---
title: [OR] [CIMB] [E3] [CBS] [1] [SuPS] Identify Severe but Plausible Scenarios
description: [OR] [CIMB] [E3] [CBS] [1] [SuPS] Identify Severe but Plausible Scenarios
image: https://blog.bcm-institute.org/hubfs/eBook%20Generic%20Morepost/OR/OR%20GEN%20E3%20Morepost/%5BOR%5D%20%5BGEN%5D%20%5BE3%5D%20%5BCBS%5D%20%5BSuPS%5D%20Identify%20Severe%20but%20Plausible%20Scenarios.jpg
---
.
[](http://www.bcm-institute.org/)
- [Home](https://www.bcm-institute.org/)
- [About Us](https://www.bcm-institute.org/about-us-3/)
- [A President’s Perspective](https://www.bcm-institute.org/about-us/a-presidents-perspective/)
- [Our History](https://www.bcm-institute.org/about-us/our-history/)
- [Our Advisory Council](https://www.bcm-institute.org/about-us/our-advisory-council/)
- [Customers’ Testimonials](https://www.bcm-institute.org/about-us/customers-testimonials/)
- [Credential Verification](https://www.bcm-institute.org/about-us/credential-verification/)
- [Courses](https://blog.bcm-institute.org/blog/course-fees-for-blended-learning-courses-master-catalog)
- [ISO 22301 Business Continuity Management System Audit](https://blog.bcm-institute.org/audit/business-continuity-management-audit-courses)
- [ISO 22301 Business Continuity Management](https://blog.bcm-institute.org/bcm/business-continuity-management-courses)
- [Crisis Communication](https://blog.bcm-institute.org/crisis-communication/crisis-communication-courses)
- [Crisis Management](https://blog.bcm-institute.org/en/crisis-management/courses)
- [IT Disaster Recovery](https://blog.bcm-institute.org/it-disaster-recovery/courses)
- [Operational Resilience](https://blog.bcm-institute.org/operational-resilience/courses)
- [Operational Resilience Audit](https://blog.bcm-institute.org/operational-resilience-audit/courses)
- [Certification](https://blog.bcm-institute.org/certification/types-of-certifications-offered)
- [ISO 22301 BCMS Audit Certification](https://blog.bcm-institute.org/certification/business-continuity-management-audit-certification)
- [ISO22301 Business Continuity Management Certification](https://blog.bcm-institute.org/bcm/business-continuity-management-certification)
- [Crisis Communication Certification](https://blog.bcm-institute.org/crisis-communication/crisis-communication-certification)
- [Crisis Management Certification](https://blog.bcm-institute.org/en/crisis-management/crisis-management-certification)
- [IT Disaster Recovery Planning Certification](https://blog.bcm-institute.org/it-disaster-recovery/it-disaster-recovery-certification)
- [Operational Resilience Certification](https://blog.bcm-institute.org/operational-resilience/operational-resilience-certification)
- [Operational Resilience Audit Certification](https://blog.bcm-institute.org/operational-resilience-audit)
- [Seminars](https://blog.bcm-institute.org/meet-the-expert/mte-webinar-mainpage)
- [Store](https://www.bcm-institute.org/store-2/)
- [Contact Us](http://www.bcm-institute.org/about-us/contact-us/)
-
-
###### Operational Resilience in Practice: The CIMB Bank Approach
# \[OR\] \[CIMB\] \[E3\] \[CBS\] \[1\] \[SuPS\] Identify Severe but Plausible Scenarios
[](https://cta-redirect.hubspot.com/cta/redirect/3893111/e6bf3389-adf3-47b2-b35a-90bf5de0996b)
Severe but plausible scenarios (SbPS) are hypothetical yet realistic events that could significantly disrupt critical business services.
For CBS‑1: Retail & Digital Banking Access, these scenarios help CIMB Bank anticipate extreme operational, technological, or cyber events that could impact customer access, transactions, and data integrity.
Linking these scenarios with cyber and ICT risks ensures that the bank’s resilience planning addresses both operational and digital threats.
Proactive risk management actions — such as system redundancy, cyber monitoring, and staff training — allow the organisation to reduce the likelihood and impact of these scenarios while maintaining regulatory compliance.
### [](https://cta-redirect.hubspot.com/cta/redirect/3893111/c9c3fddf-009e-4d50-b91c-b18d1228e9ef)
[Dr Goh Moh Heng](https://blog.bcm-institute.org/ebook-or/author/dr-goh-moh-heng) Feb 16, 2026
###### Operational Resilience Certified Planner-Specialist-Expert
###### [![\[OR\] \[CIMB\] Legal Disclaimer Banner](https://no-cache.hubspot.com/cta/default/3893111/11714c89-3f47-430e-82af-f61521f1677c.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/11714c89-3f47-430e-82af-f61521f1677c)
### [](https://cta-redirect.hubspot.com/cta/redirect/3893111/c9c3fddf-009e-4d50-b91c-b18d1228e9ef)
### CBS-1 Retail & Digital Banking Access
### Introduction
[![\[OR\] \[CIMB\] \[E3\] \[CBS\] \[1\] \[SuPS\] Identify Severe but Plausible Scenarios](https://no-cache.hubspot.com/cta/default/3893111/f9916566-5d6d-4024-b675-61dd130a5e59.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/f9916566-5d6d-4024-b675-61dd130a5e59)Severe but plausible scenarios (SbPS) are hypothetical yet realistic events that could significantly disrupt critical business services.
[](https://cta-redirect.hubspot.com/cta/redirect/3893111/b82f4b68-92a3-4741-a22a-c2df4a0479f2)For CBS‑1: Retail & Digital Banking Access, these scenarios help CIMB Bank anticipate extreme operational, technological, or cyber events that could impact customer access, transactions, and data integrity.
Linking these scenarios with cyber and ICT risks ensures that the bank’s resilience planning addresses both operational and digital threats.
Proactive risk management actions — such as system redundancy, cyber monitoring, and staff training — allow the organisation to reduce the likelihood and impact of these scenarios while maintaining regulatory compliance.
#### **[![Banner \[Table\] \[OR\] \[E3\] Identify Severe but Plausible Scenarios](https://no-cache.hubspot.com/cta/default/3893111/f4f3c007-e864-48cd-8bc1-0242c8b7fd86.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/f4f3c007-e864-48cd-8bc1-0242c8b7fd86)**
###### Table P5: Identify Severe but Plausible Scenarios for CBS-1
| Sub‑CBS Code | Sub‑CBS | Severe but Plausible Scenario | Impact / Effect | Proactive Risk Management Action | Link to Integration of Cyber & ICT Risks |
| --- | --- | --- | --- | --- | --- |
| 1.1 | Online Banking Login & Authentication | The multi-factor authentication system fails due to a software bug | Customers cannot log in; loss of trust | Implement secondary authentication channels, redundancy testing | Authentication systems are key ICT control points; monitor for cyber tampering |
| 1.2 | Account Dashboard & Balance Inquiry | Core database replication failure during peak hours | Incorrect balance display, delayed transactions | Strengthen database replication and real-time monitoring | Database availability linked to ICT systems; integrate cyber monitoring for data integrity |
| 1.3 | Funds Transfer & Payment Services | Payment gateway disruption or SWIFT/FAST network outage | Delayed or failed transactions; regulatory reporting breach | Establish alternative routing, DR failover, and transaction queuing | Payment engines interact with ICT networks, monitor for cyber fraud and DDoS |
| 1.4 | Mobile App Transaction Processing | Mobile API backend crash due to a surge in traffic or a cyberattack | Transactions fail; mobile app inaccessible | Auto-scale microservices, DDoS mitigation, penetration testing | Mobile backend APIs integrate ICT risk monitoring and incident response |
| 1.5 | Retail Digital Onboarding | Digital identity verification provider outage | New accounts cannot be opened; KYC delays | Maintain backup verification providers; offline onboarding process | KYC verification relies on ICT integration with third-party systems; monitor for data breaches |
| 1.6 | Digital Alerts & Notification Services | Messaging server outage or telecom network failure | Alerts and notifications delayed; potential regulatory breach | Redundant alert systems; multi-channel messaging | ICT risk integration via monitoring of messaging servers and secure delivery channels |
| 1.7 | Customer Support & Chatbot Interface | Chatbot AI service is offline due to a cyber incident or software failure | Increased call centre load; delayed customer response | Failover to human support, system monitoring, and AI redundancy | Chatbot systems are ICT-dependent; they integrate cyber threat detection |
| 1.8 | API Gateway & Third-Party Integrations | Third-party API provider outage or compromise | Partner services fail; data access is disrupted | API failover, SLA review, cybersecurity monitoring | APIs are critical ICT touchpoints; monitor for data leakage or unauthorised access |
| 1.9 | Access Monitoring & Security Event Logging | SIEM system outage or cyber compromise | Security blind spots; delayed incident response | Redundant logging, off-site event storage, and continuous monitoring | Direct ICT risk link; cyber threat intelligence feeds integrated |
| 1.10 | Back-End Data Synchronisation & Recovery | Disaster recovery site unavailable during primary site outage | Data loss, extended downtime | Test DR plans, cloud replication, real-time sync | Data replication and recovery are heavily ICT-dependent; cyber resilience planning is essential |
#### [![Banner \[Summing\] \[OR\] \[E3\] Identify Severe but Plausible Scenarios](https://no-cache.hubspot.com/cta/default/3893111/446ccb83-e056-40d0-aae5-834d73c13f43.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/446ccb83-e056-40d0-aae5-834d73c13f43)
Identifying severe but plausible scenarios for Retail & Digital Banking Access allows CIMB Bank to anticipate extreme but credible events and implement mitigating measures before disruptions occur.
Linking each scenario to cyber and ICT risks ensures comprehensive resilience planning that addresses operational and digital threats simultaneously.
Proactive risk management actions — including redundancy, monitoring, failover, and vendor management — strengthen the bank’s capacity to maintain service continuity, protect customer trust, and comply with regulatory expectations as outlined in the 2025 BNM Discussion Paper.
Regular scenario reviews further enhance preparedness and support informed decision-making under operational stress.
| Operational Resilience in Practice: The CIMB Bank Approach | | | | | |
| --- | --- | --- | --- | --- | --- |
| **eBook 3: Starting Your OR Implementation** | | | | | |
| **CBS-1 Retail & Digital Banking Access** | | | | | |
| **CBS-1 DP** | **CBS-1 MD** | **CBS-1 MPR** | **CBS-1 ITo** | **CBS-1 SuPS** | **CBS-1 ST** |
| [![\[OR\] \[CIMB\] \[E3\] \[CBS\] \[1\] \[DP\] Retail & Digital Banking Access](https://no-cache.hubspot.com/cta/default/3893111/eb7e4e69-774d-449b-b39c-eec011428302.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/eb7e4e69-774d-449b-b39c-eec011428302) | [![\[OR\] \[CIMB\] \[E3\] \[CBS\] \[1\] \[MD\] Map Dependency](https://no-cache.hubspot.com/cta/default/3893111/ef1fb41d-072d-440a-9bfc-d5e9dbcaaac3.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/ef1fb41d-072d-440a-9bfc-d5e9dbcaaac3) | [![\[OR\] \[CIMB\] \[E3\] \[CBS\] \[1\] \[MPR\] Map Processes and Resources](https://no-cache.hubspot.com/cta/default/3893111/d4d428de-883c-4ab5-b7e0-951cd44d67fe.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/d4d428de-883c-4ab5-b7e0-951cd44d67fe) | [![\[OR\] \[CIMB\] \[E3\] \[CBS\] \[1\] \[ITo\] Establish Impact Tolerances](https://no-cache.hubspot.com/cta/default/3893111/cec876b4-afd8-426f-b4c7-9a1db88709cc.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/cec876b4-afd8-426f-b4c7-9a1db88709cc) | [![\[OR\] \[CIMB\] \[E3\] \[CBS\] \[1\] \[SuPS\] Identify Severe but Plausible Scenarios](https://no-cache.hubspot.com/cta/default/3893111/f9916566-5d6d-4024-b675-61dd130a5e59.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/f9916566-5d6d-4024-b675-61dd130a5e59) | [![\[OR\] \[CIMB\] \[E3\] \[CBS\] \[1\] \[ST\] Perform Scenario Testing](https://no-cache.hubspot.com/cta/default/3893111/079d4de8-89ce-4c0b-a192-7a5793aec4f0.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/079d4de8-89ce-4c0b-a192-7a5793aec4f0) |
**[](https://cta-redirect.hubspot.com/cta/redirect/3893111/084e620a-46c5-419a-82ed-6a681d15c0b6)[](https://cta-redirect.hubspot.com/cta/redirect/3893111/13a448f1-f09c-42da-a57e-0988e41658c5)**
For organisations looking to accelerate their journey, BCM Institute’s training and certification programs, including the **OR-5000 Operational Resilience Expert Implementer course**, provide in-depth insights and practical toolkits for effectively embedding this model.
#### More Information About OR-5000 \[OR-5\] or OR-300 \[OR-3\]
Gain Competency: For organisations looking to accelerate their journey, BCM Institute’s training and certification programs, including the OR-5000 Operational Resilience Expert Implementer course, provide in-depth insights and practical toolkits for effectively embedding this model.
To learn more about the course and schedule, click the buttons below for the \[OR-3\] OR-300 Operational Resilience Implementer course and the \[OR-5\] OR-5000 Operational Resilience Expert Implementer course.
| [](https://cta-redirect.hubspot.com/cta/redirect/3893111/3530eccb-515d-401e-afc2-3469e26d7fbf) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/fdd4fa9c-ed69-40c1-925f-4eb6a1c5c255) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/77a34b84-0a6d-44f8-b8d6-6ab04cdf5edd) |
| --- | --- | --- |
| [](https://cta-redirect.hubspot.com/cta/redirect/3893111/6e5c0cda-39b9-4bbd-b3d4-4cf46a790b14) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/a68a08aa-36d3-4216-9551-202c9fde06ea) | [![ \[BL-OR\] \[3-4-5\] View Schedule](https://no-cache.hubspot.com/cta/default/3893111/d0d733a1-16c0-4b68-a26d-adbfd4fc6069.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/d0d733a1-16c0-4b68-a26d-adbfd4fc6069) |
| [![\[BL-OR\] \[3\] FAQ OR-300](https://no-cache.hubspot.com/cta/default/3893111/f20c71b4-f5e8-4aa5-8056-c374ca33a091.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/f20c71b4-f5e8-4aa5-8056-c374ca33a091) | If you have any questions, click to contact us.[![Email to Sales Team \[BCM Institute\]](https://no-cache.hubspot.com/cta/default/3893111/3c53daeb-2836-4843-b0e0-645baee2ab9e.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/3c53daeb-2836-4843-b0e0-645baee2ab9e) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/7f2718a4-ea80-4f84-a319-dc2d4df37a46) |
| [](https://cta-redirect.hubspot.com/cta/redirect/3893111/74b1e556-8cd2-4a74-8821-db1804534955) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/f2bd8eb1-32d2-4732-9267-ea53223cf58f) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/084e620a-46c5-419a-82ed-6a681d15c0b6) |
#### **Your Comments Here:**
---
---
---
---
All rights reserved. Copyright 2026
```json
{
"@context" : "https://schema.org",
"@type" : "BlogPosting",
"author" : {
"@type" : "Person",
"name" : "Dr Goh Moh Heng",
"url" : "https://blog.bcm-institute.org/ebook-or/author/dr-goh-moh-heng"
},
"dateModified" : "2026-03-18T02:52:29.888Z",
"datePublished" : "2026-02-16T06:10:33.000Z",
"headline" : "[OR] [CIMB] [E3] [CBS] [1] [SuPS] Identify Severe but Plausible Scenarios",
"mainEntityOfPage" : {
"@id" : "https://blog.bcm-institute.org/ebook-or/or-cimb-e3-cbs-1-sups-identify-severe-but-plausible-scenarios",
"@type" : "WebPage"
},
"publisher" : {
"@type" : "Organization",
"logo" : {
"@type" : "ImageObject",
"url" : "https://blog.bcm-institute.org/hubfs/BCMI%20Logo.png"
},
"name" : "BCMI Pte Ltd"
}
}
```