---
title: [OR] [BNM] [C2] Comparison Between BNM OR Paper with “Plan” Phase (P1) of the BCM Institute’s Operational Resilience Planning Methodology
description: [OR] [BNM] [C2] Comparison Between BNM OR Paper with “Plan” Phase (P1) of the BCM Institute’s Operational Resilience Planning Methodology
image: https://blog.bcm-institute.org/hubfs/OR%20BNM%20Morepost/%5BOR%5D%20%5BBNM%5D%20%5BC2%5D%20Comparison%20with%20BNM%20OR%20Paper%20%5BPlan%20Phase%5D.jpg
---
.
[](http://www.bcm-institute.org/)
- [Home](https://www.bcm-institute.org/)
- [About Us](https://www.bcm-institute.org/about-us-3/)
- [A President’s Perspective](https://www.bcm-institute.org/about-us/a-presidents-perspective/)
- [Our History](https://www.bcm-institute.org/about-us/our-history/)
- [Our Advisory Council](https://www.bcm-institute.org/about-us/our-advisory-council/)
- [Customers’ Testimonials](https://www.bcm-institute.org/about-us/customers-testimonials/)
- [Credential Verification](https://www.bcm-institute.org/about-us/credential-verification/)
- [Courses](https://blog.bcm-institute.org/blog/course-fees-for-blended-learning-courses-master-catalog)
- [ISO 22301 Business Continuity Management System Audit](https://blog.bcm-institute.org/audit/business-continuity-management-audit-courses)
- [ISO 22301 Business Continuity Management](https://blog.bcm-institute.org/bcm/business-continuity-management-courses)
- [Crisis Communication](https://blog.bcm-institute.org/crisis-communication/crisis-communication-courses)
- [Crisis Management](https://blog.bcm-institute.org/en/crisis-management/courses)
- [IT Disaster Recovery](https://blog.bcm-institute.org/it-disaster-recovery/courses)
- [Operational Resilience](https://blog.bcm-institute.org/operational-resilience/courses)
- [Operational Resilience Audit](https://blog.bcm-institute.org/operational-resilience-audit/courses)
- [Certification](https://blog.bcm-institute.org/certification/types-of-certifications-offered)
- [ISO 22301 BCMS Audit Certification](https://blog.bcm-institute.org/certification/business-continuity-management-audit-certification)
- [ISO22301 Business Continuity Management Certification](https://blog.bcm-institute.org/bcm/business-continuity-management-certification)
- [Crisis Communication Certification](https://blog.bcm-institute.org/crisis-communication/crisis-communication-certification)
- [Crisis Management Certification](https://blog.bcm-institute.org/en/crisis-management/crisis-management-certification)
- [IT Disaster Recovery Planning Certification](https://blog.bcm-institute.org/it-disaster-recovery/it-disaster-recovery-certification)
- [Operational Resilience Certification](https://blog.bcm-institute.org/operational-resilience/operational-resilience-certification)
- [Operational Resilience Audit Certification](https://blog.bcm-institute.org/operational-resilience-audit)
- [Seminars](https://blog.bcm-institute.org/meet-the-expert/mte-webinar-mainpage)
- [Store](https://www.bcm-institute.org/store-2/)
- [Contact Us](http://www.bcm-institute.org/about-us/contact-us/)
-
-
###### Comparison with BNM OR Paper with BCM Institute's Operational Resilience Planning Methodology
# \[OR\] \[BNM\] \[C2\] Comparison Between BNM OR Paper with “Plan” Phase (P1) of the BCM Institute’s Operational Resilience Planning Methodology
### 
BNM’s Discussion Paper articulates high-level principles and focus areas to strengthen operational resilience across financial institutions.
It reflects the realities of increased digital reliance, interconnected systems, and reliance on external parties, with the aim of ensuring the continuity of critical services during significant disruptions, such as cyber incidents, system outages, or external shocks.
### [](https://cta-redirect.hubspot.com/cta/redirect/3893111/b5d033a3-bb82-4c7e-8ac5-273df38e1a2b)
Key themes include:
- Need to identify and maintain critical services that, if disrupted, could harm customers or systemic stability.
- Focus on interdependencies, especially third-party and technology relationships.
- Governance and board accountability for resilience outcomes.
- [](https://cta-redirect.hubspot.com/cta/redirect/3893111/99882495-4654-4d10-8cd4-41a72d1ce090)Moving beyond internal recovery metrics toward customer-centric tolerances of disruption.
- Importance of scenario testing across people, process, technology, and ecosystem levels.
This is a detailed comparison between Bank Negara Malaysia’s (BNM) Discussion Paper on Operational Resilience (the regulator’s emerging expectations for financial institutions) and the “Plan” phase of the BCM Institute’s Operational Resilience Planning Methodology (as laid out in the OR-P1 guidance).
[Moh Heng Goh](https://blog.bcm-institute.org/ebook-or/author/moh-heng-goh) Jan 15, 2026
###### Operational Resilience Certified Planner-Specialist-Expert
### [](https://cta-redirect.hubspot.com/cta/redirect/3893111/4711044f-0754-47c7-86ef-22321d1fb52a)
### Chapter 2
### Comparison with Plan Phase \[P1\] of OR Planning Methodology
[](https://cta-redirect.hubspot.com/cta/redirect/3893111/9c143a3c-c106-4a97-b462-99cf81f1c5ff)BNM’s Discussion Paper articulates high-level principles and focus areas to strengthen operational resilience across financial institutions.
It reflects the realities of increased digital reliance, interconnected systems, and reliance on external parties, with the aim of ensuring the continuity of critical services during significant disruptions, such as cyber incidents, system outages, or external shocks.
Key themes include:
- Need to identify and maintain critical services that, if disrupted, could harm customers or systemic stability.
- Focus on interdependencies, especially third-party and technology relationships.
- Governance and Board Accountability for Resilience Outcomes.
- Moving beyond internal recovery metrics toward customer-centric tolerances of disruption.
- Importance of scenario testing across people, process, technology and ecosystem levels.
#### Overview of the BCM Institute’s “Plan” Phase (OR-P1)
[](https://cta-redirect.hubspot.com/cta/redirect/3893111/99882495-4654-4d10-8cd4-41a72d1ce090)The BCM Institute’s Plan phase (the first of three phases in operational resilience planning) establishes the foundational thinking and organisational preparedness necessary before detailed resilience work begins. It comprises five sequential stages:
1. **Assess Capability & Maturity** – Establish current resilience capabilities and gaps.
2. **Analyse Gap** – Identify and prioritise where resilience capabilities require strengthening.
3. **Develop Strategy & Roadmap** – Develop a strategic plan to enhance resilience capabilities, aligned with organisational directives.
4. **Confirm Risk Appetite** – Establish risk appetite and thresholds (KPIs/KRIs) aligned to organisational objectives and resilience outcomes.
5. **Develop & Embed Governance** – Embed operational resilience within governance and decision-making structures.
#### Detailed Comparison: Plan Phase vs. BNM Expectations
| Component | BNM Discussion Paper Expectations | BCM Institute Plan Phase Activities | Comparison/Alignment |
| --- | --- | --- | --- |
| \[P1-S1\] Assess Capability & Maturity | Implied need for institutions to understand the maturity of existing practices vs. resilience outcomes | Assess Capability & Maturity directly establishes a baseline | Both require understanding where you are today before planning forward |
| \[P1-S2\] Analyse Gap | Regulators expect firms to recognise limitations in current practices (e.g., reliance on third parties, outdated recovery assumptions). | Analyse Gap identifies resilience gaps relative to desired outcomes | Both frameworks emphasise gap analysis, though BNM’s is broader and outcome-oriented |
| \[P1-S3\] Develop Strategy & Roadmap | BNM calls for high-level strategic thinking—“identify critical services,” “map interdependencies,” “define tolerances”—though not within a formal strategy roadmap template. | Develop Strategy & Roadmap creates a formal plan with executive approval to enhance resilience | BNM’s principles provide inputs into an operational resilience strategy, but the BCM Institute formalises it into a roadmap tied to capabilities |
| \[P1-S4\] Confirm Risk Appetite | BNM explicitly promotes impact tolerances based on customer-centric outcomes rather than internal metrics. | Confirm Risk Appetite sets organisational risk appetite and related KPIs/KRIs early in planning | Both stress the importance of defining acceptable levels of disruption, though BNM situates it more in terms of service impact |
| \[P1-S5\] Develop & Embed Governance | Strong emphasis on board/senior-management accountability and governance structures. | Develop & Embed Governance integrates resilience into governance and oversight mechanisms | Very close alignment: both require governance structures that support ongoing oversight and accountability |
| External Dependencies / Third Parties \[P2-S2\] | BNM highlights interconnected dependencies (cloud, vendors) as systemic vulnerabilities. | Not explicitly a separate Plan activity, but dependencies will be uncovered in strategy and gap analysis | The BCM Institute plan lays the groundwork, but deeper dependency analysis is part of the later Implementation phase |
| Scenario Planning & Testing \[P2-S5\] | BNM expects scenario testing, including severe but plausible stress testing across functions. | Not part of Plan; builds into the Implement phase | BNM’s testing expectations influence strategy development, but are operationalised later in the methodology |
#### Key Observations
##### Shared Orientation Toward Outcomes
Both BNM’s discussion paper and the BCM Institute’s Plan phase recognise that traditional resilience (recovery times, backups) is insufficient on its own. What matters is maintaining customer-facing critical services within tolerable limits during disruptions.
##### Governance and Accountability Are Central
BNM’s emphasis on board and senior management's responsibility aligns closely with the Plan phase’s requirement to embed governance and secure executive approval for the resilience strategy and risk appetite.
##### Strategic Thinking Is a Foundation
While BNM provides high-level expectations, the BCM Institute’s Plan phase provides a structured process for translating those expectations into executable plans, including maturity assessments, gap analyses, and strategic roadmaps.
##### Risk Appetite vs Impact Tolerances
BCM Institute’s Plan phase begins with the risk appetite, expressed in general terms (KPIs/KRIs).
BNM specifically advocates defining impact tolerances for critical services, thereby pushing organisations toward tolerances based on external impact rather than internal operational metrics.
##### Planning vs Implementation Timing
BNM’s Discussion Paper sets out requirements that span both planning and implementation (e.g., dependency mapping and scenario testing).
In BCM Institute’s model, these deeper analytical and tactical activities (e.g., mapping, testing) are intentionally reserved for the Implement phase (P2), underscoring that Plan is about strategic readiness, not execution.
#### Practical Implications
If an organisation is using the BCM Institute’s Plan phase as its methodological start:
- BNM’s expectations validate the Plan phase’s activities and provide regulatory impetus for organisations to take them seriously.
- The outputs of the Plan phase (maturity baseline, gap analysis, resilience strategy, risk appetite, and governance) will be foundational for meeting BNM’s evolving expectations.
- BNM’s emphasis on impact tolerances and customer-centric tolerances should be embedded in the Plan phase’s strategy and risk appetite formulation, even if the detailed implementation (mapping and testing) occurs later.
- The governance work of the Plan phase should explicitly reference board oversight and accountability mechanisms for operational resilience, as required by BNM.
### [](https://cta-redirect.hubspot.com/cta/redirect/3893111/9f00129b-47f5-4a92-8db4-88b9bc250036)
| Dimension | BNM Discussion Paper | BCM Institute Plan Phase | Alignment |
| --- | --- | --- | --- |
| Direction | High-level principles guiding resilience expectations | Structured planning steps to prepare a resilience programme | Complementary |
| Strategy | Implicit in expectations (identify, tolerate, respond) | Explicit strategy roadmap development | BCM Institute adds structure |
| Risk Appetite | Focuses on service impact tolerances | KPIs/KRIs and risk appetite scoping | Can be harmonised |
| Governance | Strong regulator emphasis | Integral planning stage | Strongly aligned |
| Action | Includes mapping/testing expectations | The planning phase sets the stage, but leaves the action to implement | Sequentially aligned |
##### Note from Author/Speaker
[](https://cta-redirect.hubspot.com/cta/redirect/3893111/21328b6f-b2c7-4b21-9e15-b4da3ad58aa0)[](https://cta-redirect.hubspot.com/cta/redirect/3893111/d9ca3818-14aa-428b-a81d-edda4d191516)Author Comment: This is a detailed comparison between Bank Negara Malaysia’s (BNM) Discussion Paper on Operational Resilience (the regulator’s emerging expectations for financial institutions) and the “Plan” phase of the BCM Institute’s Operational Resilience Planning Methodology (as laid out in the OR-P1 guidance).
| ###### Comparison with BNM OR Paper with BCM Institute's Operational Resilience Planning Methodology | | | | |
| --- | --- | --- | --- | --- |
| **C1** | **C2** | **C3** | **C4** | **C5** |
| [](https://cta-redirect.hubspot.com/cta/redirect/3893111/2726ae74-56b9-4cb7-9255-428edd7e2847) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/9c143a3c-c106-4a97-b462-99cf81f1c5ff) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/77b70a13-3440-473d-9aa8-4fd79b89226d) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/5d29733b-d9be-4527-8e7b-24041f1e99dc) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/13cb1435-674a-42ed-8386-4be7d289f431) |
[](https://cta-redirect.hubspot.com/cta/redirect/3893111/084e620a-46c5-419a-82ed-6a681d15c0b6)[](https://cta-redirect.hubspot.com/cta/redirect/3893111/13a448f1-f09c-42da-a57e-0988e41658c5)Gain Competency: For organisations looking to accelerate their journey, BCM Institute’s training and certification programs, including the OR-5000 Operational Resilience Expert Implementer course, provide in-depth insights and practical toolkits for effectively embedding this model.
---
#### More Information About Operational Resilience Course OR-5000 \[OR-5\] or OR-300 \[OR-3\]
To learn more about the course and schedule, click the buttons below for the OR-300 Operational Resilience Implementer \[OR-3\] course and the OR-5000 Operational Resilience Expert Implementer \[OR-5\] course.
| [](https://cta-redirect.hubspot.com/cta/redirect/3893111/3530eccb-515d-401e-afc2-3469e26d7fbf) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/fdd4fa9c-ed69-40c1-925f-4eb6a1c5c255) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/77a34b84-0a6d-44f8-b8d6-6ab04cdf5edd) |
| --- | --- | --- |
| [](https://cta-redirect.hubspot.com/cta/redirect/3893111/6e5c0cda-39b9-4bbd-b3d4-4cf46a790b14) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/a68a08aa-36d3-4216-9551-202c9fde06ea) | [![ \[BL-OR\] \[3-4-5\] View Schedule](https://no-cache.hubspot.com/cta/default/3893111/d0d733a1-16c0-4b68-a26d-adbfd4fc6069.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/d0d733a1-16c0-4b68-a26d-adbfd4fc6069) |
| [![\[BL-OR\] \[3\] FAQ OR-300](https://no-cache.hubspot.com/cta/default/3893111/f20c71b4-f5e8-4aa5-8056-c374ca33a091.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/f20c71b4-f5e8-4aa5-8056-c374ca33a091) | If you have any questions, click to contact us.[![Email to Sales Team \[BCM Institute\]](https://no-cache.hubspot.com/cta/default/3893111/3c53daeb-2836-4843-b0e0-645baee2ab9e.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/3c53daeb-2836-4843-b0e0-645baee2ab9e) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/7f2718a4-ea80-4f84-a319-dc2d4df37a46) |
| [](https://cta-redirect.hubspot.com/cta/redirect/3893111/74b1e556-8cd2-4a74-8821-db1804534955) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/f2bd8eb1-32d2-4732-9267-ea53223cf58f) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/084e620a-46c5-419a-82ed-6a681d15c0b6) |
#### **Comments**
---
---
---
---
All rights reserved. Copyright 2026
```json
{
"@context" : "https://schema.org",
"@type" : "BlogPosting",
"author" : {
"@type" : "Person",
"name" : "Moh Heng Goh",
"url" : "https://blog.bcm-institute.org/ebook-or/author/moh-heng-goh"
},
"dateModified" : "2026-01-24T15:10:44.558Z",
"datePublished" : "2026-01-15T06:16:47.000Z",
"headline" : "[OR] [BNM] [C2] Comparison Between BNM OR Paper with “Plan” Phase (P1) of the BCM Institute’s Operational Resilience Planning Methodology",
"mainEntityOfPage" : {
"@id" : "https://blog.bcm-institute.org/ebook-or/or-bnm-c2-comparison-between-bnm-or-paper-with-plan-phase-p1-of-the-bcm-institutes-operational-resilience-planning-methodology",
"@type" : "WebPage"
},
"publisher" : {
"@type" : "Organization",
"logo" : {
"@type" : "ImageObject",
"url" : "https://blog.bcm-institute.org/hubfs/BCMI%20Logo.png"
},
"name" : "BCMI Pte Ltd"
}
}
```