[OR] [MBSB] [E2] [C1] OR Planning Methodology

Introduction to MBSB’s Operational Resilience Planning Methodology

Introduction

Operational resilience is increasingly important to financial institutions operating in an environment characterised by digitalisation, interconnected financial ecosystems, cyber threats, technology dependencies, third-party concentration and heightened customer expectations.

For MBSB, resilience therefore extends beyond the recovery of individual systems or business functions.

It requires the organisation to understand which services are most important to customers and other stakeholders, how those services are delivered, what they depend upon, and how disruption can be managed before unacceptable harm occurs.

Bank Negara Malaysia (BNM), in its 2025 Discussion Paper on Operational Resilience, outlines an emerging direction to strengthen the continuity of critical financial services.

The Discussion Paper highlights several foundational themes: preserving critical operations and services, mapping internal and external interdependencies, managing third-party dependencies, setting tolerances for disruption, and assessing capabilities against severe but plausible scenarios.

It also emphasises strong governance, leadership, organisational learning and continuous improvement.

These principles provide an important regulatory context for MBSB. BNM observes that operational resilience should build upon, rather than replace, established disciplines such as Business Continuity Management (BCM), technology risk management, third-party management, operational risk management and governance.

The objective is to bring these capabilities together to maintain critical services during disruption.

For this implementation guide, MBSB's Operational Resilience Planning Methodology is structured around three interconnected phases:

Plan → Implement → Sustain

Each phase contains five stages, creating a structured fifteen-stage methodology. The phases should not be regarded as isolated projects. Together, they form a continuous management cycle through which MBSB can establish its operational resilience foundation, implement service-level resilience capabilities, and sustain and improve those capabilities as the organisation and its operating environment evolve.

The purpose of this chapter is to provide the reader with an overall understanding of MBSB's Operational Resilience Planning Methodology before the detailed implementation activities are addressed in subsequent chapters.

Operational resilience involves multiple disciplines, business units and management responsibilities.

Without a common methodology, activities such as identifying critical services, setting impact tolerances, dependency mapping, scenario testing, risk management, business continuity and technology resilience can become fragmented.

A structured methodology provides a common framework through which these activities can be coordinated and linked to the services that matter most.

By the end of this chapter, the reader should be able to:

• understand the purpose of the Plan, Implement and Sustain phases;
• recognise the five stages within each phase;
• understand how the fifteen stages collectively form an operational resilience lifecycle;
• relate each stage to MBSB's financial services operating environment;
• understand how the methodology supports the operational resilience themes emerging from BNM's 2025 Discussion Paper; and
• recognise that operational resilience is an ongoing management capability rather than a one-time compliance exercise.

BNM similarly emphasises that operational resilience is a continuous journey, requiring financial institutions to learn from disruptions and near misses and to periodically update testing, processes, architecture, and governance arrangements as the threat and operating environments evolve.

Phase 1: Plan

The Plan Phase establishes the organisational foundation required to implement operational resilience effectively.

Before MBSB determines which services are critical or conducts detailed resilience testing, it needs to understand its existing capabilities, identify gaps, determine its strategic direction, establish acceptable risk boundaries and put appropriate governance arrangements in place.

The five stages are:

Plan Phase – Stage 1: Assess Capability and Maturity

MBSB begins by establishing a baseline of its existing operational resilience capabilities.

The assessment should consider capabilities already available through BCM, operational risk management, technology and cyber resilience, disaster recovery, outsourcing and third-party risk management, incident and crisis management, governance, and related disciplines.

The objective is not simply to determine whether policies and procedures exist. MBSB should assess how effectively these capabilities collectively support the continued delivery of critical services during disruption.

MBSB Example

MBSB could assess whether existing BCM arrangements are primarily organised around departments and critical business functions or whether they provide management with an end-to-end understanding of customer-facing services.

Existing technology recovery capabilities, outsourcing arrangements, incident management processes and governance structures could then be assessed against the operational resilience outcomes MBSB seeks to achieve.

Plan Phase – Stage 2: Analyse Gap

Once the current maturity level is understood, MBSB identifies the difference between its existing capabilities and its desired operational resilience capability.

Potential gaps may relate to service identification, dependency information, third-party visibility, impact tolerance, scenario testing, governance, management information or organisational awareness.

The gap analysis enables MBSB to distinguish between capabilities that can be leveraged from existing arrangements and areas requiring enhancement.

MBSB Example

MBSB may already maintain detailed BCM and technology recovery documentation but determine that information is structured around individual functions and systems rather than end-to-end critical business services.

The gap would therefore not necessarily be an absence of recovery arrangements, but the need to connect existing information into a service-based resilience view.

Plan Phase – Stage 3: Develop Strategy and Roadmap

The identified gaps are translated into an operational resilience strategy and implementation roadmap.

The strategy defines what MBSB intends to achieve, while the roadmap establishes how improvements will be prioritised, sequenced, resourced and monitored.

Rather than attempting to implement every improvement simultaneously, MBSB should adopt a risk-based, proportionate approach, prioritising capabilities that most directly influence the continuity of critical services.

MBSB Example

MBSB could establish a multi-year roadmap beginning with the identification of critical business services, followed by dependency mapping and impact tolerance setting.

Subsequent milestones could address scenario testing, vulnerability remediation, enhanced management reporting, and integration into business-as-usual governance.

Plan Phase – Stage 4: Confirm Risk Appetite

Operational resilience needs to be aligned with MBSB's broader risk management framework.

Risk appetite provides management with boundaries for the level and type of operational risk the organisation is prepared to accept in pursuing its objectives.

Operational resilience should translate these organisational risk boundaries into meaningful considerations concerning disruption to critical services.

MBSB Example

Where MBSB has a low appetite for prolonged disruption to essential customer banking services, this position should influence investment decisions concerning system availability, redundancy, cybersecurity, recovery capabilities and critical third-party arrangements.

Risk appetite sets the strategic boundary, while service-specific impact tolerances, developed later in the methodology,  provide more explicit measures of the disruption that can be tolerated.

Plan Phase – Stage 5: Develop and Embed Governance

Operational resilience requires clear ownership, accountability, decision-making authority and oversight.

BNM highlights strong board oversight and timely decision-making through cross-functional and integrated arrangements as important characteristics of institutions capable of withstanding disruption.

MBSB should therefore determine how operational resilience will be governed across existing management structures rather than creating unnecessary parallel arrangements.

MBSB Example

The Board and Senior Management could receive periodic reports on critical business services, impact-tolerance positions, major vulnerabilities, scenario-testing results, and remediation programmes.

Individual critical business services could also have clearly designated senior owners accountable for ensuring that resilience risks are understood and appropriately managed.

The completion of the Plan Phase provides MBSB with the organisational foundation for moving from strategic intent to implementation.

Phase 2: Implement

The Implement Phase converts MBSB's operational resilience strategy into practical service-level capabilities.

This phase places particular emphasis on understanding the services that must remain resilient, identifying the resources and dependencies that support them, determining acceptable disruption thresholds, and testing whether the organisation can remain within those thresholds.

This direction closely reflects BNM's emerging themes concerning critical services, interdependency mapping, tolerances for disruption and severe-but-plausible scenario testing.

The five stages are:

Implement Phase – Stage 1: Identify Critical Business Services

Not every MBSB activity requires the same level of resilience.

The first implementation stage therefore identifies the business services whose disruption could cause significant harm to customers, the organisation, other stakeholders or, where relevant, the wider financial system.

This service-oriented approach shifts attention from protecting individual departments towards protecting outcomes that customers and stakeholders depend upon.

MBSB Example

MBSB may determine that customers' ability to access and transact through certain banking services represents a critical business service because prolonged unavailability could prevent customers from accessing funds or completing essential financial transactions.

BNM similarly stresses the need for financial institutions to determine which operations or services are essential to consumers and markets and preserve their continuity.

Implement Phase – Stage 2: Map Processes and Resources

Once critical business services have been identified, MBSB needs an end-to-end understanding of how each service is delivered.

Mapping should identify relevant:

• people;
• business processes;
• technology and applications;
• data;
• facilities;
• internal business units;
• third parties and outsourced providers; and
• other infrastructure and external dependencies.

BNM emphasises that disruption can propagate through networks of people, processes, data, technology, facilities, business units and external service providers. Mapping these dependencies enables financial institutions to identify vulnerabilities and critical failure points.

MBSB Example

For a critical digital banking service, MBSB could map the customer interface, authentication mechanisms, supporting applications, core banking platform, telecommunications connectivity, cybersecurity services, data infrastructure, operational teams and relevant external service providers.

The resulting map should enable MBSB to understand how disruption to one component could affect delivery of the overall service.

Implement Phase – Stage 3: Set Impact Tolerance

MBSB next determines the maximum level of disruption it can tolerate before the impact becomes unacceptable.

Impact tolerance should be considered from the perspective of the business service and its outcomes, rather than being limited to the recovery objectives of individual systems or departments.

BNM notes that internal recovery measures such as Maximum Tolerable Downtime (MTD) and Recovery Time Objective (RTO) remain important but may not, by themselves, adequately represent the impact of disruption on customers and stakeholders.

MBSB Example

For a critical customer transaction service, MBSB could establish a maximum tolerable duration of service disruption, while also considering the affected transaction volumes, the number of customers impacted, financial consequences, regulatory implications, and potential customer harm.

The impact tolerance then becomes a reference point for assessing whether existing resilience arrangements are sufficient.

Implement Phase – Stage 4: Conduct Scenario Testing

Scenario testing assesses whether MBSB can continue delivering its critical business services within established impact tolerances when confronted with severe but plausible disruption.

Testing should challenge assumptions rather than simply demonstrate that existing plans work under favourable conditions.

BNM specifically highlights the importance of scenarios that are sufficiently severe to expose weaknesses while remaining credible, including consideration of concurrent and multi-layered failures.

MBSB Example

MBSB could test a scenario involving simultaneous disruption to a critical technology platform and a supporting third-party service during a period of high customer transaction volumes.

The scenario could assess whether alternative arrangements, management escalation, customer communication and recovery capabilities would enable the affected service to remain within its impact tolerance.

Implement Phase – Stage 5: Improve Lessons Learned

Testing has limited value unless identified weaknesses lead to improvement.

MBSB should establish a structured process for capturing findings from exercises, actual incidents, near misses, and operational disruptions and converting them into corrective actions.

MBSB Example

A scenario test may identify excessive dependence on a single technology component or service provider. MBSB could respond by introducing additional redundancy, strengthening contractual continuity arrangements, improving alternative processing capabilities or modifying recovery procedures.

BNM emphasises continuous learning and structured incorporation of lessons from disruptions into future planning as a fundamental aspect of improving resilience.

Therefore, completion of the Implement Phase does not represent the end of operational resilience. The capabilities established must subsequently be embedded, maintained and continuously challenged.

Phase 3: Sustain – Ensuring Long-term Resilience

The Sustain Phase embeds operational resilience into MBSB's organisational culture and business-as-usual management practices.

Operational resilience cannot remain solely the responsibility of BCM, Risk or Technology functions. Individuals responsible for designing, operating, supporting and overseeing critical services must understand how their decisions influence resilience.

The five stages are:

Sustain Phase – Stage 1: Introduce Cultural Change

The first stage focuses on creating organisational behaviours that support resilience.

Employees and management should recognise that disruption is possible despite preventive controls and that resilience therefore requires preparedness, adaptability and effective recovery.

MBSB Example

When evaluating a new digital banking capability, MBSB's management could routinely consider resilience implications alongside commercial, technology, and customer experience considerations. This would help move resilience from a specialist control activity into normal business decision-making.

Sustain Phase – Stage 2: Develop Communication Strategy

Operational resilience requires effective communication before, during and after disruption.

MBSB should establish communication arrangements that address internal stakeholders, customers, regulators, service providers, and other relevant parties.

MBSB Example

To address disruptions affecting critical customer service, MBSB could establish predetermined escalation paths, communication responsibilities, approval authorities, and customer communication channels to ensure accurate information is provided promptly during an incident.

Sustain Phase – Stage 3: Implement Training and Awareness

Different stakeholders require different levels of operational resilience knowledge.

Training should therefore be role-based rather than relying exclusively on general awareness programmes.

MBSB Example

Board and Senior Management training could focus on governance, accountability and decision-making under severe disruption. Critical business service owners could receive training on impact tolerance and scenario testing, while operational teams could focus on service dependencies, escalation procedures and continuity arrangements.

Sustain Phase – Stage 4: Provide Self-assessment

Self-assessment enables MBSB to periodically evaluate whether its operational resilience arrangements remain appropriate and effective.

The assessment should consider changes in critical services, dependencies, vulnerabilities, impact tolerances, testing outcomes, incidents and remediation activities.

MBSB Example

Each critical business service owner could periodically confirm whether dependency maps remain current, whether the service continues to operate within its approved resilience parameters, whether identified vulnerabilities have been addressed and whether significant business or technology changes have altered its resilience profile.

This creates a structured mechanism through which management can identify emerging weaknesses before they become material resilience issues.

Sustain Phase – Stage 5: Conduct Independent Quality Review

Independent review provides objective challenge and assurance over the design and effectiveness of MBSB's operational resilience framework.

The review should determine not merely whether documentation exists, but whether the framework is embedded and capable of producing the intended resilience outcomes.

MBSB Example

An independent review could examine a sample of MBSB's critical business services and assess whether their identification criteria are appropriate, dependency maps are sufficiently comprehensive, impact tolerances are supported by clear rationale, scenario tests provide meaningful challenge and identified weaknesses are being remediated.

Findings should be reported through appropriate governance channels and incorporated into the next improvement cycle.

Connecting the Three Phases

The three phases should be viewed as a continuous and interconnected lifecycle rather than a linear programme that ends after implementation.

Plan establishes where MBSB currently stands, where it intends to go and how operational resilience will be governed.

Implement identifies what must remain resilient, understands how those services are delivered, determines acceptable disruption levels and tests whether resilience arrangements are sufficient.

Sustain embeds those capabilities into MBSB's culture, communication, training, assurance, and continuous improvement processes.

The relationship can therefore be represented as:

This cyclical approach is particularly important because MBSB's operating environment will continue to change. New products, digital channels, technologies, outsourcing arrangements, customer behaviours and emerging threats can alter both service dependencies and the consequences of disruption.

Alignment with BNM's Emerging Operational Resilience Direction

MBSB's Operational Resilience Planning Methodology provides a practical structure for translating the emerging principles described by BNM into coordinated implementation activities.

BNM's 2025 Discussion Paper indicates a shift towards a more resilience-first approach within Malaysia's financial sector.

It highlights the importance of identifying critical services, understanding internal and external dependencies, managing third-party reliance, establishing tolerances for disruption, testing against severe but plausible scenarios, maintaining strong governance and continuously learning from disruptions.

Importantly, this direction does not mean discarding MBSB's existing risk and resilience capabilities. BNM recognises that financial institutions already operate within established requirements covering BCM, technology risk, outsourcing, operational risk, risk governance, corporate governance and responsibility mapping.

Operational resilience can provide an organising construct that brings these capabilities together around the outcome of maintaining critical services during disruption.

For MBSB, the fifteen-stage methodology therefore provides a bridge between existing capabilities and a more integrated, service-oriented approach to resilience.

Operational resilience requires MBSB to look beyond the recovery of individual business functions, applications, or infrastructure components and consider whether the organisation can continue to deliver its most critical business services when serious disruption occurs.

The Plan–Implement–Sustain methodology provides a structured approach for achieving this objective.

The Plan Phase establishes the foundation through capability assessment, gap analysis, strategy, risk appetite and governance.

The Implement Phase translates that foundation into practical resilience through critical business service identification, mapping, impact tolerance, scenario testing and improvement.

The Sustain Phase embeds resilience through culture, communication, training, self-assessment and independent review.

Together, these fifteen stages create a continuous operational resilience lifecycle for MBSB. They also provide a practical means of connecting existing BCM, operational risk, technology resilience, third-party risk and governance capabilities around a common outcome: maintaining the delivery of critical business services within acceptable levels of disruption.

This foundation prepares the reader for the subsequent chapters, in which the individual stages of MBSB's Operational Resilience Planning Methodology are translated into more detailed implementation activities, responsibilities, deliverables, and management practices.

Blogs marked [x] are under construction

C1	C2	C8	C14

	eBook 2: Implementing Operational Resilience for MBSB
		eBook 1	eBook 2	eBook 3	C20 [x]	C21 [x]
	"Plan" Phase of the Operational Resilience Planning Methodology
	C2	C3 [x]	C4 [x]	C5 [x]	C6 [x]	C7 [x]
	"Implement" Phase of the Operational Resilience Planning Methodology
	C8	C9 [x]	C10 [x]	C11 [x]	C12 [x]	C13 [x]
	"Sustain" Phase of the Operational Resilience Planning Methodology
	C14	C15 [x]	C16 [x]	C17 [x]	C18 [x]	C19 [x]

For organisations looking to accelerate their journey, BCM Institute’s training and certification programs, including the OR-5000 Operational Resilience Expert Implementer course, provide in-depth insights and practical toolkits for effectively embedding this model.

More Information About OR-5000 [OR-5] or OR-300 [OR-3]

Gain Competency: For organisations looking to accelerate their journey, BCM Institute’s training and certification programs, including the OR-5000 Operational Resilience Expert Implementer course, provide in-depth insights and practical toolkits for effectively embedding this model.

To learn more about the course and schedule, click the buttons below for the OR-300 Operational Resilience Implementer course and the OR-5000 Operational Resilience Expert Implementer course.

	If you have any questions, click to contact us.