[BCM] [CAAS] [E3] [BIA] [T1] [CBF] [9] IT & Cyber Resilience

Sub-CBF Code

Sub-Critical Business Function

Description of CBF

Business Unit Minimum Business Continuity Objective (BU MBCO)

CBF-1.1

Air Traffic Management (ATM) Systems Resilience

Ensures continuous operability and recovery of core ATM systems supporting flight navigation, surveillance, and communications.

Maintain 100% availability of primary ATM systems with hot-standby failover within 30 minutes of disruption.

CBF-1.2

Cybersecurity Monitoring & Threat Response

Monitors real-time threats and coordinates cyber incident response and containment across CAAS digital assets and infrastructure.

Threat monitoring must resume within 15 minutes; containment and response actions must be initiated within 1 hour of incident detection.

CBF-1.3

Critical System Backup & Data Recovery

Manages backups and ensures the integrity of critical data to support timely system recovery in case of outages or breaches.

Daily backups of critical systems with recovery points within 4 hours; restoration capabilities within 2 hours for Tier-1 systems.

CBF-1.4

Enterprise IT Infrastructure Continuity

Supports the resilience of CAAS’s core IT infrastructure, including servers, network equipment, and data centres.

Maintain 80% uptime for non-critical services; critical infrastructure must be restored within 2 hours.

CBF-1.5

Digital Aviation Services Platform (DASP) Resilience

Ensures continued operation of DASP, which supports digital interactions with stakeholders (e.g., e-services, permits, applications).

Core DASP functions must be operational within 4 hours; data integrity to be fully restored within 24 hours.

CBF-1.6

Cloud and Third-Party Service Continuity

Manages continuity of outsourced or cloud-based services supporting CAAS's operations, ensuring SLAs and security postures are maintained.

Critical cloud services must have a recovery plan with activation within 2 hours; vendor SLAs must meet RTO ≤ 4 hours.

CBF-1.7

IT Governance & Compliance Management

Maintains IT policies, compliance, audits, and risk management frameworks to ensure regulatory alignment and control effectiveness.

Ensure continuity of regulatory and compliance monitoring with no more than 24 hours of disruption to prevent audit gaps or reporting delays.

CBF-1.8

Disaster Recovery Planning and Testing

Designs, maintains, and tests the IT disaster recovery plans to ensure readiness and alignment with business continuity strategies.

DR planning documentation must remain accessible within 1 hour; post-disaster tests must be performed within 7 days following a major disruption.

Sub-CBF Code

Sub-CBF

Impact Area

Financial Impact – Monetary Loss (Estimated)

Financial Impact – Calculation of Monetary Loss

Impact on MBCO – Affect MBCO

Impact on MBCO – Impact

Remarks – Description

CBF-1.1

Air Traffic Management (ATM) Systems Resilience

Safety, Operational, Reputational, Legal & Regulatory

SGD 10M–50M

(No. of Flights Affected) × (Average Penalty + Cost per Delay)

Yes

Severe

Disruption affects radar tracking, flight separation, and real-time navigation—posing national safety risks.

CBF-1.2

Cybersecurity Monitoring & Threat Response

Security, Legal & Regulatory, Reputational

SGD 5M–20M

(Estimated No. of Breaches) × (Average Loss per Incident) + Regulatory Fines

Yes

High

Loss of real-time threat visibility may lead to breaches, compromising aviation and passenger data.

CBF-1.3

Critical System Backup & Data Recovery

Operational, Reputational

SGD 3M–10M

(Data Recovery Hours) × (Ops Cost/Hour) × (No. of Systems)

Yes

Moderate

Data loss or unavailability delays key decisions and impacts compliance with aviation standards.

CBF-1.4

Enterprise IT Infrastructure Continuity

Operational

SGD 2M–8M

(Downtime in Hours) × (No. of Impacted Users) × (Average Hourly Wage/Cost)

Yes

Moderate

Internal operations (HR, finance, administration) are affected but don’t impact external services directly.

CBF-1.5

Digital Aviation Services Platform (DASP) Resilience

Operational, Customer Service, Reputational

SGD 5M–15M

(Users Affected) × (Average Delay Cost/User) + (Penalty Fees)

Yes

High

DASP links CAAS to airlines and other aviation stakeholders; its failure disrupts coordination and service delivery.

CBF-1.6

Cloud and Third-Party Service Continuity

Contractual, Operational, Legal & Regulatory

SGD 3M–12M

(Services Affected) × (Monthly Subscription Cost + SLA Penalty)

Yes

High

Dependency on external vendors for data hosting and analytics increases operational vulnerability.

CBF-1.7

IT Governance & Compliance Management

Legal & Regulatory

SGD 1M–5M

(No. of Non-Compliance Cases) × (Avg Fine/Penalty)

Yes

Moderate

Affects audit readiness and CAAS’s ability to demonstrate regulatory alignment (e.g., ISO, ICAO).

CBF-1.8

Disaster Recovery Planning and Testing

Operational

SGD 500K–2M

(Testing Gaps) × (Estimated Risk Exposure per Gap)

Yes

Moderate

Inadequate testing leads to failed recovery in a real incident; impacts all dependent systems.

CBF-1.11

Training & Certification of ATS Personnel

Human Resource, Compliance

SGD 20,000 – 50,000

No. of uncertified staff x Lost productivity x Training delay cost

No

Low – Operational continuity can be maintained in the short term; however, certification gaps will likely emerge.

Essential for long-term sustainability and staff readiness.