[BCM] [CAAS] [E3] [BIA] [T2] [CBF] [9] IT & Cyber Resilience

[Business Impact Analysis] [Critical Business Function] [T2] Part 3

CBF 9: IT & Cyber Resilience

Impact Over Time of Business Functions

The resilience of information technology and cybersecurity capabilities within the Civil Aviation Authority of Singapore (CAAS) is critical to maintaining safe, secure, and uninterrupted civil aviation operations in Singapore.

The Critical Business Function (CBF-9): IT & Cyber Resilience encompasses the digital backbone of CAAS’s services, from real-time air traffic management to the secure operation of enterprise systems and digital aviation platforms.

This chapter evaluates the potential impact over time if these functions are disrupted, using a 1 to 5 scale—where 1 indicates minimal impact and 5 indicates severe or critical impact.

The analysis is aligned with the BCM Institute’s framework for impact assessment and considers factors such as operational disruption, financial cost, safety risks, regulatory compliance, and reputational damage.

Understanding the impact severity over specific time intervals allows CAAS to prioritize recovery strategies and allocate appropriate resources, ensuring that business continuity objectives are met in the face of cyber incidents, IT system failures, or external threats.

Table 3: [Impact Over Time of Business Functions for CBF 1: Air Navigation Services

Notes

• Impact values are based on a scale of 1 (lowest) to 5 (highest) as per BCM standards.
• RTO (Recovery Time Objective): The maximum allowable time to recover the function to avoid unacceptable consequences.
• MTPD (Maximum Tolerable Period of Disruption): The longest time a process can be disrupted before it causes irrevocable damage.
• Vulnerable Period: Time of heightened risk when disruption will cause a disproportionately high impact.

Summing Up ... for Part 3

The analysis of impact over time for the sub-functions under CBF-9 IT & Cyber Resilience clearly illustrates the time-sensitive and mission-critical nature of digital infrastructure within CAAS. Functions such as Air Traffic Management Systems Resilience and Cybersecurity Monitoring present high criticality even at the 4-hour mark, reinforcing the need for rapid recovery capabilities, well-tested disaster recovery plans, and continuous monitoring.

Conversely, sub-functions like Governance, Compliance, and Disaster Recovery Testing tolerate longer disruptions before causing material impact, but are essential for long-term regulatory and reputational standing.

The Recovery Time Objectives (RTOs) and Maximum Tolerable Periods of Disruption (MTPDs) defined in this assessment provide clear targets for CAAS to build its IT and cyber resilience capabilities, especially as digital transformation and aviation modernisation continue to accelerate.

This prioritisation ensures that CAAS can uphold its commitment to aviation safety, regulatory compliance, and stakeholder trust, even during IT disruptions or cyber incidents.

[Business Impact Analysis] [Critical Business Function] [T2] Part 4

CBF 1: Air Navigation Services

Supporting IT Systems and Applications

The Civil Aviation Authority of Singapore (CAAS) operates within a highly complex, regulated, and technology-reliant environment.

As such, the resilience of its IT and cyber systems forms a critical backbone in maintaining uninterrupted air navigation services, safeguarding national cybersecurity, and ensuring operational continuity across all aviation-related functions.

This chapter focuses on the supporting IT systems and applications that underpin the Critical Business Function: CBF-9 – IT & Cyber Resilience.

It presents a comprehensive view of the key Sub-CBFs, identifies core systems, evaluates Recovery Point Objectives (RPOs) and System Recovery Time Objectives (System RTOs), and outlines the special equipment or resources that facilitate their continuity.

This analysis enables CAAS to maintain resilient operations in alignment with best practices in business continuity and disaster recovery planning.

Table 4: [BIA] [P4] Supporting IT Systems and Applications for CBF 9: IT & Cyber Resilience

Summing Up ... for Part 4

The resilience of IT and cyber capabilities is a cornerstone of CAAS’s operational excellence and regulatory compliance.

By clearly mapping each Sub-CBF under CBF-9 to their respective systems, recovery parameters, and supporting infrastructure, CAAS demonstrates a proactive and structured approach to safeguarding critical aviation functions.

As cyber threats evolve and digital transformation accelerates, maintaining up-to-date IT continuity plans, system redundancy, and robust disaster recovery capabilities ensures that CAAS remains prepared for both anticipated and unforeseen disruptions.

This foundational support strengthens national aviation safety and positions CAAS as a resilient aviation authority in a digitally connected world.

 

Resilience Redefined: Implementing BCM at Civil Aviation Authority of Singapore
eBook 3: Starting Your BCM Implementation
MBCO	P&S	RAR T1	RAR T2	RAR T3	BCS T1	CBF
CBF-1 Air Navigation Services
DP	BIAQ T1	BIAQ T2	BIAQ T3	BCS T2	BCS T3	PD

 

More Information About Business Continuity Management Courses

To learn more about the course and schedule, click the buttons below for the  BCM-300 Business Continuity Management Implementer [BCM-3] and the BCM-5000 Business Continuity Management Expert Implementer [BCM-5].

	Please feel free to send us a note if you have any questions.