Saudi Aramco initiated its supply-chain cybersecurity programme in 2016 to combat third-party risk by embedding cybersecurity into its third-party engagement life cycle. The programme aimed to identify the necessary elements to ensure the security of Saudi Aramco data and assets entrusted to third parties by improving critical third parties’ cybersecurity readiness as well as minimizing potential disruption in the event of a cyberattack. The programme made sure cybersecurity would no longer be an afterthought when engaging with third parties by embedding cybersecurity requirements in the third-party engagement process. Nonetheless, continuous collaboration among cybersecurity, legal, procurement and business is important to ensure success in implementing such a programme. Through this effort, the company established crucial cybersecurity elements, including cybersecurity contractual terms, third-party cybersecurity policy and standards, cyber incident reporting and third-party risk-based classification. To sustain the programme efforts, third-party cybersecurity functions and processes were formalized. This included formalization of the Saudi Aramco Cybersecurity Compliance Certificate (CCC) with nine audit firms as authorized entities to assess and issue the CCC independently, based on the organization’s compliance with Saudi Aramco’s third-party cybersecurity standard.