Scenario: In 2020, oil and gas company Eni reorganized and adopted a new organizational model to achieve significant decarbonization goals, with technological innovation and digitalization as the strategic drivers of its transformation process. To facilitate the decarbonization goals through digitalization, Eni initiated a large number of digital transformation projects, all of which present crosscutting challenges for cybersecurity. Consequently, the company developed a global cybersecurity approach to protect industrial control system (ICS) and information and communications technology (ICT) assets and let the IT/OT convergence happen, while protecting ICS from classic ICT threats and thus enabling the business transformation. Eni takes a risked-based approach to cybersecurity that is centred on its strategic vision and aligned with major corporate strategy drivers. It includes protecting key industrial assets, ensuring compliance readiness, employing performance models to ensure continuous improvement, using a resiliencyfirst approach to monitoring and a rapid services response to guarantee business continuity, and allowing business to leverage emerging technologies. Reporting and communicating with the Eni risk committee is an important part of the maturity model; providing continuous information and inducting new members are also key success factors. Consequently, a renewed reporting policy has been adapted to the new business needs, with an improved set of risk indicators and the inclusion of risks linked to the human factors of cybersecurity. Key takeaways: By ensuring continuous alignment with the organization’s strategy drivers and establishing clear responsibility, Eni guarantees cybersecurity is an enabler by adapting its cyber organization, culture and practices. Metrics to evaluate key outcomes include: more than 10 cybersecurity reports shared with the risk committee, and more than 10 key risk indicators updated quarterly. So far in 2021, almost 40 cyber projects have been aligned with the company strategy, and cybersecurity competencies have been involved in more the 600 ICT, digital, industrial and business activities.