In 2015, the Iberdrola S.A. board recognized that being at the forefront of digital transformation required strong cybersecurity and resilience capabilities. In this dynamic, increasingly complex and interconnected environment, ensuring compliance with all IT security, privacy and critical infrastructure protection regulations was not enough. As a result, the board approved a company-wide cybersecurity risk policy to promote a strong cybersecurity culture and established a Global Cybersecurity Committee with the mandate to lead this cultural change. The goal was to promote cybersecurity and resilience by design and by default throughout the organization. Moreover, it aimed to embed the idea that cybersecurity is everyone's responsibility, and goes beyond individual organizations How this was accomplished: − A new cyber governance framework was approved where IT and Security no longer had sole responsibility for cybersecurity. It is now a responsibility of all businesses and corporate areas. − The chief information security officers (CISOs) are responsible for ensuring overall coordination, independent oversight and adequate cyber training of their respective boards, senior management and all personnel. − A common cyber risk methodology and global rules were defined to allow risk-based identification of action plans in all areas. Cybersecurity strategy and action plans for IT, OT and IoT environments are coordinated and supported with investments in technology, processes and people. − An OT cybersecurity forum brings together Industrial control systems (ICS) and IT security experts across the company to exchange best practices, share results and coordinate initiatives. − Leadership, including the Global CISO, emphasized collaboration. These collaborative partnerships with technology providers, other companies, industry experts and government agencies now provide threat intelligence for the company and contribute to the resilience of the ecosystem as a whole.