Trust is at the core of Schneider Electric’s business, with cybersecurity as a critical pillar. Effective cyber risk management extends beyond technology to governance, which is why the company has embedded key internal controls (KICs) within the three-lines-of-defence framework.

The KICs initiative establishes clear accountability for cyber risk mitigation, ensuring that business and operational cyber risk-owners (first line of defence) formally acknowledge risks and implement controls. These efforts are guided by the group CISO (second line of defence) and independently reviewed by internal audit (third line of defence). By making control expectations explicit, KICs eliminate ambiguity and ensure that cybersecurity and product security are integral to operations.

KICs are mapped to company policies and the cyber risk register, which are updated annually by the cybersecurity team. Each year, risk-owners formally sign off on control execution, providing evidence or action plans to address gaps. This structured approach strengthens compliance, enhances business resilience and enables the company to demonstrate security commitments to customers and regulators. By formalizing risk-ownership, KICs mark a significant advance in Schneider Electric’s cyber maturity programme, reinforcing the company’s proactive stance on cybersecurity and business continuity.