[OR] [BDCB] [E3] [CBS] [1] [ITo] Establish Impact Tolerances

Level

Assessment meaning

Very Low

Minor internal disruption with no material effect on participants, settlement completion, data integrity, regulatory obligations, or financial markets.

Low

Limited and short-lived service degradation affecting a small number of transactions or participants, with effective workarounds and no material financial harm.

Medium

Noticeable disruption affecting multiple participants or processing cycles, requiring management intervention but remaining recoverable without significant market or regulatory consequences.

High

Material disruption causing delayed settlement, liquidity pressure, widespread participant impact, regulatory concern, or substantial operational and financial consequences.

Very High

Severe or potentially systemic disruption involving loss of settlement availability or finality, widespread inability to transfer funds, material data-integrity failure, significant regulatory breach, or possible financial-stability consequences.

Sub-CBS Code

Name of Sub-CBS

Potential Disruption

Potential Harm

Level of Harm

Key Harm Indicators

CBS-1.1

Payment Participant Management

Participant records, access entitlements, settlement-account associations, or onboarding approvals become unavailable, inaccurate, or corrupted. New or amended participant access cannot be completed, or an unauthorised entity is incorrectly enabled.

Legitimate participants may be unable to submit transactions, while incorrect access could expose the payment infrastructure to fraud, unauthorised activity, confidentiality breaches, or settlement risk. The harm becomes more severe when the disruption affects an existing participant during an operational day rather than only delaying a non-urgent onboarding request.

High where existing participant access is affected or control integrity is compromised; Medium for short delays to planned onboarding.

Number and systemic importance of participants affected; duration of access failure; number of rejected instructions; unauthorised access events; participant-record discrepancies; onboarding backlog; unresolved entitlement exceptions; regulatory or security breaches.

CBS-1.2

Payment Instruction Submission

Participants cannot transmit payment instructions, or instructions are delayed, duplicated, lost, incompletely received, or submitted through degraded channels.

Payment obligations cannot enter the settlement chain. Participants may be unable to complete high-value, time-critical, government, interbank, or customer-related payments. Transaction backlogs and liquidity demands could accumulate rapidly near settlement cut-off times.

Very High when the primary and alternate submission channels are unavailable across multiple participants; High for material partial degradation.

Duration of submission-channel outage; percentage and number of participants unable to submit; value and volume of delayed instructions; queue growth; missed cut-off times; geographic or channel coverage; number of duplicate or lost messages.

CBS-1.3

Transaction Validation and Authentication

Authentication, message-integrity verification, format validation, sanctions-related controls, or authorisation checks fail or produce unreliable results.

Legitimate transactions may be rejected or delayed, while fraudulent, duplicated, malformed, or unauthorised instructions may proceed. A failure of control integrity could undermine trust in the settlement process and require suspension of processing until the validity of transactions can be established.

Very High where transaction authenticity or integrity cannot be trusted; High where processing is halted safely but materially delayed.

Authentication failure rate; validation-error rate; number and value of quarantined transactions; unauthorised instructions; integrity alerts; false rejection rate; duration of control unavailability; number of participants affected.

CBS-1.4

Liquidity and Funds Availability Management

Current settlement balances, intraday liquidity positions, collateral information, queue positions, or funds-availability calculations become unavailable or inaccurate.

Participants may be unable to settle obligations despite holding adequate funds, or payments may be processed without reliable evidence of sufficient liquidity. This can create gridlock, liquidity stress, settlement delays, and contagion across connected institutions.

Very High where liquidity positions cannot be trusted or widespread gridlock develops; High for contained delays affecting a limited group.

Value and volume of queued payments; number of participants with constrained liquidity; duration of liquidity-information unavailability; collateral discrepancies; rejected payments; intraday credit exposure; extent of settlement gridlock.

CBS-1.5

Payment Processing and Routing

The central processing function cannot prioritise, queue, route, sequence, or direct validated transactions to the appropriate settlement mechanism. Transactions may be misrouted, duplicated, omitted, or processed out of sequence.

A failure at this concentration point can interrupt both real-time and net settlement streams. It may produce widespread processing delays, inaccurate settlement outcomes, missed deadlines, and uncertainty about transaction status.

Very High because this process is a central orchestration point for the end-to-end service.

Percentage of payment flows affected; transaction backlog; value and volume not routed; processing latency; duplication or omission rate; number of settlement streams affected; duration of processing suspension; cut-off breaches.

CBS-1.6

Real-Time Gross Settlement (RTGS) Processing

High-value or time-critical transactions cannot be settled individually and irrevocably in real time, or settlement records become unreliable.

Banks and other participants may be unable to discharge high-value obligations. Liquidity may become trapped, time-critical payments may fail, and uncertainty regarding settlement finality could create systemic and market-integrity concerns.

Very High due to the potential value, urgency, finality, and interconnected nature of RTGS transactions.

RTGS outage duration; value and number of unsettled payments; number of participants affected; missed time-critical obligations; settlement-finality uncertainty; liquidity trapped; use and capacity of contingency processing; escalation by major participants.

CBS-1.7

Deferred Net Settlement Processing

Net positions cannot be calculated, validated, communicated, funded, or settled at the scheduled settlement cycle. Incorrect netting calculations may also occur.

Retail, clearing, or other deferred-net obligations may remain unsettled. Participants may face unexpected funding requirements, delayed customer credits, reconciliation difficulties, and increased settlement exposure. Incorrect net positions could require rollback, recalculation, or suspension.

High, escalating to Very High if multiple cycles are missed, net positions are materially incorrect, or the disruption affects a systemically important payment stream.

Number of missed settlement cycles; number of affected participants; gross and net values delayed; calculation discrepancies; funding shortfalls; customer transactions delayed; time required to reconstruct positions.

CBS-1.8

Settlement Finalisation and Confirmation

Settlement-account updates, finality records, confirmations, participant notifications, or transaction-status information are unavailable, delayed, duplicated, or inconsistent.

Payments may have been financially settled but participants cannot establish final status. Alternatively, settlement may be incorrectly represented as complete. Uncertainty can cause duplicate payments, reconciliation breaks, liquidity mismanagement, disputes, and loss of confidence.

Very High where settlement finality or ledger integrity is uncertain; High where finality remains intact but confirmations are materially delayed.

Confirmation latency; number and value of transactions with uncertain status; account-to-transaction reconciliation breaks; duplicate resubmissions; participant enquiries; inconsistent settlement records; duration of ledger unavailability.

CBS-1.9

Exception and Failed Transaction Management

Failed, rejected, duplicated, delayed, or disputed transactions cannot be identified, investigated, prioritised, or resolved within required operational windows.

Unresolved exceptions can accumulate and conceal broader processing failures. Participants may experience prolonged uncertainty, financial loss, missed obligations, or incorrect balances. A backlog may also impair the following settlement cycle.

High where exceptions affect high-value transactions or create widespread uncertainty; Medium for small, contained backlogs with effective controls.

Exception backlog; age of unresolved cases; value of affected payments; number of participants affected; repeat failures; missed resolution deadlines; number of manual interventions; unresolved reconciliation breaks.

CBS-1.10

Settlement Risk Monitoring and Control

Real-time visibility of queues, exposures, liquidity conditions, processing anomalies, capacity, operational performance, or systemic indicators is lost or degraded.

BDCB may be unable to identify emerging gridlock, abnormal participant behaviour, processing deterioration, fraud indicators, or systemic stress. The underlying payment service may continue temporarily, but risk can accumulate undetected until harm becomes severe.

High, escalating to Very High if transaction processing continues without adequate control visibility during volatile or stressed conditions.

Duration of monitoring blind spot; number of unavailable risk indicators; unmonitored transaction value; undetected queue growth; threshold breaches; alert latency; manual monitoring coverage; time to identify material anomalies.

CBS-1.11

Payment System Oversight and Compliance Monitoring

Participant compliance information, rule-adherence monitoring, supervisory data, breach reporting, or oversight analysis becomes unavailable or unreliable.

Weak oversight may allow persistent control breaches, unsafe participant practices, unresolved operational weaknesses, or non-compliance to continue. Immediate transaction processing may remain available, but risk to system integrity and regulatory accountability increases over time.

High for prolonged or material oversight failure; Medium for short disruption where operational controls and records remain complete.

Number and severity of unreviewed breaches; overdue compliance submissions; period without oversight monitoring; affected participants; unresolved supervisory findings; reporting deadlines missed; material control exceptions.

CBS-1.12

Operational Incident and Service Disruption Management

Incidents are not detected, classified, escalated, coordinated, communicated, or contained promptly. Command arrangements or technical and business response teams cannot operate effectively.

A manageable technology or operational event may develop into a prolonged service outage. Delayed decisions, inconsistent communications, unclear accountability, and failed hand-offs can increase participant harm and cause the overall service to exceed its Impact Tolerance.

Very High where response failure extends a material disruption or prevents timely containment.

Time to detect, declare, escalate, and mobilise; time to appoint incident leadership; decision latency; number of unresolved critical actions; stakeholder-notification delays; containment time; conflicting communications; duration added to the outage.

CBS-1.13

Business Continuity and Service Recovery

Alternate processing, disaster recovery, data restoration, workforce relocation, backup communications, manual contingency arrangements, or service-restoration procedures fail or cannot be activated.

BDCB may be unable to restore payment and settlement services before unacceptable harm arises. Data may be unavailable or inconsistent, participant backlogs may grow, and the disruption may continue beyond settlement windows or into subsequent business days.

Very High, as this process is the final control against an extended Impact Tolerance breach.

Actual recovery time; recovery-point gap; percentage of service restored; backlog-clearing time; failed recovery steps; data-reconciliation differences; alternate-site capacity; number of unavailable critical roles; duration beyond defined tolerance.

CBS-1.14

Settlement Reporting and Regulatory Information Management

Settlement records, operational reports, audit trails, participant reports, management information, or regulatory information are delayed, incomplete, or inaccurate.

Senior management and oversight functions may lack reliable information to direct response, understand exposures, demonstrate settlement activity, or comply with statutory and regulatory requirements. Material inaccuracies may undermine confidence in the service.

High where statutory, financial, audit, or settlement records are materially affected; Medium for short reporting delays with complete underlying data.

Reports delayed; data completeness and accuracy rates; unresolved reporting exceptions; number of statutory deadlines missed; audit-trail gaps; management-information latency; number of participant reports affected.

CBS-1.15

Post-Settlement Review and Continuous Improvement and Decision Support

Performance analysis, lessons learned, trend identification, root-cause analysis, risk acceptance, remediation prioritisation, or management decision support is incomplete or unavailable.

Immediate settlement may continue, but recurring weaknesses may remain untreated. Over time, unresolved vulnerabilities can increase the likelihood that future cyber, ICT, liquidity, operational, or third-party incidents will breach the Impact Tolerance.

Medium for an isolated delay; High where persistent failure prevents correction of known material weaknesses.

Overdue post-incident reviews; repeat incidents; aged remediation actions; number of unaccepted residual risks; incomplete root-cause analyses; overdue management decisions; control-test failures not remediated.

Sub-CBS Code

Name of Sub-CBS

Cyber and ICT Risk Linkage

Contribution to Impact Tolerance Breach

Proactive Risk Management Action

Evidence of Proactive Risk Management

CBS-1.1

Payment Participant Management

Compromise of identity and access management; privileged-access abuse; unauthorised amendment of participant records; database corruption; interface failure between participant administration and payment platforms; failed access-control changes.

Incorrect access configuration could exclude legitimate participants or permit unauthorised payment activity. A widespread entitlement failure could prevent instruction submission and quickly affect end-to-end availability and integrity.

Apply least privilege, segregation of duties, multifactor authentication, privileged-access monitoring, dual approval for critical entitlement changes, periodic access recertification, immutable audit logging, and tested restoration of participant records.

Approved access-control risk assessment; access-recertification records; privileged-access monitoring reports; penetration-test results; entitlement-change samples; audit-log reviews; participant-record restoration test; remediation records.

CBS-1.2

Payment Instruction Submission

Distributed denial-of-service attack; messaging-gateway outage; API or interface disruption; telecommunications failure; certificate expiry; capacity saturation; malware affecting participant connectivity; third-party network failure.

Loss of primary and alternate channels can prevent payment instructions from entering the service. A transaction backlog close to cut-off can cause widespread payment delay within a short period.

Maintain diverse submission channels, network paths and telecommunications arrangements; implement DDoS protection, capacity monitoring, message persistence, replay controls, alternate connectivity, certificate lifecycle management, and participant contingency procedures.

DDoS simulation results; network-resilience tests; channel failover reports; capacity test results; certificate inventories; participant connectivity-test records; telecommunications-provider assurance; backlog-recovery exercises.

CBS-1.3

Transaction Validation and Authentication

Compromise of cryptographic keys; authentication-service outage; validation-rule corruption; malware; unauthorised code change; time-synchronisation failure; certificate-validation failure; false-positive or false-negative control behaviour.

If authenticity and integrity cannot be established, BDCB may need to suspend processing. Processing unreliable instructions could be more harmful than temporary unavailability and may immediately threaten settlement integrity.

Use hardware-backed key protection where appropriate, dual control for key and rule changes, secure software development, integrity monitoring, time-source redundancy, automated control reconciliation, security-event monitoring, and emergency key-revocation procedures.

Key-management audit; cryptographic-control test results; code-review records; validation-rule change approvals; time-synchronisation monitoring; security monitoring records; penetration tests; emergency revocation exercise results.

CBS-1.4

Liquidity and Funds Availability Management

Settlement-balance database failure; corrupted balance data; unavailable collateral or liquidity feed; delayed replication; application-calculation error; unauthorised account alteration; interface or time-sequencing failure.

Inaccurate liquidity positions can cause inappropriate rejection, uncollateralised exposure, payment gridlock, or suspension of settlement. Harm may propagate across participants as obligations remain unmet.

Reconcile balances across authoritative records; apply transaction and account integrity controls; maintain high-availability databases; use independent reasonableness checks; monitor queue and liquidity thresholds; test restoration and failover; define controlled fallback arrangements.

Daily reconciliation results; database failover tests; integrity-control reports; liquidity stress-test results; threshold-monitoring logs; backup restoration evidence; control exception reports; management review minutes.

CBS-1.5

Payment Processing and Routing

Central application failure; routing-table corruption; failed software release; capacity degradation; database or middleware failure; unauthorised rules amendment; infrastructure concentration; ransomware.

Because this is a concentration point, a single failure can interrupt multiple settlement streams. Misrouting or duplication can also create integrity failures that remain harmful after availability is restored.

Implement resilient architecture, active-active or rapid failover where justified, controlled deployment and rollback, routing-rule dual approval, message deduplication, end-to-end reconciliation, capacity stress testing, network segmentation, and recovery independent of the primary environment.

Architecture resilience review; application failover report; change and rollback test; routing-rule audit; capacity and performance reports; vulnerability assessment; ransomware exercise; reconciliation evidence; independent control review.

CBS-1.6

Real-Time Gross Settlement (RTGS) Processing

RTGS application or database failure; cyberattack; privileged compromise; settlement-ledger corruption; network partition; infrastructure outage; failed technology change; processing-capacity degradation.

Unavailability or uncertainty in the RTGS ledger could stop high-value settlement immediately. The combination of high transaction values, liquidity dependencies and finality requirements means the tolerance may be breached rapidly.

Maintain geographically and technologically resilient settlement capability; protect the settlement ledger; segregate privileged access; implement continuous replication with integrity validation; test failover under peak load; maintain controlled contingency-processing arrangements.

RTGS disaster recovery test; peak-volume failover results; ledger-reconciliation report; privileged-access review; cyber scenario test; infrastructure resilience assessment; recovery-point validation; management acceptance of residual risks.

CBS-1.7

Deferred Net Settlement Processing

Netting-engine failure; corrupted clearing file; duplicate or missing records; interface outage; batch-scheduling failure; time-synchronisation error; failed change; malware affecting clearing inputs.

Failure before a scheduled cycle can prevent calculation or settlement of net obligations. Incorrect output may require suspension and reconstruction, potentially affecting large volumes of underlying transactions.

Validate input completeness; use control totals and independent recalculation; secure file transfers; maintain restartable processing; protect scheduling and time services; test missed-cycle recovery; retain reconstructable transaction records.

Netting reconciliation records; secure-transfer test; batch-restart results; missed-cycle simulation; input control-total reports; data-restoration test; change-control evidence; independent calculation review.

CBS-1.8

Settlement Finalisation and Confirmation

Ledger-write failure; database corruption; delayed replication; notification-platform outage; duplicate messaging; status inconsistency between processing and settlement records; API failure.

Participants may be unable to determine whether payment is final. Uncertainty may prompt duplicate submissions, incorrect liquidity decisions, or disputes, and can become intolerable even where the core engine remains available.

Establish a single authoritative settlement record; implement atomic transaction controls, immutable audit trails, end-to-end reconciliation, duplicate suppression, resilient confirmation channels, defined status-enquiry capability, and tested ledger reconstruction.

Ledger-integrity test; reconciliation reports; notification-channel failover results; duplicate-control testing; status-enquiry exercise; audit-trail review; database restoration and reconstruction evidence.

CBS-1.9

Exception and Failed Transaction Management

Case-management outage; loss of exception queues; incomplete transaction logs; communication-channel failure; cyberattack concealing failed transactions; automation error; access-control failure.

Exceptions may accumulate unnoticed or remain unresolved beyond cut-off. The breach risk rises where high-value or widespread failures cannot be separated from normal processing delays.

Maintain automated and manual exception detection, resilient case records, severity-based prioritisation, complete transaction traceability, alternate participant communications, escalation thresholds, and trained specialist response coverage.

Exception-control testing; case-system recovery test; backlog trend reports; transaction-traceability samples; escalation exercise; staffing and competency records; alternate communication test; ageing reports.

CBS-1.10

Settlement Risk Monitoring and Control

Monitoring-platform outage; telemetry manipulation; alert suppression; security-information and event-management failure; inaccurate dashboards; time-source failure; network visibility loss; data-feed interruption.

BDCB may continue processing without awareness of queue growth, abnormal behaviour, liquidity stress, or cyber compromise. This can delay containment until the service has already exceeded tolerable harm thresholds.

Use independent monitoring paths, data-quality controls, alert-health monitoring, synchronised time sources, automated threshold escalation, manual fallback dashboards, protected logging, and periodic testing of monitoring blind-spot scenarios.

Monitoring-availability reports; alert test results; log-integrity reviews; time-source failover test; dashboard reconciliation; blind-spot scenario exercise; monitoring coverage assessment; incident detection metrics.

CBS-1.11

Payment System Oversight and Compliance Monitoring

Regulatory-reporting platform failure; loss or corruption of participant compliance data; unauthorised modification of findings; analytics failure; inaccessible audit records; cyber compromise of supervisory information.

Prolonged loss of oversight can allow participant and infrastructure weaknesses to persist. It can also impair BDCB’s ability to demonstrate that the payment system is being operated and supervised within established rules.

Protect supervisory records; apply data lineage and validation; maintain independent audit trails; segregate operational and oversight access; establish reporting contingencies; test restoration; track compliance exceptions and overdue actions.

Data-lineage assessment; reporting contingency test; access review; audit-trail inspection; compliance dashboard; restoration test; overdue-finding reports; independent assurance results.

CBS-1.12

Operational Incident and Service Disruption Management

Incident-management platform outage; ransomware affecting collaboration tools; unavailable contact information; failed alerting; telecommunications outage; compromised crisis communications; inaccurate technical telemetry.

Even a recoverable primary failure may breach the tolerance if incident detection, command, escalation, containment, or communication is delayed. The process is a critical hand-off between operations, cybersecurity, ICT recovery and senior management.

Maintain out-of-band communications, current call trees, role-based incident playbooks, integrated cyber and operational command arrangements, alternate incident-recording methods, automated escalation, decision authorities, and regular cross-functional exercises.

Incident response exercise reports; call-tree test; out-of-band communication test; mobilisation metrics; playbook approvals; after-action reports; management committee minutes; action-tracking records.

CBS-1.13

Business Continuity and Service Recovery

Disaster recovery environment unavailable; backup corruption; replication failure; common-mode infrastructure weakness; ransomware spreading to recovery systems; insufficient alternate-site capacity; third-party infrastructure outage.

Failure of recovery capability directly exposes the service to an extended outage beyond its Impact Tolerance. Common-mode failure between primary and recovery environments is a significant concentration risk.

Separate recovery domains; protect immutable backups; validate replication integrity; test cyber recovery and clean-room restoration; ensure adequate processing capacity; diversify critical infrastructure; predefine minimum viable service; conduct end-to-end failover and return-to-primary tests.

Disaster recovery and cyber-recovery reports; backup restoration results; replication validation; alternate-site capacity test; end-to-end failover evidence; third-party assurance; unresolved recovery-risk register; independent review.

CBS-1.14

Settlement Reporting and Regulatory Information Management

Data-warehouse outage; extraction or transformation failure; reporting logic error; data corruption; loss of audit logs; unauthorised report alteration; interface or archival failure.

BDCB may be unable to determine settlement exposure, provide participant reports, support management decisions, or meet regulatory and statutory obligations. Integrity failures may require extensive reconstruction.

Implement governed data lineage, source-to-report reconciliation, access controls, report-version control, immutable audit records, independent validation of critical reports, alternate reporting procedures, and tested archival restoration.

Source-to-report reconciliation; data-quality reports; reporting access review; logic-validation records; audit-log retention evidence; alternate reporting exercise; archival restoration test; regulatory submission controls.

CBS-1.15

Post-Settlement Review and Continuous Improvement and Decision Support

Loss of incident data; analytics-platform failure; incomplete root-cause information; unauthorised alteration of findings; fragmented remediation tracking; inaccessible risk records; poor aggregation of cyber and ICT trends.

Weak analysis and governance do not usually cause an immediate outage, but they allow known vulnerabilities and technology concentration risks to persist, increasing the probability and severity of future tolerance breaches.

Require timely root-cause analysis, integrate cyber and ICT lessons, maintain central remediation tracking, assign accountable owners, monitor ageing and recurrence, escalate overdue high-risk actions, and obtain independent validation of closure.

Approved post-incident reports; root-cause analyses; remediation dashboard; committee minutes; repeat-incident analysis; risk acceptance records; closure validation; independent-review findings.

Dimension

Illustrative tolerance boundary

Maximum disruption duration

No more than two hours of complete unavailability of essential payment-instruction submission, processing, liquidity validation, RTGS settlement, settlement finalisation, or status-confirmation capability during an operating day.

Time-critical operating window

A disruption must not cause BDCB to miss a legally, operationally, or systemically significant settlement cut-off without an approved contingency arrangement that permits obligations to be completed safely.

Essential-service activation

A minimum viable or alternate payment and settlement capability should be activated sufficiently early to remain within the two-hour end-to-end tolerance, allowing time for validation, reconciliation and backlog clearance.

Service degradation

Degraded processing may continue only where transaction authenticity, integrity, sequencing, liquidity controls and finality remain reliable. Processing latency should not exceed 15 minutes for time-critical high-value instructions for a sustained period unless controlled contingency prioritisation is operating.

Participant scope

Complete inability of more than 20% of active participants, or the loss of any participant whose inability to transact could create material systemic or government-service consequences, should trigger immediate senior escalation and contingency action.

Transaction scope

Affected transaction value and volume must remain below levels that could create material liquidity pressure, widespread missed obligations, settlement gridlock, or disruption to connected payment streams. The applicable thresholds should be calibrated from peak-day and stress-period transaction data.

RTGS integrity and finality

Zero tolerance for undetected loss of settlement finality, unauthorised settlement, irreconcilable ledger alteration, or inability to establish the authoritative status of high-value payments.

Data loss

Zero loss of committed settlement records should be the target. Any temporary data inconsistency must be detectable, reconstructable and reconciled before normal processing resumes.

Duplicate or erroneous settlement

No material duplicate, omitted, misrouted or incorrectly valued settlement may remain undetected or unresolved beyond the operating day.

Monitoring coverage

Critical queue, liquidity, settlement, security and integrity monitoring should not be unavailable for more than 15 minutes without an effective independent or manual monitoring arrangement.

Incident mobilisation

A potentially material disruption should be detected, classified and escalated rapidly, with cross-functional incident leadership mobilised within a target of 15 minutes following confirmation of critical service impact.

Regulatory and statutory considerations

The disruption must not prevent BDCB from fulfilling essential legal, statutory, supervisory or financial-market responsibilities, or create a material inability to provide timely notification and accurate information to relevant decision-makers and stakeholders.

Market-integrity boundary

Processing should be suspended or restricted where authenticity, data integrity, liquidity position, transaction sequence or settlement finality cannot be established with sufficient confidence. Availability must not be preserved at the expense of integrity.

Backlog recovery

Critical payment backlogs should be prioritised and cleared within the same operating day or approved extended settlement window without creating uncontrolled liquidity, duplication or reconciliation risk.

Geographic and channel scope

A common-mode failure affecting all primary and alternate processing, communications or recovery channels would represent a likely tolerance breach unless minimum viable service can be established within the two-hour limit.