---
title: [OR] [CAPM] [BNM] Operational Resilience Capability-level Assessment Aligned to Bank Negara Malaysia
description: [OR] [MM] [BNM] Operational Resilience Maturity-level Assessment Aligned to Bank Negara Malaysia
image: https://blog.bcm-institute.org/hubfs/Operational%20Resilience%20OR/Operational%20Resilience%20Morepost/OR%20Blog%20New%20Morepost/OR_Blog_Maturity-level%20Model%20for%20Focus%20Areas.png
---
.
[](http://www.bcm-institute.org/)
- [Home](https://www.bcm-institute.org/)
- [About Us](https://www.bcm-institute.org/about-us-3/)
- [A President’s Perspective](https://www.bcm-institute.org/about-us/a-presidents-perspective/)
- [Our History](https://www.bcm-institute.org/about-us/our-history/)
- [Our Advisory Council](https://www.bcm-institute.org/about-us/our-advisory-council/)
- [Customers’ Testimonials](https://www.bcm-institute.org/about-us/customers-testimonials/)
- [Credential Verification](https://www.bcm-institute.org/about-us/credential-verification/)
- [Courses](https://blog.bcm-institute.org/blog/course-fees-for-blended-learning-courses-master-catalog)
- [ISO 22301 Business Continuity Management System Audit](https://blog.bcm-institute.org/audit/business-continuity-management-audit-courses)
- [ISO 22301 Business Continuity Management](https://blog.bcm-institute.org/bcm/business-continuity-management-courses)
- [Crisis Communication](https://blog.bcm-institute.org/crisis-communication/crisis-communication-courses)
- [Crisis Management](https://blog.bcm-institute.org/en/crisis-management/courses)
- [IT Disaster Recovery](https://blog.bcm-institute.org/it-disaster-recovery/courses)
- [Operational Resilience](https://blog.bcm-institute.org/operational-resilience/courses)
- [Operational Resilience Audit](https://blog.bcm-institute.org/operational-resilience-audit/courses)
- [Certification](https://blog.bcm-institute.org/certification/types-of-certifications-offered)
- [ISO 22301 BCMS Audit Certification](https://blog.bcm-institute.org/certification/business-continuity-management-audit-certification)
- [ISO22301 Business Continuity Management Certification](https://blog.bcm-institute.org/bcm/business-continuity-management-certification)
- [Crisis Communication Certification](https://blog.bcm-institute.org/crisis-communication/crisis-communication-certification)
- [Crisis Management Certification](https://blog.bcm-institute.org/en/crisis-management/crisis-management-certification)
- [IT Disaster Recovery Planning Certification](https://blog.bcm-institute.org/it-disaster-recovery/it-disaster-recovery-certification)
- [Operational Resilience Certification](https://blog.bcm-institute.org/operational-resilience/operational-resilience-certification)
- [Operational Resilience Audit Certification](https://blog.bcm-institute.org/operational-resilience-audit)
- [Seminars](https://blog.bcm-institute.org/meet-the-expert/mte-webinar-mainpage)
- [Store](https://www.bcm-institute.org/store-2/)
- [Contact Us](http://www.bcm-institute.org/about-us/contact-us/)
-
-
###### Operational Resilience Ebook Series
# \[OR\] \[CAPM\] \[BNM\] Operational Resilience Capability-level Assessment Aligned to Bank Negara Malaysia
[](https://cta-redirect.hubspot.com/cta/redirect/3893111/d6538564-69f1-473a-96c4-99a65460eba9)
This chapter contains a comprehensive Operational Resilience Capability Assessment Questionnaire tailored for banks in Malaysia, aligned to:
- The 2025 Bank Negara Malaysia Operational Resilience Discussion Paper (emerging regulatory expectations)
- BCM Institute OR planning methodology (\[OR\] \[P1-S1\])
- Capability assessment principles from BCM Institute and BCMPedia
The questions are structured to reflect BNM’s emphasis on governance, critical services, interdependencies, technology, and third-party risks, as well as increasing accountability and resilience integration
[Moh Heng Goh](https://blog.bcm-institute.org/ebook-or/author/moh-heng-goh) May 1, 2026
###### Operational Resilience Certified Planner-Specialist-Expert
### [](https://cta-redirect.hubspot.com/cta/redirect/3893111/d6538564-69f1-473a-96c4-99a65460eba9)Operational Resilience Capability Assessment (BNM-Aligned)
#### [](https://cta-redirect.hubspot.com/cta/redirect/3893111/a5acb961-f2ec-4567-b636-874e365c892e)
[](https://cta-redirect.hubspot.com/cta/redirect/3893111/bcfa64a1-a7e4-4548-a927-2b17c34f8671)
This chapter contains a comprehensive Operational Resilience Capability Assessment Questionnaire tailored for banks in Malaysia, aligned to:
- The 2025 Bank Negara Malaysia Operational Resilience Discussion Paper (emerging regulatory expectations)
- BCM Institute OR planning methodology (\[OR\] \[P1-S1\])
- Capability assessment principles from BCM Institute and BCMPedia
The questions are structured to reflect BNM’s emphasis on governance, critical services, interdependencies, technology, and third-party risks, as well as increasing accountability and resilience integration
[](https://cta-redirect.hubspot.com/cta/redirect/3893111/2726ae74-56b9-4cb7-9255-428edd7e2847)emphasis on:
- Sustaining **critical business services (CBS)**
- Ability to **prevent, respond, recover, and adapt** to disruptions
- Strong **governance, accountability, and interdependency management**
- Focus on **customer impact and systemic stability**
#### **1. Governance, Oversight and Accountability**
##### **Board and Senior Management Oversight**
- Has the Board formally approved an **Operational Resilience framework and strategy**?
- Is there a **clearly designated accountable executive** (e.g., CRO / Head of OR)?
- Does the Board receive **regular reporting on resilience posture and disruptions**?
- Are resilience objectives integrated into **enterprise risk management (ERM)**?
##### **Policy and Governance Structure**
- Are there documented policies covering:
- Are governance roles clearly defined across the **three lines of defence**?
##### **Culture and Accountability**
- Are KPIs/KRIs aligned to **resilience outcomes (not just compliance)**?
- Is there evidence of **cross-functional accountability for critical services**?
#### **2. Identification of Critical Business Services (CBS)**
- Has the bank formally identified **Critical Business Services (CBS)**?
- Are CBS defined based on:
- Are CBS clearly distinguished from:
##### **CBS Governance**
- Are CBS owners formally assigned?
- Are CBS definitions periodically reviewed and approved?
👉 BNM emphasises that resilience must focus on **critical services and customer impact**, not just internal recovery
#### **3. Impact Tolerance and Service Resilience Objectives**
- Are tolerance breaches:
#### **4. Mapping Interdependencies (End-to-End Visibility)**
##### **Dependency Mapping**
- Has the bank mapped dependencies for each CBS across:
##### **Connectivity and Complexity**
- Are **interconnections between systems and services documented**?
- Are **single points of failure identified and mitigated**?
##### **Data and Documentation**
- Are mapping outputs:
👉 BNM highlights **complex interdependencies and digital ecosystems** as a key resilience challenge
#### **5. Scenario Testing and Resilience Validation**
##### **Scenario Design**
- Are **severe but plausible scenarios (SbPS)** defined?
- Do scenarios include:
##### **Testing Execution**
- Are scenarios tested against:
- Are tests conducted:
##### **Outcomes and Improvement**
- Are test results:
- Are lessons learned translated into:
#### **6. Technology and Cyber Resilience Capability**
- Are cloud and digital dependencies:
##### **Monitoring and Detection**
- Are early warning indicators defined?
#### **7. Third-Party and Supply Chain Resilience**
##### **Third-Party Risk Management**
- Are third parties supporting CBS identified and classified?
- Are critical vendors subject to:
##### **Concentration and Substitution Risk**
- Are concentration risks (e.g., single cloud provider) assessed?
- Are exit and substitution strategies defined?
##### **Integration into Testing**
- Are third parties included in:
👉 BNM stresses the importance of **third-party and ecosystem resilience** due to increasing reliance on outsourcing and cloud
#### **8. Incident Management and Crisis Response Capability**
- Is there a formal **incident management framework**?
- Are escalation protocols clearly defined?
- Is there an established **crisis management structure (e.g., command centre)**?
##### **Communication Capability**
- Are communication protocols tested?
#### **9. Recovery, Continuity and Adaptation Capability**
- Are recovery strategies:
##### **Adaptive Capacity**
- Can the organisation:
#### **10. Data, Metrics and Continuous Improvement**
##### **Metrics and Monitoring**
- Are resilience KPIs/KRIs defined for:
##### **Continuous Improvement**
- Is there a structured process for:
- Are improvements tracked and reported?
#### **11. Integration Across Risk Domains (Holistic Capability)**
- Is operational resilience integrated with:
##### **Enterprise Alignment**
- Is resilience embedded into:
👉 BNM emphasises **holistic and enterprise-wide resilience**, not siloed practices
#### **12. Capability Level Assessment (Scoring Dimension)**
##### **Maturity Rating Guide (Scoring Model)**
Use a 7-level maturity scale:
[](https://cta-redirect.hubspot.com/cta/redirect/3893111/b24f59e0-3272-4913-bab9-2c79dbed1a69)For each question, assign:
1. Level 0: Undefined: No evidence of capability
2. Level 1: Initial: Informal, inconsistent practices
3. Level 2: Managed: Defined but not consistently applied
4. Level 3: Defined: Documented and consistently implemented
5. Level 4: Well-defined: Measured, monitored, and controlled
6. Level 5: Optimising: Continuously improved and integrated
7. Level 6: Innovative: Industry leadership through innovation.
#### **How to Use This Capability Assessment**
##### **[](https://cta-redirect.hubspot.com/cta/redirect/3893111/dfff65d0-298e-42bb-950b-19fab2a205b5)Step 1: Assess Capability**
- Evaluate each question
- Assign capability level (0–6)
##### **Step 2: Identify Gaps**
- Focus on:
##### **Step 3: Align to BNM Expectations**
- Prioritise:
### [](https://cta-redirect.hubspot.com/cta/redirect/3893111/5404effa-ac11-44ba-a782-31a19cc7ef69)
### **Key Takeaways (Aligned to BNM Direction)**
This capability assessment reflects BNM’s shift toward:
- Service-centric, end-to-end, and accountable operational resilience
- Banks are expected to move beyond traditional BCM into:
- Integrated resilience capabilities
- Customer-impact driven design
- Continuous testing and improvement
#### More Information About Blended Learning OR-5000 \[BL-OR-5\] or OR-300 \[BL-OR-3\]
To learn more about the course and schedule, click the buttons below for the OR-3 Blended Learning OR-300 Operational Resilience Implementer course and the OR-5 Blended Learning OR-5000 Operational Resilience Expert Implementer course.
| [](https://cta-redirect.hubspot.com/cta/redirect/3893111/3530eccb-515d-401e-afc2-3469e26d7fbf) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/fdd4fa9c-ed69-40c1-925f-4eb6a1c5c255) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/77a34b84-0a6d-44f8-b8d6-6ab04cdf5edd) |
| --- | --- | --- |
| [](https://cta-redirect.hubspot.com/cta/redirect/3893111/6e5c0cda-39b9-4bbd-b3d4-4cf46a790b14) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/a68a08aa-36d3-4216-9551-202c9fde06ea) | [![ \[BL-OR\] \[3-4-5\] View Schedule](https://no-cache.hubspot.com/cta/default/3893111/d0d733a1-16c0-4b68-a26d-adbfd4fc6069.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/d0d733a1-16c0-4b68-a26d-adbfd4fc6069) |
| [![\[BL-OR\] \[3\] FAQ OR-300](https://no-cache.hubspot.com/cta/default/3893111/f20c71b4-f5e8-4aa5-8056-c374ca33a091.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/f20c71b4-f5e8-4aa5-8056-c374ca33a091) | If you have any questions, click to contact us.[![Email to Sales Team \[BCM Institute\]](https://no-cache.hubspot.com/cta/default/3893111/3c53daeb-2836-4843-b0e0-645baee2ab9e.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/3c53daeb-2836-4843-b0e0-645baee2ab9e) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/7f2718a4-ea80-4f84-a319-dc2d4df37a46) |
| [](https://cta-redirect.hubspot.com/cta/redirect/3893111/74b1e556-8cd2-4a74-8821-db1804534955) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/f2bd8eb1-32d2-4732-9267-ea53223cf58f) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/084e620a-46c5-419a-82ed-6a681d15c0b6) |
#### **Comments**
---
---
---
---
All rights reserved. Copyright 2026
```json
{
"@context" : "https://schema.org",
"@type" : "BlogPosting",
"author" : {
"@type" : "Person",
"name" : "Moh Heng Goh",
"url" : "https://blog.bcm-institute.org/ebook-or/author/moh-heng-goh"
},
"dateModified" : "2026-05-01T06:41:49.300Z",
"datePublished" : "2026-05-01T04:30:42.000Z",
"headline" : "[OR] [CAPM] [BNM] Operational Resilience Capability-level Assessment Aligned to Bank Negara Malaysia",
"mainEntityOfPage" : {
"@id" : "https://blog.bcm-institute.org/ebook-or/or-capm-bnm-operational-resilience-capability-level-assessment-aligned-to-bank-negara-malaysia",
"@type" : "WebPage"
},
"publisher" : {
"@type" : "Organization",
"logo" : {
"@type" : "ImageObject",
"url" : "https://blog.bcm-institute.org/hubfs/BCMI%20Logo.png"
},
"name" : "BCMI Pte Ltd"
}
}
```