[OR] [LSEG] [E3] [CBS] [2] [ST] Perform Scenario Testing

CBS-2 Market Data Distribution Services

Scenario testing is a fundamental component of operational resilience, enabling the London Stock Exchange Group (LSEG) to assess whether its critical business services can continue to operate within established impact tolerances during severe yet plausible disruption events.

For CBS-2 Market Data Distribution Services, scenario testing provides assurance that the end-to-end market data ecosystem—from source acquisition and validation through distribution, customer delivery, and resilience administration—can withstand operational, technological, cyber, third-party, and infrastructure-related disruptions.

By simulating realistic adverse conditions, LSEG can identify vulnerabilities, validate recovery capabilities, assess the effectiveness of controls, and strengthen preparedness across people, processes, technology, facilities, and external dependencies.

The scenario testing activities presented in this chapter align with operational resilience principles and incorporate the growing interrelationships among cyber risks, ICT disruptions, data integrity threats, and business service continuity.

The objective is not only to test recovery procedures but also to demonstrate that market participants, customers, regulators, and other stakeholders continue to receive critical market data services during periods of stress.

Through regular testing, analysis of outcomes, and implementation of lessons learned, LSEG can continuously enhance the resilience of its Market Data Distribution Services and support the stability and integrity of the financial markets it serves.

The following table provides recommended Operational Resilience Scenario Testing activities for CBS-2 Market Data Distribution Services within the London Stock Exchange Group (LSEG).

The scenarios align with operational resilience principles and focus on severe yet plausible disruptions that affect the end-to-end market data lifecycle.

Each scenario incorporates cyber and ICT risk considerations and demonstrates proactive risk management actions to evidence resilience capability.

Table P6: Perform Scenario Testing for CBS-2

Sub-CBS Code	Sub-CBS Process	Recommended Scenario Test	Cyber & ICT Risk Integration	Evidence of Proactive Risk Management
2.1	Market Data Source Acquisition and Feed Collection	Simulate loss of primary exchange market data feed from multiple exchanges simultaneously	Telecommunications outage, DDoS attack on feed gateways, API failure	Alternate feed activation test, redundant connectivity validation, supplier failover records
2.2	Market Data Validation and Quality Verification	Inject corrupted market data records and invalid pricing updates into the validation environment	Data integrity attack, malware manipulation of inbound data	Data quality exception reports, validation rule testing records, anomaly detection logs
2.3	Market Data Normalisation and Data Transformation	Simulate the failure of the transformation engine during peak trading hours	Application failure, software defect, cloud service degradation	Transformation recovery procedures, automated rollback testing, and resilience architecture reviews
2.4	Instrument and Reference Data Association	Test inaccurate reference data mapping affecting multiple instruments	Master data corruption, unauthorised database modification	Reference data reconciliation reports, governance reviews, and control testing evidence
2.5	Real-Time Tick Data Processing	Simulate processing engine overload caused by extreme market volatility	Resource exhaustion, algorithm malfunction, infrastructure bottleneck	Capacity stress test reports, scaling validation results, performance monitoring dashboards
2.6	Market Data Aggregation and Consolidation	Simulate failure of the primary aggregation platform consolidating global feeds	Server failure, cluster outage, storage corruption	High-availability failover testing, resilience drills, and platform recovery evidence
2.7	Data Enrichment and Analytics Processing	Simulate disruption of analytics engines supporting value-added market data products	Analytics platform compromise, cloud processing failure	Recovery time testing, backup analytics activation records, and cyber recovery exercises
2.8	Entitlement and Subscriber Access Management	Simulate corruption of the entitlement database, causing subscriber access errors	Identity management compromise, privileged account abuse	IAM testing reports, access review records, and entitlement reconciliation evidence
2.9	Data Feed Publication and Distribution	Simulate a complete outage of the distribution infrastructure serving global clients	DDoS attack, messaging middleware failure, CDN disruption	Distribution failover exercises, traffic rerouting evidence, and client notification testing
2.10	Low-Latency Data Delivery and Network Routing	Simulate latency spikes and network congestion across critical delivery routes	Network attack, router misconfiguration, carrier outage	Network resilience testing, latency monitoring records, and route diversity validation
2.11	API Gateway and Connectivity Services	Simulate an API gateway failure affecting customer access to market data	API exploitation attack, authentication failure, gateway outage	API resilience testing, penetration testing results, and gateway failover validation
2.12	Market Data Synchronisation and Time Management	Simulate failure of enterprise time synchronisation infrastructure	NTP compromise, GPS timing disruption, clock drift attack	Time synchronisation testing records, alternate timing source validation, and monitoring reports
2.13	Historical Data Capture and Archiving	Simulate failure of the archival platform and inability to retrieve historical records	Storage corruption, ransomware attack, backup compromise	Backup restoration tests, archival integrity verification, and recovery drill evidence
2.14	Customer Delivery Channel Integration	Simulate an outage affecting multiple customer delivery channels simultaneously	Middleware compromise, integration platform outage	Customer channel failover tests, integration resilience reports, and recovery exercises
2.15	Exception Handling and Data Recovery Management	Simulate widespread market data corruption requiring bulk recovery operations	Cyber-induced data corruption, database failure	Data recovery testing records, incident simulations, restoration success metrics
2.16	Market Data Monitoring and Performance Surveillance	Simulate failure of monitoring tools during a market data degradation event	SIEM outage, monitoring platform compromise	Secondary monitoring activation, observability testing, and incident detection metrics
2.17	Incident Response and Service Restoration	Conduct an end-to-end cyberattack simulation impacting market data services	Ransomware, destructive malware, and insider threat	Incident response exercise reports, crisis management records, and lessons learned register
2.18	Regulatory Reporting and Data Compliance Monitoring	Simulate regulatory reporting failures due to missing or inaccurate market data	Compliance system outage, data integrity compromise	Regulatory reporting testing, compliance audit results, and remediation tracking
2.19	Cybersecurity Monitoring for Data Infrastructure	Conduct an advanced persistent threat (APT) simulation targeting market data infrastructure	APT attack, lateral movement, credential compromise	Threat hunting reports, SOC exercise results, cyber maturity assessments
2.20	Business Continuity and Resilience Administration	Simulate a prolonged regional data centre outage impacting market data operations	Data centre failure, cloud region outage, cyber-physical disruption	BCP exercise reports, alternate site activation records, resilience governance reviews

Recommended Enterprise-Wide End-to-End Scenario Tests

In addition to individual Sub-CBS testing, LSEG should conduct integrated scenario tests covering the complete CBS-2 Market Data Distribution Services value chain.

Scenario Test	Scope	Cyber & ICT Linkage	Evidence of Proactive Risk Management
Exchange Feed Loss During Peak Trading	2.1 to 2.10	Connectivity failure, supplier outage	Third-party resilience assessments, recovery exercise reports
Ransomware Attack on Market Data Platform	2.2 to 2.20	Cybersecurity incident, data encryption	Cyber recovery testing, immutable backup validation
Data Corruption Across Market Data Lifecycle	2.2 to 2.18	Data integrity compromise	Data reconciliation reports, recovery testing evidence
Cloud Service Provider Regional Outage	2.5 to 2.20	Cloud infrastructure failure	Multi-region failover testing, cloud resilience assessments
Global DDoS Attack on Data Distribution Services	2.9 to 2.14	Network and application attack	DDoS mitigation exercises, network resilience reports
Time Synchronisation Failure Across Trading Ecosystem	2.12 and dependent services	Critical ICT infrastructure failure	Alternate timing source tests, synchronisation recovery evidence
Insider Threat: Manipulating Market Data	2.2 to 2.18	Privileged access abuse	User activity monitoring reports, access governance testing
Simultaneous Cyber and Physical Facility Disruption	Entire CBS-2	Combined cyber and operational event	Crisis management exercises, business continuity testing results

Key Evidence Expected from Scenario Testing

To demonstrate operational resilience maturity and proactive risk management, LSEG should maintain evidence, including:

Scenario test plans and approved test objectives.
Impact tolerance measurement results.
Recovery Time Objective (RTO) and Recovery Point Objective (RPO) achievement records.
Cybersecurity monitoring and threat detection reports.
Third-party resilience assessment results.
Failover and recovery exercise reports.
Crisis management and incident response logs.
Lessons learned and remediation tracking registers.
Board and executive review documentation.
Continuous improvement actions and resilience enhancement programmes.

This approach aligns scenario testing with operational resilience expectations by validating whether CBS-2 Market Data Distribution Services can remain within established impact tolerances during severe but plausible operational, cyber, technology, third-party, and data integrity disruption scenarios.

The successful execution of scenario testing for CBS-2 Market Data Distribution Services enables the London Stock Exchange Group to validate its operational resilience under a range of severe yet plausible disruption scenarios.

The testing programme demonstrates the organisation’s ability to identify emerging risks, respond effectively to incidents, recover critical functions within acceptable timeframes, and maintain the delivery of essential market data services to customers and market participants.

By integrating cyber resilience, technology resilience, third-party dependency management, and business continuity considerations into each test scenario, LSEG establishes a comprehensive and realistic assessment of its operational preparedness.

Scenario testing should not be viewed as a one-time compliance exercise but as a continuous improvement mechanism that strengthens resilience maturity across the organisation.

The insights gained from testing provide valuable evidence of proactive risk management, support governance and regulatory oversight, and drive enhancements to operational processes, technology platforms, incident response capabilities, and recovery strategies.

Through ongoing testing, review, and remediation, LSEG can continue to improve its ability to withstand disruption, protect market integrity, and ensure the reliable delivery of market data services in an increasingly complex and interconnected operating environment.

LSEG Thin Banner

eBook 3: Starting Your OR Implementation
CBS-2 Market Data Distribution Services
DP	MIIC	MIID	ITo	SbPS	ST

Gain Competency: For organisations looking to accelerate their journey, BCM Institute’s training and certification programs, including the OR-5000 Operational Resilience Expert Implementer course, provide in-depth insights and practical toolkits for effectively embedding this model.

More Information About OR-5000 [OR-5] or OR-300 [OR-3]

To learn more about the course and schedule, click the buttons below for the OR-300 Operational Resilience Implementer course and the OR-5000 Operational Resilience Expert Implementer course.