Scenario: Many organizations harbor different cultures with various risk appetite levels, which can be detrimental to implementing company-wide cybersecurity policies and best practices. With the goal of reducing the potential impact of cyberattacks at Repsol, the CISO recognized the need to balance risk appetite levels within business units with stakeholder expectations in order to implement cyber resilience holistically throughout the company. Using the World Economic Forum’s principles for boards while building a trusted relationship with board members, the CISO shifted the company’s cybersecurity strategic plan from a technical-solutions approach to a business-resilience and risk-management approach. The board provided support for training and awareness as well as resources dedicated to developing Repsol’s cyber resilience further. The CISO was able to provide budget support to other departments for lighthouse projects on cyber resilience. Key takeaway: By ensuring the CISO had the appropriate resources, the board provided the means to build allies in implementing new cyber policies and practices.