世界经济论坛-石油和天然气行业的网络复原力（英文）-2021.5-27页_4mb

Summary of Cyber Resilience in the Oil and Gas Industry: Playbook for Boards and Corporate Officers

Core Content

The Cyber Resilience in the Oil and Gas Industry: Playbook for Boards and Corporate Officers is a comprehensive guide aimed at helping oil and gas executives manage and mitigate cyber risks in a rapidly evolving digital landscape. It outlines six industry-specific principles to enhance cyber resilience, complementing general cybersecurity principles developed by the World Economic Forum.

The document emphasizes that the oil and gas industry is undergoing a significant transformation driven by digitalization, which integrates operational technology (OT) and information technology (IT) systems to optimize operations and reduce emissions. However, this integration also exposes the sector to heightened cyber risks, including attacks on critical infrastructure, supply chain vulnerabilities, and insider threats. Cybersecurity is now a core business requirement, not just a technical concern, and must be embedded into the corporate culture and strategy.

Main Viewpoints

• Cybersecurity is a critical business challenge: The oil and gas industry is increasingly vulnerable to cyber threats due to the integration of OT and IT systems. Cybersecurity failures can disrupt operations, cause financial losses, and damage reputations.

• Cyber resilience is essential for operational and strategic success: Boards and corporate leaders must ensure that cybersecurity is a central component of the business model, aligning with the company's overall goals and risk appetite.

• A holistic and integrated approach is required: Cyber resilience must be embedded in all aspects of the business, from the field to the corporate headquarters, and across the entire supply chain.

• Collaboration and ecosystem-wide strategies are key: Cybersecurity cannot be managed in isolation. Collaboration between organizations, consistent protocols, and shared responsibility are vital for improving resilience across the industry.

• Proactive governance and leadership are crucial: Boards need to establish clear governance models, define roles and responsibilities, and ensure that cybersecurity is prioritized in strategic planning and risk assessment.

Key Information

1. Cyber Resilience Principles for Oil and Gas Industry Boards

• OG1. Cyber-resilience governance: Boards must ensure comprehensive cybersecurity governance that spans IT, OT, physical security, and digital transformation. This includes oversight, accountability, and alignment with industry standards.

• OG2. Resilience by design: Cyber risks should be evaluated and embedded into the design of all business processes. A cross-functional approach is needed to achieve this.

• OG3. Corporate responsibility for cyber resilience: Boards should encourage management to examine the organization's cyber culture and practices, and consider how they affect the broader ecosystem.

• OG4. Holistic risk-management approach: Cyber risks must be managed in conjunction with other operational risks, and the organization must be prepared for unknown threats.

• OG5. Ecosystem-wide collaboration: Collaboration across the industry is essential for sharing best practices, lessons learned, and strengthening collective cyber resilience.

• OG6. Ecosystem-wide cyber-resilience plans: Boards should support the development and testing of collective cyber-resilience plans that include incident response, communication, business continuity, and disaster recovery.

2. General Cyber-Resilience Principles (Appendix A)

The World Economic Forum has developed ten general cyber-resilience principles that apply to any organization. These principles include:

• Responsibility for cyber resilience
• Command of the subject
• Integration of cyber resilience
• Risk assessment and reporting
• Accountable officer
• Review
• Effectiveness
• Risk appetite
• Resilience plans
• Cyber hygiene

These principles are designed to guide board members and corporate officers in cultivating a resilient cybersecurity culture.

3. Operationalizing the Principles (Appendix B)

The playbook provides practical guidance on how to operationalize the principles, including:

• Establishing a dedicated cybersecurity structure
• Implementing a risk-based strategy
• Ensuring clear communication and alignment across departments
• Investing in training and awareness
• Leveraging AI and automation for monitoring and detection

4. Cyber Resilience in the Oil and Gas Strategy and Culture Working Group (Appendix D)

This working group, comprising over 40 senior executives, aims to develop a blueprint for evaluating and enhancing cyber resilience across the oil and gas industry. The group's efforts have led to the creation of the Playbook for Boards and Corporate Officers.

Conclusion

The oil and gas industry must adapt to the digital transformation and the associated cybersecurity challenges. Boards and corporate leaders must take a proactive, integrated, and collaborative approach to cyber resilience. By embedding cybersecurity into the core of the business model and ensuring that it is a shared responsibility, companies can improve their readiness to respond to cyber threats and protect their operations, assets, and stakeholders.

Key Takeaways

• Cybersecurity is a critical business function, not just a technical one.
• Boards must ensure cybersecurity is integrated into all aspects of the business and the broader ecosystem.
• A holistic, risk-based approach to cybersecurity is necessary to address the complexities of the digital transformation.
• Collaboration and shared responsibility are essential for improving cyber resilience across the industry.
• Proactive governance and leadership are key to developing and maintaining effective cyber-resilience measures.