Scenario: Under a company-wide digital transformation initiative at Repsol, the company also shaped a new cybersecurity strategy. Its vision focused on integrating resilience into the business design and improving the recovery time after a cyber incident. Instead of focusing only on technical solutions, the new strategy is based on business resilience and risk appetite, and on the World Economic Forum Cyber Resilience in Oil and Gas community’s principles for boards. To this end, the security and business teams collaborated to define resilience metrics and funded lighthouse projects, ensuring resilience was included from the inception phase. When deemed appropriate, the security team sought support from the board to improve training, awareness and resource allocation to deliver value. This collaborative process allowed Repsol to align the needs of the business and security sections and improve cyber-resilience controls. Key takeaway: Focusing on the business risks resulted in corporate integration and awareness of cybersecurity, while collecting insights and lessons from the World Economic Forum community to adopt a more holistic approach to cyber resilience.