The New York Power Authority (NYPA) focuses on security and resilience, implementing board principles through monitoring and implementing the toolkit for cyber resilience in the electricity sector. The NYPA has strong board engagement on the critical role the organization plays in New York State and an understanding of how security and resilience of the services provided need clear emphasis. In working towards improved oversight of cyber resilience, the NYPA has implemented a board-level security committee focused on cyber and physical security, including overall resilience. The committee is augmented at the business level by the NYPA Secure Committee, which includes top-level business leaders who intersect or partner with security teams. As part of this institutional structure, NYPA’s three-year cybersecurity roadmap and integrated resilience roadmap undergo regular updates and reviews, including annual reviews and status updates to the board. This process also ensures that cyber risk is aligned with, and managed in concert with, enterprise risk-management processes to ensure mitigation, response and monitoring. Risk owners are identified and assigned, with cyber resilience being mostly coordinated by the executive business lead (e.g. chief information security officer) as the assigned risk owner. Integration with enterprise risk management was achieved by aligning the Secure Committee with the Enterprise Risk Management Committee for clearly defined risk appetite and effectiveness metrics and escalation. Systemic risks are raised through the various channels, ultimately making their way to the board in quarterly updates. Resilience is reviewed and improved by business and industry exercises that move beyond the tabletop to action. These assessments and the corresponding after-action reports drive decision-making and prioritization to continually reduce cyber risk and increase business resilience. The NYPA confirms these actions and mitigations with intensive internal audit functions and through the use of external assessments. The NYPA continues to implement the cyber-resilience principles to ensure the right services and focus takes overall resilience into account. The implementation of the principles clarified a top-down understanding of NYPA’s cyber risk in comparison to all enterprise risk, allowing a clear and decisive management of security risks across all business and critical functions. Risks in terms of supply chain, compliance and the new normal (e.g. post-COVID) will continue to drive cooperative measures, services and initiatives. By using the implementation of these categories to achieve the board’s principles, the NYPA aims to continuously improve the active management of cybersecurity and resilience while coping and adapting to any future changes and challenges.