Scenario: At petroleum company Ecopetrol, taking cybersecurity seriously means that it should be integrated throughout all aspects of the value chain, from IT devices to energy assets connected by OT control systems. This overarching principle has been cascaded throughout the company’s approach to integrate cyber-risk management at all points in its operations. To enforce the importance of cyber risk, board members and the CEO developed and endorsed key cyber principles in a memorandum that was communicated to the company by the chief operating officer and chief information officer. The memo’s central goal was to integrate cyber into all the enterprise’s operational tasks, beginning with IT and OT environments, as well as in all the processes in business units and holding companies. With the board leading oversight and the implementation of key guidelines, Ecopetrol prioritized cyber risks linked to the strategic risks. Key takeaway: With board support, the team was able to strengthen its cybersecurity programme by adding personnel and funding and establishing a “Cybersecurity Governance System” to better manage these risks.