Scenario: Saudi Aramco took proactive measures to establish a new organizational structure and engage personnel to address cybersecurity oversight and implementation for IT and OT. Saudi Aramco decided that the best way to defend the organization was with a proactive and risk-based strategy and a dedicated structure to improve cyber hygiene and governance. As a crucial early step, the company appointed a CISO to institute cybersecurity governance and oversee the enterprise’s cybersecurity posture, including IT and OT. The CISO helped ensure security and the resilience of connected physical assets and technology devices that could be vulnerable to attack. The company established a risk-based cybersecurity programme and strategy to cover cyber resilience and aligned its structure to meet industry frameworks and standards, like the US National Institute of Standards and Technology’s Cybersecurity Framework (NIST CSF) and the Cybersecurity Capability Maturity Model (C2M2). A new oversight mechanism was put in place with the board of directors overseeing top corporate cyber risks and executive management overseeing cybersecurity performance through designated key performance indicators. This approach was designed to support managers and executives in making informed decisions in alignment with preset risk tolerance and appetite. Key takeaway: New personnel, protocols, oversight structures, and periodic reporting to the board and executive leadership helped to gain stakeholder buy-in as well as increase cybersecurity awareness and the overall level of cybersecurity at the company.