[OR] [BB] [E3] [CBS] [1] [ST] Perform Scenario Testing

CBS-1 Digital Account Access & Management

Introduction

Scenario testing is a core component of Operational Resilience. As explained in “[OR] [P2-S4] What is Scenario Testing in Operational Resilience?”, scenario testing is not merely about simulating IT failures — it is about assessing how severe but plausible disruptions impact a Critical Business Service (CBS), evaluating the organisation’s ability to remain within impact tolerance, and identifying improvement actions across people, process, technology, facilities, and third parties.

For Boost Bank’s CBS-1: Digital Account Access & Management, scenario testing must consider cyber threats, ICT disruptions, third-party failures, fraud risks, regulatory exposure, and customer impact.

The table below outlines recommended scenario testing themes for each Sub-CBS, the potential impact/effect, and evidence of proactive risk management actions. It also reflects the integration of Cyber and ICT risks, consistent with regulatory expectations on digital banking resilience.

Table P6: Perform Scenario Testing for CBS-1

Sub-CBS Code	Sub-CBS	Recommended Scenario Test Themes (Including Cyber & ICT Risk Integration)	Impact / Effect	Evidence of Proactive Risk Management Action
1.1	Account Onboarding & Registration	• System outage during peak onboarding period • Third-party eKYC provider failure • Data breach during customer data capture • API failure with identity verification partner	• Customers unable to open accounts • Reputational damage • Regulatory non-compliance (KYC/AML breaches) • Data privacy exposure	• Dual eKYC provider redundancy • Secure encryption & secure coding practices • Incident response playbook tested • Real-time onboarding monitoring dashboard
1.2	Authentication & Access Control	• Distributed Denial of Service (DDoS) attack • MFA system failure • Credential stuffing attack • IAM misconfiguration	• Customers locked out • Account takeover risk • Financial loss & fraud • Regulatory breach	• MFA resilience testing • Zero-trust access framework • DDoS mitigation service • Access log review & penetration testing reports
1.3	Profile & Account Maintenance	• Database corruption • Unauthorized profile change • Insider threat scenario • Cloud service disruption	• Incorrect customer data • Fraudulent changes • Loss of service trust	• Role-based access controls (RBAC) • Data integrity monitoring • Audit trail verification • Periodic privileged access review
1.4	Embedded Banking Integration	• Fintech/API partner outage • API gateway compromise • Data leakage via third-party integration • SLA breach	• Service disruption across ecosystem • Third-party concentration risk • Customer transaction failures	• Third-party risk assessments • API throttling & monitoring • SLA performance dashboard • Exit strategy & substitution planning
1.5	Security & Fraud Monitoring	• Fraud detection engine failure • AI model drift • SOC alert backlog • Ransomware attack	• Increased fraud losses • Delayed detection • Customer financial harm	• Continuous fraud model validation • 24/7 SOC coverage • Threat intelligence integration • Tabletop cyber incident exercises
1.6	Password & PIN Reset / Recovery	• OTP gateway outage • SIM swap fraud • Social engineering attack • Bulk reset exploitation attempt	• Unauthorized access • Account takeover • Customer lockout	• Multi-channel OTP redundancy • Behavioural analytics • SIM swap detection control • Customer awareness campaigns
1.7	Device & Session Management	• Session hijacking • Malware-infected device login • Concurrent session abuse • Mobile app certificate failure	• Data compromise • Fraudulent transactions • System instability	• Device fingerprinting • Automatic session timeout • Secure mobile SDK controls • App penetration testing
1.8	Alerts & Notification Services	• SMS/email notification service outage • Delayed fraud alerts • Notification spoofing attack	• Customers unaware of fraud • Escalation of losses • Reputational damage	• Multi-channel notification redundancy • Alert delivery monitoring • Secure message signing • Regular failover testing
1.9	Regulatory Compliance & Logging	• Log management system failure • Incomplete audit trail • Data retention breach • Regulator request during outage	• Inability to evidence compliance • Regulatory penalties • Legal exposure	• Centralised SIEM solution • Immutable log storage • Periodic compliance audits • Regulatory response playbook
1.10	Service Availability & Continuity Management	• Core banking cloud region outage • Cyber attack causing prolonged downtime • Data centre failure • Pandemic-level staff unavailability	• Prolonged service unavailability • Breach of impact tolerance • Customer attrition	• Active-active cloud architecture • Disaster Recovery (DR) testing • RTO/RPO validation • Business Continuity Plan (BCP) exercises

Integration of Cyber and ICT Risks

Across all Sub-CBS components, scenario testing integrates:

Cyber Risks: DDoS, ransomware, credential stuffing, API compromise, insider threats, fraud attacks.
ICT Risks: Cloud outages, system misconfiguration, database corruption, third-party ICT provider failure, infrastructure capacity overload.
Third-Party Risks: Fintech partners, telecom providers (OTP/SMS), cloud service providers, identity verification vendors.
Data Risks: Data integrity, confidentiality, and availability failures.

This integrated approach ensures that Boost Bank tests operational resilience beyond isolated IT failures and instead evaluates end-to-end service continuity under severe but plausible disruptions.

Banner [Summing] [OR] [E3] Perform Scenario Testing

Performing scenario testing for CBS-1 Digital Account Access & Management enables Boost Bank to validate its ability to remain within defined impact tolerances during severe disruptions.

By integrating cyber threats, ICT failures, third-party risks, and fraud scenarios into structured testing, the bank moves beyond theoretical risk assessments and demonstrates measurable resilience capability.

Evidence of proactive risk management — such as redundancy design, continuous monitoring, incident response playbooks, regular penetration testing, disaster recovery exercises, and third-party oversight — provides assurance to regulators, customers, and stakeholders that Boost Bank is not only compliant but operationally resilient.

Scenario testing must therefore be conducted regularly, lessons learned must be documented, and improvement actions must be tracked to closure to ensure CBS-1 remains robust, secure, and customer-centric in an evolving digital threat landscape.

Digital Banking Resilience: Strengthening Boost Bank for Tomorrow
eBook 3: Starting Your OR Implementation
CBS-1 Digital Account Access & Management
CBS-1 DP	CBS-1 MD	CBS-1 MPR	CBS-1 ITo	CBS-1 SuPS	CBS-1 ST

For organisations looking to accelerate their journey, BCM Institute’s training and certification programs, including the OR-5000 Operational Resilience Expert Implementer course, provide in-depth insights and practical toolkits for effectively embedding this model.

More Information About OR-5000 [OR-5] or OR-300 [OR-3]

To learn more about the course and schedule, click the buttons below for the OR-300 Operational Resilience Implementer course and the OR-5000 Operational Resilience Expert Implementer course.