Repsol has embraced zero trust with two different approaches – as a mindset and as a programme. As a mindset: Every initiative and security requirement is thought through with the zero trust principles in mind as part of a security-by-design process. As a programme: To reach maturity in this architecture and truly change the paradigm, Repsol recognizes that some transformational projects and a dedicated multidisciplinary team are needed. The key piece for succeeding in the programme is adequate sponsorship to drive the transformation. Senior management have to be briefed about the concept and must support the programme, while key teams from areas such as architecture, applications and infrastructure have to be highly engaged. The organization is aware that this is a continuous journey on which it needs to adjust its action plan to the readiness of the environment and the always evolving nature of the threats.