--- title: [OR] [BB] [E3] [CBS] [1] [SuPS] Identify Severe but Plausible Scenarios description: [OR] [BB] [E3] [CBS] [2] [SuPS] Identify Severe but Plausible Scenarios image: https://blog.bcm-institute.org/hubfs/Boost%20Bank%20Graphic%20Folder/Boost%20Bank%20CBS%201%20Morepost/%5BOR%5D%20%5BVV%5D%20%5BE3%5D%20%5BCBS%5D%20%5B1%5D%20%5BSuPS%5D%20Digital%20Account%20Access%20%26%20Management.jpg --- . . [![BCMIWhiteLogo.png](https://blog.bcm-institute.org/hs-fs/hubfs/Blog%20Testing/BCMIWhiteLogo.png?width=556&name=BCMIWhiteLogo.png "BCMIWhiteLogo.png")](http://www.bcm-institute.org/) - [Home](https://www.bcm-institute.org/) - [About Us](https://www.bcm-institute.org/about-us-3/) - [A President’s Perspective](https://www.bcm-institute.org/about-us/a-presidents-perspective/) - [Our History](https://www.bcm-institute.org/about-us/our-history/) - [Our Advisory Council](https://www.bcm-institute.org/about-us/our-advisory-council/) - [Customers’ Testimonials](https://www.bcm-institute.org/about-us/customers-testimonials/) - [Credential Verification](https://www.bcm-institute.org/about-us/credential-verification/) - [Courses](https://blog.bcm-institute.org/blog/course-fees-for-blended-learning-courses-master-catalog) - [ISO 22301 Business Continuity Management System Audit](https://blog.bcm-institute.org/audit/business-continuity-management-audit-courses) - [ISO 22301 Business Continuity Management](https://blog.bcm-institute.org/bcm/business-continuity-management-courses) - [Crisis Communication](https://blog.bcm-institute.org/crisis-communication/crisis-communication-courses) - [Crisis Management](https://blog.bcm-institute.org/en/crisis-management/courses) - [IT Disaster Recovery](https://blog.bcm-institute.org/it-disaster-recovery/courses) - [Operational Resilience](https://blog.bcm-institute.org/operational-resilience/courses) - [Operational Resilience Audit](https://blog.bcm-institute.org/operational-resilience-audit/courses) - [Certification](https://blog.bcm-institute.org/certification/types-of-certifications-offered) - [ISO 22301 BCMS Audit Certification](https://blog.bcm-institute.org/certification/business-continuity-management-audit-certification) - [ISO22301 Business Continuity Management Certification](https://blog.bcm-institute.org/bcm/business-continuity-management-certification) - [Crisis Communication Certification](https://blog.bcm-institute.org/crisis-communication/crisis-communication-certification) - [Crisis Management Certification](https://blog.bcm-institute.org/en/crisis-management/crisis-management-certification) - [IT Disaster Recovery Planning Certification](https://blog.bcm-institute.org/it-disaster-recovery/it-disaster-recovery-certification) - [Operational Resilience Certification](https://blog.bcm-institute.org/operational-resilience/operational-resilience-certification) - [Operational Resilience Audit Certification](https://blog.bcm-institute.org/operational-resilience-audit) - [Seminars](https://blog.bcm-institute.org/meet-the-expert/mte-webinar-mainpage) - [Store](https://www.bcm-institute.org/store-2/) - [Contact Us](http://www.bcm-institute.org/about-us/contact-us/) - - ###### Digital Banking Resilience: Strengthening Boost Bank for Tomorrow ![OR BB FI MY Gen-8](https://blog.bcm-institute.org/hs-fs/hubfs/BB%20BCM%20%5BAi%20Gen%20Blog%20Photo%5D/OR%20BB%20Bank%20Generic/OR%20BB%20FI%20MY%20Gen-8.jpg?width=2000&height=1333&name=OR%20BB%20FI%20MY%20Gen-8.jpg "OR BB FI MY Gen-8") # \[OR\] \[BB\] \[E3\] \[CBS\] \[1\] \[SuPS\] Identify Severe but Plausible Scenarios [![MLRE Logo](https://no-cache.hubspot.com/cta/default/3893111/06d3cad6-2d53-4731-94d7-755adcbdd6b4.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/06d3cad6-2d53-4731-94d7-755adcbdd6b4) Operational Resilience requires organisations such as **Boost Bank** to identify and prepare for **Severe but Plausible (SbP) Scenarios** — events that are extreme in impact yet realistic enough to occur, as described in the BCM Institute blog “\[OR\] \[P2-S4\] \[1\] What is Severe but Plausible Scenarios in Operational Resilience.”   For **CBS-1 Digital Account Access & Management**, the focus is on ensuring that customers can securely onboard, authenticate, access, and manage their digital banking services without unacceptable disruption. The SbP scenarios below integrate **Cyber and ICT risks**, recognising that digital banking services are highly dependent on secure applications, cloud infrastructure, third-party integrations, and regulatory compliance systems. ### [![New call-to-action](https://no-cache.hubspot.com/cta/default/3893111/c9c3fddf-009e-4d50-b91c-b18d1228e9ef.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/c9c3fddf-009e-4d50-b91c-b18d1228e9ef) [Moh Heng Goh](https://blog.bcm-institute.org/ebook-or/author/moh-heng-goh) Mar 6, 2026 ###### Operational Resilience Certified Planner-Specialist-Expert ###### [![\[OR\] \[BB\] Legal Disclaimer Banner](https://no-cache.hubspot.com/cta/default/3893111/bbedab3d-a991-4956-b3f1-f5d4aa873c6e.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/bbedab3d-a991-4956-b3f1-f5d4aa873c6e) ### [![New call-to-action](https://no-cache.hubspot.com/cta/default/3893111/c9c3fddf-009e-4d50-b91c-b18d1228e9ef.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/c9c3fddf-009e-4d50-b91c-b18d1228e9ef) ### **CBS-1 Digital Account Access & Management** #### Introduction Operational Resilience requires organisations such as **Boost Bank** to identify and prepare for **Severe but Plausible (SbP) Scenarios** — events that are extreme in impact yet realistic enough to occur, as described in the BCM Institute blog “\[OR\] \[P2-S4\] \[1\] What is Severe but Plausible Scenarios in Operational[![New call-to-action](https://no-cache.hubspot.com/cta/default/3893111/1203ab63-4424-4d5d-8fec-b651fc3b5c57.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/1203ab63-4424-4d5d-8fec-b651fc3b5c57)  Resilience.” For **CBS-1 Digital Account Access & Management**, the focus is on ensuring that customers can securely onboard, authenticate, access, and manage their digital banking services without unacceptable disruption. The SbP scenarios below integrate **Cyber and ICT risks**, recognising that digital banking services are highly dependent on secure applications, cloud infrastructure, third-party integrations, and regulatory compliance systems. [![Banner \[Table\] \[OR\] \[E3\] Identify Severe but Plausible Scenarios](https://no-cache.hubspot.com/cta/default/3893111/f4f3c007-e864-48cd-8bc1-0242c8b7fd86.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/f4f3c007-e864-48cd-8bc1-0242c8b7fd86) ###### Table P5: Identify Severe but Plausible Scenarios for CBS-1   | **Sub-CBS Code** | **Sub-CBS** | **Severe but Plausible Scenario** | **Impact / Effect** | **Proactive Risk Management Action (Evidence of Preparedness)** | **Link to Integration of Cyber and ICT Risks** | | --- | --- | --- | --- | --- | --- | | 1.1 | Account Onboarding & Registration | Large-scale outage of digital onboarding platform due to cloud misconfiguration or DDoS attack during peak campaign | New customers unable to register; revenue loss; reputational damage; regulatory scrutiny | Multi-region cloud deployment; DDoS protection; onboarding failover environment; periodic stress testing; onboarding surge capacity testing | Cyber: DDoS, API exploitation. ICT: Cloud configuration failure, capacity overload | | 1.2 | Authentication & Access Control | Credential stuffing attack exploiting compromised credentials from external breach | Mass account lockouts; unauthorised access; customer panic | MFA enforcement; behavioural analytics; bot mitigation; credential monitoring; regular penetration testing | Cyber: Identity attacks, brute force. ICT: IAM system resilience | | 1.3 | Profile & Account Maintenance | Core banking API failure corrupts customer profile updates | Incorrect customer data; transaction errors; compliance breaches | API validation controls; automated reconciliation; rollback mechanisms; change management controls | Cyber: API tampering. ICT: Integration failure, database corruption | | 1.4 | Embedded Banking Integration | Third-party fintech partner API compromised, leading to data leakage | Exposure of customer data; regulatory penalties; loss of partner trust | Third-party risk assessments; secure API gateway; continuous monitoring; contractual security clauses | Cyber: Supply chain attack. ICT: Third-party system dependency | | 1.5 | Security & Fraud Monitoring | Fraud monitoring system outage due to SIEM platform failure | Undetected fraudulent transactions; financial loss | Redundant fraud detection engines; manual fraud review fallback; real-time monitoring dashboards; scenario testing | Cyber: Advanced persistent threat. ICT: Monitoring infrastructure failure | | 1.6 | Password & PIN Reset / Recovery | Social engineering campaign exploiting weak identity verification in reset process | Account takeover surge; customer complaints | Strong identity verification (biometric / liveness checks); rate limiting; staff awareness training; red-team simulation | Cyber: Social engineering, phishing. ICT: Weak reset workflow controls | | 1.7 | Device & Session Management | Malware bypasses device binding controls allowing session hijacking | Fraudulent transactions; data compromise | Device fingerprinting; session timeout controls; encryption; anomaly detection; endpoint integrity checks | Cyber: Malware, session hijacking. ICT: Session management vulnerabilities | | 1.8 | Alerts & Notification Services | SMS gateway provider outage or compromise | Customers not alerted to suspicious transactions; delayed fraud detection | Multi-channel notification (push, email, SMS); dual vendor redundancy; notification monitoring; failover testing | Cyber: Telecom provider compromise. ICT: Messaging infrastructure outage | | 1.9 | Regulatory Compliance & Logging | Log management system corrupted by ransomware attack | Loss of audit trail; inability to demonstrate compliance; regulatory sanctions | Immutable logging; off-site log backup; SOC monitoring; ransomware playbooks; regular restoration tests | Cyber: Ransomware. ICT: Log server failure | | 1.10 | Service Availability & Continuity Management | Major cloud region outage affecting digital banking platform | Complete digital access disruption; systemic customer impact | Active-active architecture; disaster recovery drills; RTO/RPO defined; crisis communication plan | Cyber: Cloud provider targeted attack. ICT: Infrastructure region failure |   [![Banner \[Summing\] \[OR\] \[E3\] Identify Severe but Plausible Scenarios](https://no-cache.hubspot.com/cta/default/3893111/446ccb83-e056-40d0-aae5-834d73c13f43.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/446ccb83-e056-40d0-aae5-834d73c13f43) Identifying Severe but Plausible Scenarios for **CBS-1 Digital Account Access & Management** enables Boost Bank to anticipate high-impact disruptions arising from cyber threats, ICT failures, third-party dependencies, and operational weaknesses. By integrating Cyber and ICT risk considerations into each sub-process — from onboarding to service continuity — the bank strengthens its operational resilience posture. The proactive risk management actions outlined above provide demonstrable evidence that Boost Bank is not merely reactive, but actively stress-testing, monitoring, and improving its digital banking ecosystem to remain within defined impact tolerances under extreme but realistic conditions. This structured approach ensures customer trust, regulatory compliance, and sustainable digital banking service delivery even under severe disruption scenarios.   | Digital Banking Resilience: Strengthening Boost Bank for Tomorrow | | | | | | | --- | --- | --- | --- | --- | --- | | **eBook 3: Starting Your OR Implementation** | | | | | | | **CBS-1 Digital Account Access & Management** | | | | | | | **CBS-1 DP** | **CBS-1 MD** | **CBS-1 MPR** | **CBS-1 ITo** | **CBS-1 SuPS** | **CBS-1 ST** | | [![New call-to-action](https://no-cache.hubspot.com/cta/default/3893111/44edfd24-234a-4f2c-9314-879d2a167b8c.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/44edfd24-234a-4f2c-9314-879d2a167b8c) | [![New call-to-action](https://no-cache.hubspot.com/cta/default/3893111/2b6f9c2d-e2c4-404e-a76c-9fa34415bd92.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/2b6f9c2d-e2c4-404e-a76c-9fa34415bd92) | [![New call-to-action](https://no-cache.hubspot.com/cta/default/3893111/6c30f467-27a8-4fce-a99c-6d4bb52861e8.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/6c30f467-27a8-4fce-a99c-6d4bb52861e8) | [![New call-to-action](https://no-cache.hubspot.com/cta/default/3893111/dbff189c-39f6-48cf-bda7-04acccdbd9f1.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/dbff189c-39f6-48cf-bda7-04acccdbd9f1) | [![New call-to-action](https://no-cache.hubspot.com/cta/default/3893111/1203ab63-4424-4d5d-8fec-b651fc3b5c57.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/1203ab63-4424-4d5d-8fec-b651fc3b5c57) | [![New call-to-action](https://no-cache.hubspot.com/cta/default/3893111/da3cfb81-260f-489f-b6d9-e89f2626bb4e.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/da3cfb81-260f-489f-b6d9-e89f2626bb4e) | **[![New call-to-action](https://no-cache.hubspot.com/cta/default/3893111/084e620a-46c5-419a-82ed-6a681d15c0b6.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/084e620a-46c5-419a-82ed-6a681d15c0b6)[![New call-to-action](https://no-cache.hubspot.com/cta/default/3893111/13a448f1-f09c-42da-a57e-0988e41658c5.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/13a448f1-f09c-42da-a57e-0988e41658c5)** For organisations looking to accelerate their journey, BCM Institute’s training and certification programs, including the **OR-5000 Operational Resilience Expert Implementer course**, provide in-depth insights and practical toolkits for effectively embedding this model.   #### More Information About OR-5000 \[OR-5\] or OR-300 \[OR-3\] To learn more about the course and schedule, click the buttons below for the OR-300 Operational Resilience Implementer course and the OR-5000 Operational Resilience Expert Implementer course. | [![BL-OR-3 Register Now](https://no-cache.hubspot.com/cta/default/3893111/3530eccb-515d-401e-afc2-3469e26d7fbf.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/3530eccb-515d-401e-afc2-3469e26d7fbf) | [![BL-OR-3_Tell Me More](https://no-cache.hubspot.com/cta/default/3893111/fdd4fa9c-ed69-40c1-925f-4eb6a1c5c255.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/fdd4fa9c-ed69-40c1-925f-4eb6a1c5c255) | [![BL-OR-3_View Schedule](https://no-cache.hubspot.com/cta/default/3893111/77a34b84-0a6d-44f8-b8d6-6ab04cdf5edd.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/77a34b84-0a6d-44f8-b8d6-6ab04cdf5edd) | | --- | --- | --- | | [![BL-OR-5_Register Now](https://no-cache.hubspot.com/cta/default/3893111/6e5c0cda-39b9-4bbd-b3d4-4cf46a790b14.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/6e5c0cda-39b9-4bbd-b3d4-4cf46a790b14) | [![BL-OR-5_Tell Me More](https://no-cache.hubspot.com/cta/default/3893111/a68a08aa-36d3-4216-9551-202c9fde06ea.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/a68a08aa-36d3-4216-9551-202c9fde06ea) | [![ \[BL-OR\] \[3-4-5\] View Schedule](https://no-cache.hubspot.com/cta/default/3893111/d0d733a1-16c0-4b68-a26d-adbfd4fc6069.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/d0d733a1-16c0-4b68-a26d-adbfd4fc6069) | | [![\[BL-OR\] \[3\] FAQ OR-300](https://no-cache.hubspot.com/cta/default/3893111/f20c71b4-f5e8-4aa5-8056-c374ca33a091.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/f20c71b4-f5e8-4aa5-8056-c374ca33a091) | If you have any questions, click to contact us.[![Email to Sales Team \[BCM Institute\]](https://no-cache.hubspot.com/cta/default/3893111/3c53daeb-2836-4843-b0e0-645baee2ab9e.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/3c53daeb-2836-4843-b0e0-645baee2ab9e) | [![FAQ BL-OR-5 OR-5000](https://no-cache.hubspot.com/cta/default/3893111/7f2718a4-ea80-4f84-a319-dc2d4df37a46.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/7f2718a4-ea80-4f84-a319-dc2d4df37a46) | | [![OR Implementer Landing Page](https://no-cache.hubspot.com/cta/default/3893111/74b1e556-8cd2-4a74-8821-db1804534955.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/74b1e556-8cd2-4a74-8821-db1804534955) | [![New call-to-action](https://no-cache.hubspot.com/cta/default/3893111/f2bd8eb1-32d2-4732-9267-ea53223cf58f.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/f2bd8eb1-32d2-4732-9267-ea53223cf58f) | [![New call-to-action](https://no-cache.hubspot.com/cta/default/3893111/084e620a-46c5-419a-82ed-6a681d15c0b6.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/084e620a-46c5-419a-82ed-6a681d15c0b6) |   #### **Comments:**   ![CTA Banner_OR](https://blog.bcm-institute.org/hubfs/CTA%20Banner%20for%20Blog/CTA%20Banner_OR.jpg "CTA Banner_OR") --- ![CTA Banner_ORA](https://blog.bcm-institute.org/hubfs/CTA%20Banner%20for%20Blog/CTA%20Banner_ORA.jpg "CTA Banner_ORA") --- ![CTA Banner_BCM](https://blog.bcm-institute.org/hubfs/CTA%20Banner%20for%20Blog/CTA%20Banner_BCM.jpg "CTA Banner_BCM") --- ![CTA Banner_ITDR](https://blog.bcm-institute.org/hubfs/CTA%20Banner%20for%20Blog/CTA%20Banner_ITDR.jpg "CTA Banner_ITDR") --- ![CTA Banner_CM](https://blog.bcm-institute.org/hubfs/CTA%20Banner%20for%20Blog/CTA%20Banner_CM.jpg "CTA Banner_CM") ![BCMIWhiteLogoSmall.png](https://blog.bcm-institute.org/hs-fs/hubfs/Blog%20Testing/BCMIWhiteLogoSmall.png?width=72&name=BCMIWhiteLogoSmall.png "BCMIWhiteLogoSmall.png") All rights reserved. Copyright 2026 ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Moh Heng Goh", "url" : "https://blog.bcm-institute.org/ebook-or/author/moh-heng-goh" }, "dateModified" : "2026-03-06T07:55:31.278Z", "datePublished" : "2026-03-06T07:22:02.000Z", "headline" : "[OR] [BB] [E3] [CBS] [1] [SuPS] Identify Severe but Plausible Scenarios", "mainEntityOfPage" : { "@id" : "https://blog.bcm-institute.org/ebook-or/or-bb-e3-cbs-2-sups-identify-severe-but-plausible-scenarios", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://blog.bcm-institute.org/hubfs/BCMI%20Logo.png" }, "name" : "BCMI Pte Ltd" } } ```