[BCM] [CAAS] [E3] [BCS] [T3] [CBF] [9] Minimum Resources Required during a Disaster

[Business Continuity Strategy] [Template 3]

CBF 9: IT & Cyber Resilience

Minimum Resources Required during a Disaster

The Civil Aviation Authority of Singapore (CAAS) relies heavily on robust IT and cyber resilience to safeguard air traffic management, digital aviation services, and enterprise-wide IT infrastructure.

During a disaster, the ability to continue critical IT and cybersecurity operations depends on the timely availability of essential resources, including skilled personnel, functional recovery sites, and technical assets such as workstations, telecommunications, and secure systems access.

This chapter outlines the minimum resources required during a disaster for each Sub-CBF under CBF-9 IT & Cyber Resilience.

The resource requirements reflect the baseline level necessary to ensure continuity of mission-critical IT functions and compliance with aviation safety and cybersecurity standards.

Table 3: [BCS] [T3] Minimum Resources Required for CBF 9: IT & Cyber Resilience

Sub-CBF Code	Sub-CBF	Recovery Location	Minimum Resource Requirements Per Function Per Recovery Location
CBF-1.1	Air Traffic Management (ATM) Systems Resilience	Secondary Control Centre (Off-site, highly secure)	Staff: 15 ATC IT specialists & engineers Seats: 15 Telephones: 10 (secure lines) PC/Laptops: 15 with real-time ATC system access Others: Backup servers (min. 2), secure communication links, redundant radar feeds
CBF-1.2	Cybersecurity Monitoring & Threat Response	Cybersecurity Operations Centre (CSOC) – Alternate Site	Staff: 10 cybersecurity analysts Seats: 10 Telephones: 6 (secure hotline) PC/Laptops: 10 with SIEM & forensic tools Others: Dedicated threat intelligence feeds, isolated incident response lab (min. 1)
CBF-1.3	Critical System Backup & Data Recovery	Disaster Recovery Data Centre	Staff: 8 data engineers Seats: 8 Telephones: 4 PC/Laptops: 8 with backup/recovery tools Others: Backup storage arrays (min. 2), high-speed replication link, portable storage (min. 4 units)
CBF-1.4	Enterprise IT Infrastructure Continuity	Secondary Data Centre	Staff: 12 IT infrastructure specialists Seats: 12 Telephones: 6 PC/Laptops: 12 with admin access Others: Network equipment (min. 2 routers, 2 firewalls), power backup (min. 2 UPS), server racks (min. 4)
CBF-1.5	Digital Aviation Services Platform (DASP) Resilience	Alternate Cloud/Hosting Facility	Staff: 6 application & service engineers Seats: 6 Telephones: 3 PC/Laptops: 6 with VPN access Others: Cloud failover environment (min. 1), secure API gateway backup (min. 1)
CBF-1.6	Cloud and Third-Party Service Continuity	Vendor-hosted DR Environment (Multi-region setup)	Staff: 5 vendor liaison officers & CAAS IT staff Seats: 5 Telephones: 3 PC/Laptops: 5 Others: Contractual DR services, cloud redundancy (min. 2 zones), third-party SLAs with response guarantees
CBF-1.7	IT Governance & Compliance Management	Corporate Office (Alternate Workspace)	Staff: 4 compliance officers Seats: 4 Telephones: 2 PC/Laptops: 4 with regulatory reporting access Others: Compliance documentation repository (min. 1), secure portal for MAS/ICAO reporting
CBF-1.8	Disaster Recovery Planning and Testing	DR War Room / Training Facility	Staff: 6 BCM/IT DR coordinators Seats: 6 Telephones: 2 PC/Laptops: 6 Others: Simulation software (min. 1), test servers (min. 2), DR exercise documentation tools

Summing Up ...

The minimum resources outlined in this chapter represent the baseline operational capacity required to sustain CAAS’s IT and cyber resilience functions during a disaster.

By pre-defining staff, facilities, and technical requirements for each Sub-CBF, CAAS ensures that it can maintain critical aviation services, protect against cyber threats, and recover swiftly from IT disruptions.

This structured approach to resource planning not only safeguards operational continuity but also strengthens stakeholder confidence in Singapore’s aviation safety and resilience framework.

Continuous testing, updating, and alignment with regulatory requirements will ensure that CAAS remains prepared to respond effectively to both cyber and IT-related crises.

Resilience Redefined: Implementing BCM at Civil Aviation Authority of Singapore
eBook 3: Starting Your BCM Implementation
MBCO	P&S	RAR T1	RAR T2	RAR T3	BCS T1	CBF

CBF-1 Air Navigation Services
DP	BIAQ T1	BIAQ T2	BIAQ T3	BCS T2	BCS T3	PD

More Information About Business Continuity Management Courses

To learn more about the course and schedule, click the buttons below for the BCM-300 Business Continuity Management Implementer [BCM-3] and the BCM-5000 Business Continuity Management Expert Implementer [BCM-5].