutional structure, NYPA’s three-year cybersecurity roadmap and integrated resilience roadmap undergo regular updates and reviews, including annual reviews and status updates to the board. This process also ensures that cyber risk is aligned with, and managed in concert with, enterprise risk-management processes to ensure mitigation, response and monitoring. Risk owners are identified and assigned, with cyber resilience being mostly coordinated by the executive business lead (e.g. chief information security officer) as the assigned risk owner. Integration with enterprise risk management was achieved by aligning the Secure Committee with the Enterprise Risk Management Committee for clearly defined risk appetite and effectiveness metrics and escalation. Systemic risks are raised through the various channels, ultimately making their way to the board in quarterly updates. Resilience is reviewed and improved by business and industry exercises that move beyond the tabletop to action. These assessments and the corresponding after-action reports drive decision-making and prioritization to continually reduce cyber risk and increase business resilience. The NYPA confirms these actions and mitigations with intensive internal audit functions and through the use of external assessments. The NYPA continues to implement the cyber-resilience principles to ensure the right services and focus takes overall resilience into account. The implementation of the principles clarified a top-down understanding of NYPA’s cyber risk in comparison to all enterprise risk, allowing a clear and decisive management of security risks across all business and critical functions. Risks in terms of supply chain, compliance and the new normal (e.g. post-COVID) will continue to drive cooperative measures, services and initiatives. By using the implementation of these categories to achieve the board’s principles, the NYPA aims to continuously improve the active management of cybersecurity and resilience while coping and adapting to any future changes and challenges.
New York Power Authority Implementing the principles to improve the active management of cybersecurity and resilience
Power Authority of the State of New York
The era of digitization and technological innovation means that organizations are exposed to cyberattacks that are increasingly frequent and sophisticated. The organizational complexity of the Enel Group and the numerous environments it encompasses (data, people and the industrial world) expose the organization’s assets to a wide range of cyber-attacks. To address this, the Enel Group has adopted a cyber risk management model based on a "systemic" vision that integrates the traditional information technology sector, the operational technology field most closely linked to the industrial sector and IoT associated with the networking of smart objects. In particular, Enel has adopted a “Cyber Security Framework," a policy issued by the CEO, defining all processes in order to guide and manage cybersecurity activities. This framework facilitates deep involvement from all business areas, the implementation of regulatory and legal requirements, Case study from ENEL: An example of what can be done they also often have different security requirements. Perhaps the most fundamental difference is that IT security focuses on confidentiality while OT usually prioritizes integrity and availability. The potential societal consequences require a grid asset operator’s priority to be ensuring the safe and reliable delivery of electricity. This responsibility leads to other differences across areas, from component lifetimes and patching practices to audit timelines and additional functions. The security challenges created by differences in priorities are often exacerbated by a communication barrier between IT and OT groups. Additionally, they may have different reporting and governance structures. This lack of coordination and communication is especially risky in times of emergency where the organization needs to respond to, or recover from, a cyber incident. the use of best-available technologies and an informed workforce. Furthermore, cybersecurity decisions and activities are based on business priorities, and security measures are embedded throughout the design and development lifecycle of applications, processes, and services. This model is supported by a global and holistic organizational structure that drives activities and projects based on a risk-based approach in order to balance the benefits of increasingly digital IT/OT/IoT systems with the potential cyber risk and associated business impact. However, Enel Group has not stopped there. In 2017, Enel Group established a new Cyber Security Risk Management Methodology, applicable to all IT, OT and IoT environments and has created its own active Cyber Emergency Readiness Team (CERT), which is recognized and accredited by national and international communities, in order to direct an industrialized response to cyber threats and incidents.
Enel: An example of what can be done
Enel

Cyber Resilience Initiative

A World Economic Forum Initiative
© 2026 All rights reserved
Privacy Policy & Terms of Service