Advancing Supply Chain Security in Oil and Gas: An Industry Analysis

The report argues that the digital transformation of the oil and gas industry has increased reliance on third parties, expanding the attack surface for cyber threats. It proposes a harmonized, risk-based approach to third-party risk management (TPRM) across five life cycle phases: planning, assessment and evaluation, contract and commissioning, operation and monitoring, and offloading. The framework includes 10 guiding principles, 39 baseline cybersecurity requirements, and a methodology for calculating residual risk based on inherent risk and control effectiveness. Case studies from Shell, Galp Energia, Saudi Aramco, Schneider Electric, and Palo Alto Networks illustrate the implementation of these risk-based strategies, emphasizing the need for public-private collaboration to streamline resource-intensive assessment processes.

• The oil and gas industry's digital transformation has led to hyperconnectivity and a reliance on over 1,000 third parties, which increases vulnerabilities to cyberattacks and operational risks such as cloud breaches and software supply chain disruptions.
• Current third-party risk management is often inefficient and redundant, characterized by resource-intensive methods and a lack of aligned requirements, leading to thousands of questionnaires being filled out without proper analysis.
• The report proposes a holistic five-phase life cycle for managing third-party risks: Planning, Assessment and evaluation, Contract and commissioning, Operation and monitoring, and Offloading.
• A risk-based assessment model is recommended to determine a third party's inherent risk rating (Critical, High, Moderate, or Low) based on four criteria: access to critical IT systems, access to critical OT systems, access to sensitive information, and dependence of critical business processes on the third party.
• The framework establishes 39 cybersecurity baseline requirements based on 10 key principles, including secure-by-design systems, access controls based on 'need-to-know', and the maintenance of response and recovery mechanisms.
• To streamline the contract and commissioning phase, the report identifies 12 common cybersecurity-related contractual term topics, ranging from identity and access management to secure development and source code protection.
• Continuous monitoring should be risk-based, using a reassessment matrix where the frequency and depth of audits (onsite, remote, or self-assessment) are driven by the residual risk rating.

APA

World Economic Forum (2021). Advancing Supply Chain Security in Oil and Gas: An Industry Analysis. http://www3.weforum.org/docs/WEF_Advancing_Supply_Chain_Security_in_Oil_and_Gas_2021.pdf

Chicago

World Economic Forum. Advancing Supply Chain Security in Oil and Gas: An Industry Analysis. 2021. http://www3.weforum.org/docs/WEF_Advancing_Supply_Chain_Security_in_Oil_and_Gas_2021.pdf.

Wikipedia

{{cite report |author=World Economic Forum |title=Advancing Supply Chain Security in Oil and Gas: An Industry Analysis |date=August 2021 |url=http://www3.weforum.org/docs/WEF_Advancing_Supply_Chain_Security_in_Oil_and_Gas_2021.pdf |access-date=23 October 2026 |via=Climate Insights Directory}}

BibTeX

@techreport{worldeconomicforum2021advancing, author = {{World Economic Forum}}, title = {{Advancing Supply Chain Security in Oil and Gas: An Industry Analysis}}, institution = {World Economic Forum}, year = {2021}, month = aug, url = {http://www3.weforum.org/docs/WEF_Advancing_Supply_Chain_Security_in_Oil_and_Gas_2021.pdf}, urldate = {2026-10-23}, note = {Indexed by Climate Insights Directory} }