---
title: [OR] [MAS] [E3] [C2] Scenario Design – Severe but Plausible Events
description: [OR] [MAS] [E3] [C2] Scenario Design – Severe but Plausible Events
image: https://blog.bcm-institute.org/hubfs/BB%20OR%20%5BAi%20Gen%20Blog%20Photo%5D/OR%20Pictures%20A/BB%20OR%20Folder%20A/BB%20OR%20%5BA%5D%2013.jpg
---
. .
[](http://www.bcm-institute.org/)
- [Home](https://www.bcm-institute.org/)
- [About Us](https://www.bcm-institute.org/about-us-3/)
- [A President’s Perspective](https://www.bcm-institute.org/about-us/a-presidents-perspective/)
- [Our History](https://www.bcm-institute.org/about-us/our-history/)
- [Our Advisory Council](https://www.bcm-institute.org/about-us/our-advisory-council/)
- [Customers’ Testimonials](https://www.bcm-institute.org/about-us/customers-testimonials/)
- [Credential Verification](https://www.bcm-institute.org/about-us/credential-verification/)
- [Courses](https://blog.bcm-institute.org/blog/course-fees-for-blended-learning-courses-master-catalog)
- [ISO 22301 Business Continuity Management System Audit](https://blog.bcm-institute.org/audit/business-continuity-management-audit-courses)
- [ISO 22301 Business Continuity Management](https://blog.bcm-institute.org/bcm/business-continuity-management-courses)
- [Crisis Communication](https://blog.bcm-institute.org/crisis-communication/crisis-communication-courses)
- [Crisis Management](https://blog.bcm-institute.org/en/crisis-management/courses)
- [IT Disaster Recovery](https://blog.bcm-institute.org/it-disaster-recovery/courses)
- [Operational Resilience](https://blog.bcm-institute.org/operational-resilience/courses)
- [Operational Resilience Audit](https://blog.bcm-institute.org/operational-resilience-audit/courses)
- [Certification](https://blog.bcm-institute.org/certification/types-of-certifications-offered)
- [ISO 22301 BCMS Audit Certification](https://blog.bcm-institute.org/certification/business-continuity-management-audit-certification)
- [ISO22301 Business Continuity Management Certification](https://blog.bcm-institute.org/bcm/business-continuity-management-certification)
- [Crisis Communication Certification](https://blog.bcm-institute.org/crisis-communication/crisis-communication-certification)
- [Crisis Management Certification](https://blog.bcm-institute.org/en/crisis-management/crisis-management-certification)
- [IT Disaster Recovery Planning Certification](https://blog.bcm-institute.org/it-disaster-recovery/it-disaster-recovery-certification)
- [Operational Resilience Certification](https://blog.bcm-institute.org/operational-resilience/operational-resilience-certification)
- [Operational Resilience Audit Certification](https://blog.bcm-institute.org/operational-resilience-audit)
- [Seminars](https://blog.bcm-institute.org/meet-the-expert/mte-webinar-mainpage)
- [Store](https://www.bcm-institute.org/store-2/)
- [Contact Us](http://www.bcm-institute.org/about-us/contact-us/)
-
-
###### Achieving Operational Resilience in Singapore’s Financial Sector: A Practical Guide to MAS Compliance and Implementation
![BB OR \[D\] 6](https://blog.bcm-institute.org/hs-fs/hubfs/BB%20OR%20%5BAi%20Gen%20Blog%20Photo%5D/OR%20Pictures%20A/BB%20OR%20Folder%20D/BB%20OR%20%5BD%5D%206.jpg?width=2000&height=1333&name=BB%20OR%20%5BD%5D%206.jpg "BB OR [D] 6")
# \[OR\] \[MAS\] \[E3\] \[C2\] Scenario Design – Severe but Plausible Events
[](https://cta-redirect.hubspot.com/cta/redirect/3893111/23a20024-f0ef-49c9-b977-9368b9e21491)
Testing and exercising form the backbone of any effective operational resilience programme.
While organisations may design robust frameworks, identify Critical Business Services (CBS), and establish impact tolerances, these elements remain theoretical until they are validated through structured testing.
In the context of Singapore’s financial sector, the Monetary Authority of Singapore (MAS) places strong emphasis on testing and exercising as a regulatory expectation to ensure that resilience capabilities are not only documented but demonstrably effective.
Aligned with MAS guidance in “Achieving Operational Resilience for Financial Institutions in Singapore,” testing is not a one-off activity but a continuous process embedded in the resilience lifecycle.
It ensures that institutions can respond, adapt, and recover from disruptions while maintaining the delivery of critical services.
Complementing this, BCM Institute’s perspective on scenario testing reinforces that organisations must move beyond static plans and adopt dynamic, scenario-driven validation approaches.
This chapter explores the importance of testing and exercising, highlights MAS expectations, and outlines the primary types of testing used in operational resilience.
[](https://cta-redirect.hubspot.com/cta/redirect/3893111/2bb354c3-7a30-4ef1-89c2-e67a16317fda)
[Moh Heng Goh](https://blog.bcm-institute.org/ebook-or/author/moh-heng-goh) Apr 25, 2026
###### Operational Resilience Certified Planner-Specialist-Expert
### [](https://cta-redirect.hubspot.com/cta/redirect/3893111/e57d77d5-7e4f-4f1c-9e1f-cf1f4b2ba552)
### eBook 3: Chapter 2
### Scenario Design – Severe but Plausible Events
#### **Introduction**
Scenario design is a critical component of operational resilience testing. It translates regulatory[![\[OR\] \[MAS\] \[E3\] \[C2\] Scenario Design – Severe but Plausible Events](https://no-cache.hubspot.com/cta/default/3893111/56071084-60f0-45a7-aa3f-721cacd9af2e.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/56071084-60f0-45a7-aa3f-721cacd9af2e) expectations and resilience objectives into **realistic disruption events** that challenge an organisation’s ability to deliver its Critical Business Services (CBS).
Under the guidance of the Monetary Authority of Singapore (MAS), financial institutions are required to test against **severe but plausible scenarios**—events that are extreme in impact yet credible within their operating environments.
Aligned with BCM Institute’s scenario testing methodology, the goal is not to simulate hypothetical extremes detached from reality, but to design **credible stress events** that expose weaknesses across people, process, technology, and third-party dependencies.
This chapter outlines how to design such scenarios and explores key categories of severe but plausible events relevant to financial institutions.
#### **Principles of Severe but Plausible Scenario Design**
A well-designed scenario must strike a careful balance: it should be severe enough to challenge resilience capabilities, yet plausible enough to reflect real-world risks.
##### **Key Design Principles**
- **Credibility and Relevance**
Scenarios must be grounded in actual threat landscapes, regulatory concerns, and the organisation’s operating context.
- **Service-Centric Focus**
Each scenario should test the organisation’s ability to maintain or recover its CBS, rather than focusing on isolated systems or functions.
- **End-to-End Disruption**
Scenarios should incorporate failures across the full value chain, including internal operations and external dependencies.
- **Escalation and Complexity**
Effective scenarios evolve over time, introducing compounding challenges such as resource constraints, communication breakdowns, or decision delays.
- **Cross-Functional Involvement**
Scenario design must involve stakeholders across IT, operations, risk, compliance, and crisis management to ensure realism.
MAS expects institutions to demonstrate that these scenarios are used to **validate impact tolerances, test response capabilities, and identify resilience gaps**.
#### **Cyberattack Scenarios**
Cyber threats are among the most significant risks to operational resilience. MAS explicitly emphasises the importance of testing cyber resilience through realistic attack scenarios.
##### **Common Cyberattack Scenarios**
- **Ransomware Attack**
Encryption of critical systems affecting CBS, such as payments or digital banking services.
- **Distributed Denial-of-Service (DDoS)**
Overwhelming of online banking platforms, leading to service unavailability.
- **Data Breach or Data Integrity Compromise**
Exposure or manipulation of sensitive customer data affects trust and regulatory compliance.
- **Insider Threat**
Malicious or negligent actions by employees leading to system compromise.
##### **Key Testing Objectives**
- Validate **incident detection and response capabilities**
- Assess **cyber incident escalation and crisis management**
- Test **system recovery and data restoration processes**
- Evaluate **customer communication and regulatory reporting readiness**
Cyber scenarios should also consider **cascading effects**, such as reputational damage and regulatory intervention.
#### **Cloud Service Provider Outages**
With increasing reliance on cloud infrastructure, third-party disruptions have become a critical area of concern in operational resilience.
##### **Typical Cloud Disruption Scenarios**
- **Major Cloud Provider Outage**
Loss of access to critical applications hosted on cloud platforms.
- **Regional Data Centre Failure**
Disruption affecting specific geographic zones, impacting service availability.
- **Third-Party Service Degradation**
Performance issues affecting transaction processing or customer access.
##### **Key Testing Objectives**
- Validate **failover and redundancy mechanisms**
- Assess **dependency mapping accuracy**
- Test **third-party communication and coordination**
- Evaluate **manual workarounds and fallback processes**
MAS expects institutions to demonstrate that they understand and can manage **concentration risk and third-party dependencies**, particularly in cloud environments.
#### **Pandemic or Workforce Disruption**
The COVID-19 pandemic highlighted the importance of workforce resilience as a key pillar of operational continuity.
##### **Typical Workforce Disruption Scenarios**
- **Pandemic Resurgence**
High absenteeism affecting critical operations.
- **Workplace Denial (e.g., building closure)**
Loss of access to primary work locations.
- **Critical Staff Unavailability**
Absence of key personnel with specialised knowledge.
##### **Key Testing Objectives**
- Validate **remote working capabilities and infrastructure**
- Assess **cross-training and staff substitution strategies**
- Test **communication channels and employee coordination**
- Evaluate **sustained operations under prolonged disruption**
These scenarios emphasise that resilience is not purely technological—it is equally dependent on **people and organisational adaptability**.
#### **Multi-Event Scenarios**
Real-world disruptions rarely occur in isolation. MAS encourages institutions to design **multi-event or compound scenarios** that reflect the complexity of actual crises.
##### **Examples of Multi-Event Scenarios**
- **Cyberattack During a Cloud Outage**
Simultaneous system compromise and infrastructure failure.
- **Pandemic with Third-Party Disruption**
Workforce shortages combined with vendor service degradation.
- **Natural Disaster Triggering Technology Failures**
Physical disruption leading to cascading IT outages.
##### **Key Testing Objectives**
- Assess **organisational resilience under compounded stress**
- Evaluate **decision-making under uncertainty and ambiguity**
- Test **prioritisation of critical services**
- Identify **systemic vulnerabilities across interconnected dependencies**
Multi-event scenarios are particularly valuable in revealing **hidden interdependencies** and **systemic weaknesses** that single-event scenarios may not expose.
#### **Integrating Scenario Design with Impact Tolerances**
Scenario design must be closely aligned with **impact tolerances** defined for each CBS. Each scenario should aim to answer:
- Can the organisation **remain within impact tolerance thresholds**?
- If not, how quickly can it **recover within acceptable limits**?
- What **gaps or weaknesses** prevent successful recovery?
This alignment ensures that testing is not abstract but directly linked to **measurable resilience outcomes**, as required by MAS.
**[](https://cta-redirect.hubspot.com/cta/redirect/3893111/5404effa-ac11-44ba-a782-31a19cc7ef69)**
Designing severe but plausible scenarios is fundamental to effective operational resilience testing.
Guided by the expectations of the Monetary Authority of Singapore and aligned with BCM Institute’s scenario testing principles, organisations must develop realistic, service-centric scenarios that challenge their ability to deliver critical business services under disruption.
By incorporating cyber threats, cloud outages, workforce disruptions, and multi-event crises, institutions can move beyond basic testing and achieve a deeper understanding of their resilience capabilities.
Ultimately, well-designed scenarios enable organisations to uncover vulnerabilities, strengthen response strategies, and ensure that resilience is not assumed—but proven.
[](https://cta-redirect.hubspot.com/cta/redirect/3893111/2bb354c3-7a30-4ef1-89c2-e67a16317fda)
| ** eBook 1** | **C1** | **C2** | **C3** | **C4** |
| --- | --- | --- | --- | --- |
| [![\[OR\] \[MAS\] \[E1\] ebook Cover](https://no-cache.hubspot.com/cta/default/3893111/727b3faf-7a0f-4839-a05e-ba6681ad3b49.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/727b3faf-7a0f-4839-a05e-ba6681ad3b49) | [![\[OR\] \[MAS\] \[E3\] \[C1\] Importance of Testing and Exercising](https://no-cache.hubspot.com/cta/default/3893111/0df0eeee-fc66-4b11-ab38-66d79aaec491.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/0df0eeee-fc66-4b11-ab38-66d79aaec491) | [![\[OR\] \[MAS\] \[E3\] \[C2\] Scenario Design – Severe but Plausible Events](https://no-cache.hubspot.com/cta/default/3893111/56071084-60f0-45a7-aa3f-721cacd9af2e.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/56071084-60f0-45a7-aa3f-721cacd9af2e) | [![\[OR\] \[MAS\] \[E3\] \[C3\] Scenario Testing of Critical Business Services](https://no-cache.hubspot.com/cta/default/3893111/ac943830-33e3-43e8-91af-cbb5d124dc59.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/ac943830-33e3-43e8-91af-cbb5d124dc59) | [![\[OR\] \[MAS\] \[E3\] \[C4\] Incident and Crisis Management Exercises](https://no-cache.hubspot.com/cta/default/3893111/a11d0538-1b7c-43d3-85b9-8e083acda084.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/a11d0538-1b7c-43d3-85b9-8e083acda084) |
| ** eBook 2** | **C5** | **C6** | **C7** | **C8** |
| [![\[OR\] \[MAS\] \[E2\] ebook Cover](https://no-cache.hubspot.com/cta/default/3893111/29bf59e4-024e-4ce8-9af2-7d831cefaf6b.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/29bf59e4-024e-4ce8-9af2-7d831cefaf6b) | [![\[OR\] \[MAS\] \[E3\] \[C5\] Metrics and Performance Measurement](https://no-cache.hubspot.com/cta/default/3893111/acfb7134-43bc-4f8b-a60e-91b81188e7df.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/acfb7134-43bc-4f8b-a60e-91b81188e7df) | [![\[OR\] \[MAS\] \[E3\] \[C6\] Audit and Regulatory Compliance](https://no-cache.hubspot.com/cta/default/3893111/0f90a2af-ea7b-4663-a226-3e6fd7a82d08.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/0f90a2af-ea7b-4663-a226-3e6fd7a82d08) | [![\[OR\] \[MAS\] \[E3\] \[C7\] Continuous Improvement Framework](https://no-cache.hubspot.com/cta/default/3893111/d422f957-18d1-44fb-9ecb-d184979350ff.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/d422f957-18d1-44fb-9ecb-d184979350ff) | [![\[OR\] \[MAS\] \[E3\] \[C8\] Emerging Risks and Future Trends](https://no-cache.hubspot.com/cta/default/3893111/17b9540f-873a-4b75-8187-b86d5e09bdf0.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/17b9540f-873a-4b75-8187-b86d5e09bdf0) |
| ** eBook 3** | **C9** | **C10** | **C11** | **C12** |
| [![\[OR\] \[MAS\] \[E3\] ebook Cover](https://no-cache.hubspot.com/cta/default/3893111/3e58aabc-cc9d-4e0e-8524-4e3229e46cce.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/3e58aabc-cc9d-4e0e-8524-4e3229e46cce) | [![\[OR\] \[MAS\] \[E3\] \[C9\] Challenges in Sustaining Resilience](https://no-cache.hubspot.com/cta/default/3893111/a7283d2e-7333-4d52-9790-751c55748374.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/a7283d2e-7333-4d52-9790-751c55748374) | [![\[OR\] \[MAS\] \[E3\] \[C10\] Building a Resilience Culture](https://no-cache.hubspot.com/cta/default/3893111/9930350a-530c-412f-99a8-22812806d262.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/9930350a-530c-412f-99a8-22812806d262) | [![\[OR\] \[MAS\] \[E3\] \[C11\] Singapore Financial Sector Outlook](https://no-cache.hubspot.com/cta/default/3893111/2ef85c98-f632-4f2b-870f-106eafa93d0d.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/2ef85c98-f632-4f2b-870f-106eafa93d0d) | [![\[OR\] \[MAS\] \[E3\] \[C12\] Final Key Takeaways and Call to Action](https://no-cache.hubspot.com/cta/default/3893111/609332ce-b015-472e-884d-53a8b0f663b6.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/609332ce-b015-472e-884d-53a8b0f663b6) |
Gain Competency: For organisations looking to accelerate their journey, BCM Institute’s training and certification programs, including the OR-5000 Operational Resilience Expert Implementer course, provide in-depth insights and practical toolkits for effectively embedding this model.
#### More Information About OR-5000 \[OR-5\] or OR-300 \[OR-3\]
To learn more about the course and schedule, click the buttons below for the OR-300 Operational Resilience Implementer course and the OR-5000 Operational Resilience Expert Implementer course.
| [](https://cta-redirect.hubspot.com/cta/redirect/3893111/3530eccb-515d-401e-afc2-3469e26d7fbf) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/fdd4fa9c-ed69-40c1-925f-4eb6a1c5c255) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/77a34b84-0a6d-44f8-b8d6-6ab04cdf5edd) |
| --- | --- | --- |
| [](https://cta-redirect.hubspot.com/cta/redirect/3893111/6e5c0cda-39b9-4bbd-b3d4-4cf46a790b14) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/a68a08aa-36d3-4216-9551-202c9fde06ea) | [![ \[BL-OR\] \[3-4-5\] View Schedule](https://no-cache.hubspot.com/cta/default/3893111/d0d733a1-16c0-4b68-a26d-adbfd4fc6069.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/d0d733a1-16c0-4b68-a26d-adbfd4fc6069) |
| [![\[BL-OR\] \[3\] FAQ OR-300](https://no-cache.hubspot.com/cta/default/3893111/f20c71b4-f5e8-4aa5-8056-c374ca33a091.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/f20c71b4-f5e8-4aa5-8056-c374ca33a091) | If you have any questions, click to contact us.[![Email to Sales Team \[BCM Institute\]](https://no-cache.hubspot.com/cta/default/3893111/3c53daeb-2836-4843-b0e0-645baee2ab9e.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/3c53daeb-2836-4843-b0e0-645baee2ab9e) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/7f2718a4-ea80-4f84-a319-dc2d4df37a46) |
| [](https://cta-redirect.hubspot.com/cta/redirect/3893111/74b1e556-8cd2-4a74-8821-db1804534955) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/f2bd8eb1-32d2-4732-9267-ea53223cf58f) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/084e620a-46c5-419a-82ed-6a681d15c0b6) |
#### **Comments:**
---
---
---
---
All rights reserved. Copyright 2026
```json
{
"@context" : "https://schema.org",
"@type" : "BlogPosting",
"author" : {
"@type" : "Person",
"name" : "Moh Heng Goh",
"url" : "https://blog.bcm-institute.org/ebook-or/author/moh-heng-goh"
},
"dateModified" : "2026-04-30T09:08:53.315Z",
"datePublished" : "2026-04-25T10:40:48.000Z",
"headline" : "[OR] [MAS] [E3] [C2] Scenario Design – Severe but Plausible Events",
"mainEntityOfPage" : {
"@id" : "https://blog.bcm-institute.org/ebook-or/or-mas-e3-c2-scenario-design-severe-but-plausible-events",
"@type" : "WebPage"
},
"publisher" : {
"@type" : "Organization",
"logo" : {
"@type" : "ImageObject",
"url" : "https://blog.bcm-institute.org/hubfs/BCMI%20Logo.png"
},
"name" : "BCMI Pte Ltd"
}
}
```