---
title: [OR] [MBSB] [E3] [CBS] [3] [SbPS] Identify Severe but Plausible Scenarios
description: [OR] [MBSB] [E3] [CBS] [3] [SbPS] Identify Severe but Plausible Scenarios
image: https://blog.bcm-institute.org/hubfs/MBSB%20Graphic%20Folder/MBSB%20CBS%203/%5BOR%5D%20%5BMBSB%5D%20%5BE3%5D%20%5BCBS%5D%20%5B3%5D%20%5BSbPS%5D%20Digital%20Banking%20Services.jpg
---
. .
[](http://www.bcm-institute.org/)
- [Home](https://www.bcm-institute.org/)
- [About Us](https://www.bcm-institute.org/about-us-3/)
- [A President’s Perspective](https://www.bcm-institute.org/about-us/a-presidents-perspective/)
- [Our History](https://www.bcm-institute.org/about-us/our-history/)
- [Our Advisory Council](https://www.bcm-institute.org/about-us/our-advisory-council/)
- [Customers’ Testimonials](https://www.bcm-institute.org/about-us/customers-testimonials/)
- [Credential Verification](https://www.bcm-institute.org/about-us/credential-verification/)
- [Courses](https://blog.bcm-institute.org/blog/course-fees-for-blended-learning-courses-master-catalog)
- [ISO 22301 Business Continuity Management System Audit](https://blog.bcm-institute.org/audit/business-continuity-management-audit-courses)
- [ISO 22301 Business Continuity Management](https://blog.bcm-institute.org/bcm/business-continuity-management-courses)
- [Crisis Communication](https://blog.bcm-institute.org/crisis-communication/crisis-communication-courses)
- [Crisis Management](https://blog.bcm-institute.org/en/crisis-management/courses)
- [IT Disaster Recovery](https://blog.bcm-institute.org/it-disaster-recovery/courses)
- [Operational Resilience](https://blog.bcm-institute.org/operational-resilience/courses)
- [Operational Resilience Audit](https://blog.bcm-institute.org/operational-resilience-audit/courses)
- [Certification](https://blog.bcm-institute.org/certification/types-of-certifications-offered)
- [ISO 22301 BCMS Audit Certification](https://blog.bcm-institute.org/certification/business-continuity-management-audit-certification)
- [ISO22301 Business Continuity Management Certification](https://blog.bcm-institute.org/bcm/business-continuity-management-certification)
- [Crisis Communication Certification](https://blog.bcm-institute.org/crisis-communication/crisis-communication-certification)
- [Crisis Management Certification](https://blog.bcm-institute.org/en/crisis-management/crisis-management-certification)
- [IT Disaster Recovery Planning Certification](https://blog.bcm-institute.org/it-disaster-recovery/it-disaster-recovery-certification)
- [Operational Resilience Certification](https://blog.bcm-institute.org/operational-resilience/operational-resilience-certification)
- [Operational Resilience Audit Certification](https://blog.bcm-institute.org/operational-resilience-audit)
- [Seminars](https://blog.bcm-institute.org/meet-the-expert/mte-webinar-mainpage)
- [Store](https://www.bcm-institute.org/store-2/)
- [Contact Us](http://www.bcm-institute.org/about-us/contact-us/)
-
-
###### Operational Resilience in Action: The MBSB Approach
# \[OR\] \[MBSB\] \[E3\] \[CBS\] \[3\] \[SbPS\] Identify Severe but Plausible Scenarios
[![\[OR\] \[MBSB\] \[Full Banner\] Operational Resilience in Action The MBSB Bank's Approach ](https://no-cache.hubspot.com/cta/default/3893111/567eecca-dbad-4a1a-8465-5d45335ce5da.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/567eecca-dbad-4a1a-8465-5d45335ce5da)
Identifying Severe but Plausible Scenarios is a critical step in determining whether MBSB can continue delivering CBS-3 Digital Banking Services during major operational disruption without exceeding its approved Impact Tolerance.
Rather than assessing technology failures in isolation, scenario identification examines how credible disruptive events affect customers' ability to access accounts, authenticate securely, obtain reliable financial information, initiate transactions, complete payments, and receive assistance.
The 24 Sub-CBS processes provide a structured basis for identifying vulnerabilities throughout the digital banking service lifecycle.
They allow MBSB to examine how disruption originates within a process, propagates through supporting systems and external dependencies, and affects other interconnected Critical Business Services.
Cyber and ICT Risks must be integrated throughout this assessment because ransomware, distributed denial-of-service attacks, compromised identities, data corruption, failed technology changes, network outages and technology concentration can trigger or amplify severe operational disruption.
### [](https://cta-redirect.hubspot.com/cta/redirect/3893111/c9c3fddf-009e-4d50-b91c-b18d1228e9ef)
[Dr Goh Moh Heng](https://blog.bcm-institute.org/ebook-or/author/dr-goh-moh-heng) Oct 14, 2026
###### Operational Resilience Certified Planner-Specialist-Expert
### [![x \[OR\] \[MBSB\] Legal Disclaimer Banner](https://no-cache.hubspot.com/cta/default/3893111/d779f9ab-aec0-4cdd-a906-81e7841c3e1c.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/d779f9ab-aec0-4cdd-a906-81e7841c3e1c)
### [](https://cta-redirect.hubspot.com/cta/redirect/3893111/c9c3fddf-009e-4d50-b91c-b18d1228e9ef)**CBS-3 Digital Banking Services**
#### Introduction
[](https://cta-redirect.hubspot.com/cta/redirect/3893111/b82f4b68-92a3-4741-a22a-c2df4a0479f2)
[![\[OR\] \[MBSB\] \[E3\] \[CBS\] \[3\] \[SbPS\] Digital Banking Services](https://no-cache.hubspot.com/cta/default/3893111/6e7f0ef7-370b-4182-8814-6b83fe57964a.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/6e7f0ef7-370b-4182-8814-6b83fe57964a)
Identifying Severe but Plausible Scenarios is a critical step in determining whether MBSB can continue delivering CBS-3 Digital Banking Services during major operational disruption without exceeding its approved Impact Tolerance.
Rather than assessing technology failures in isolation, scenario identification examines how credible disruptive events affect customers' ability to access accounts, authenticate securely, obtain reliable financial information, initiate transactions, complete payments, and receive assistance.
The 24 Sub-CBS processes provide a structured basis for identifying vulnerabilities throughout the digital banking service lifecycle.
They allow MBSB to examine how disruption originates within a process, propagates through supporting systems and external dependencies, and affects other interconnected Critical Business Services.
Cyber and ICT Risks must be integrated throughout this assessment because ransomware, distributed denial-of-service attacks, compromised identities, data corruption, failed technology changes, network outages and technology concentration can trigger or amplify severe operational disruption.
However, scenario identification must also consider people, processes, facilities, third parties, crisis decisions and alternative service arrangements.
The objective is to develop scenarios that challenge MBSB's actual resilience capability, identify weaknesses before a major incident occurs, and provide a defensible foundation for subsequent scenario testing, management oversight and continuous improvement.
Assessment qualification: The scenarios in this chapter are illustrative recommendations based on a plausible Malaysian banking operating model.
They are not statements that MBSB has experienced these incidents, uses particular proprietary systems or has confirmed the vulnerabilities described.
#### **Scenario Identification and Assessment Methodology**
##### **Definition of a Severe but Plausible Scenario**
For CBS-3, a Severe but Plausible Scenario is a credible disruptive event that creates sufficient operational stress to challenge MBSB's ability to maintain essential digital banking outcomes within its approved Impact Tolerance.
An appropriate scenario should establish the initiating event, the affected Sub-CBS processes, the supporting dependencies that fail or become degraded, the progression of the disruption, and the consequences for customers and connected financial services.
A scenario is not sufficiently developed if it merely states that a system becomes unavailable.
It should explain why the failure occurs, how existing controls are challenged, what additional complications arise, and which customer outcomes are threatened.
##### **Scenario Selection Criteria**
MBSB should evaluate proposed scenarios against the following criteria.
| Selection Criterion | Assessment Question | Application to CBS-3 |
| --- | --- | --- |
| Credibility | Could the event reasonably occur in the banking operating environment? | Consider cyber threats, incident experience, known technology failure modes and external dependencies. |
| Severity | Would the event materially challenge the bank's existing resilience arrangements? | Include prolonged disruption, widespread customer impact, integrity compromise or simultaneous dependency failures. |
| Customer harm | Could the disruption prevent essential banking outcomes or cause financial harm? | Assess access to funds, payment completion, transaction accuracy, security and customer assistance. |
| Dependency propagation | Could the failure spread beyond the originating Sub-CBS? | Examine shared authentication, core banking, payment processing, telecommunications and hosting dependencies. |
| Cyber and ICT integration | Could a cyber or technology failure initiate, amplify or prolong the event? | Consider compromised credentials, failed changes, ransomware, data corruption and infrastructure concentration. |
| Control challenge | Would the scenario test more than routine incident procedures? | Introduce capacity constraints, incomplete information, conflicting priorities or failed fallback arrangements. |
| Testability | Can you measure performance and customer outcomes? | Define observations, timestamps, transaction integrity checks, affected customer populations and decision records. |
| Impact Tolerance relevance | Could the scenario cause CBS-3 to exceed an approved harm boundary? | Compare actual or simulated outcomes with duration, service capability, customer impact and integrity thresholds. |
##### **Relationship with the Proposed CBS-3 Impact Tolerance**
The preceding chapter proposed the following illustrative assessment parameters, which should be used consistently when developing the scenarios in this chapter.
| Impact Tolerance Dimension | Illustrative Assessment Parameter |
| --- | --- |
| Maximum material disruption duration | 2 consecutive hours without an effective alternative |
| Affected customer boundary | 20% of active digital banking customers are unable to complete essential journeys |
| Minimum essential journey completion | 80% of legitimate attempted essential journeys |
| Material financial data integrity compromise | No tolerance for uncontrolled, unauthorised transactions or materially incorrect authoritative financial outcomes |
| Other harm considerations | Urgent customer needs, vulnerable customers, regulatory obligations, connected CBS disruption and financial-system consequences |
These values are not BNM-prescribed thresholds or approved MBSB limits.
They are starting assumptions that MBSB's business owners, risk functions, technology owners, and senior management must validate.
A scenario may indicate an Impact Tolerance breach when it crosses any approved material-harm boundary.
Do not treat a two-hour duration as a permissible waiting period if significant financial harm or compromised transaction integrity occurs earlier.
##### **Scenario Development Sequence[![PIC \[OR\] \[E1\] \[E2\] \[E3\] \[SbPS\] Severe but Plausible Scenarios Development](https://no-cache.hubspot.com/cta/default/3893111/3040e004-5a2f-4f69-9d5e-0c4edbcc840d.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/3040e004-5a2f-4f69-9d5e-0c4edbcc840d)**
[![Banner \[Table\] \[OR\] \[E3\] Identify Severe but Plausible Scenarios](https://no-cache.hubspot.com/cta/default/3893111/f4f3c007-e864-48cd-8bc1-0242c8b7fd86.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/f4f3c007-e864-48cd-8bc1-0242c8b7fd86)
#### **Recommended Severe but Plausible Scenarios for CBS-3**
Table 1 presents 24 scenarios corresponding to the complete Sub-CBS catalogue. The scenarios cover different initiating events and failure mechanisms rather than repeating a generic system outage.
The proposed events are severe enough to challenge continuity, security, transaction integrity or recovery capability, while remaining credible for a financial institution providing digital banking services.
Table P5 — Recommended Severe but Plausible Scenarios for CBS-3
| Sub-CBS Code | Name of Sub-CBS | Recommended Severe but Plausible Scenario | Scenario Description | Primary Disruption Trigger | Impact on Sub-CBS | Impact on Critical Business Service |
| --- | --- | --- | --- | --- | --- | --- |
| CBS-3.1 | Digital Banking Customer Registration and Enrolment | Compromised identity verification service during a surge in customer enrolment | A third-party identity verification interface begins returning inconsistent decisions following a security incident. At the same time, abnormal registration volumes overwhelm exception-handling staff. The bank suspends enrolment while it investigates the integrity of prior decisions. | A compromise of the identity verification provider, combined with a processing surge. | The bank cannot reliably verify new registrations and must investigate enrolment backlogs and potentially fraudulent registrations. | New customers cannot obtain digital banking access. The bank must balance service continuity with the risk of activating unauthorised customer profiles. |
| CBS-3.2 | Digital Banking Access Activation and Maintenance | Mass customer access lockout following an erroneous identity policy deployment | A security policy change incorrectly invalidates registered devices or access entitlements. Rollback is delayed because the same administrative platform is degraded, while contact centres experience a surge in reactivation requests. | Failed identity and access management configuration change. | Access activation, suspension and reactivation processes become unreliable or unavailable. | Large numbers of legitimate customers cannot access digital banking; insecure emergency overrides could increase account compromise risk. |
| CBS-3.3 | Digital Banking Channel Access and Service Availability | Coordinated a DDoS attack during peak digital banking demand | A sustained DDoS attack overwhelms the internet-facing infrastructure while legitimate customer traffic is already elevated. Traffic diversion adds latency, and shared network dependencies prevent effective failover between mobile and internet banking channels. | DDoS attack combined with network capacity and concentration constraints. | Digital channel availability and customer request processing deteriorate significantly. | Customers cannot access essential banking functions across multiple channels, potentially exceeding customer-scope and duration boundaries. |
| CBS-3.4 | Digital Customer Authentication and Identity Verification | Shared authentication platform compromise and emergency shutdown | Indicators of privileged account compromise require isolation of the central authentication service. Replacement authentication infrastructure cannot immediately establish trusted identity records, while other transaction services rely on the same authentication capability. | Privileged access compromise affecting shared identity infrastructure. | Customer authentication becomes unavailable or must be restricted for security reasons. | Digital access and transaction authorisation fail simultaneously; interconnected CBS-8 and payment services may also be affected. |
| CBS-3.5 | Digital Session Establishment and Management | Session infrastructure failure is causing interrupted and potentially duplicated customer transactions | A failed application deployment causes session tokens to expire unexpectedly. Customers repeatedly retry interrupted payment journeys, while session-state recovery is inconsistent between application instances. | Failed software deployment and session-state synchronisation failure. | Secure sessions cannot be maintained consistently, and interrupted customer activities cannot be reliably resumed. | Customers experience incomplete journeys and uncertainty about whether transactions were submitted, increasing duplicate-payment risk. |
| CBS-3.6 | Digital Access Security and Customer Account Protection | Coordinated account takeover attack during security-control degradation | Attackers use stolen credentials and social engineering to target customer accounts. At the same time, a security-control integration failure delays protective restrictions and account compromise alerts. | Credential compromise and fraud-control integration failure. | Compromised accounts cannot be restricted promptly, while legitimate access restoration becomes backlogged. | Unauthorised activity may cause immediate financial harm and undermine confidence in digital banking security. |
| CBS-3.7 | Digital Account Information Retrieval and Presentation | Corrupted account balance information following core banking data synchronisation failure | A defective data synchronisation process produces inconsistent balances across core banking and digital channels. The issue is detected after some customers have initiated payments using incorrect available-balance information. | Data replication defect or failed technology change. | Digital account information becomes inaccurate or stale; affected account views must be restricted pending validation. | Customers may make incorrect financial decisions, encounter failed payments or suffer financial harm even while the channel remains available. |
| CBS-3.8 | Digital Transaction History and Statement Services | Ransomware is affecting transaction history and statement repositories | Ransomware encrypts transaction history and statement records. Uncertainty about backup integrity and the need to preserve records for investigations and customer disputes complicate recovery. | Ransomware is affecting transaction records and document storage. | Historical transactions and statements become unavailable or untrustworthy. | Customers cannot verify transactions or obtain important financial records; prolonged disruption increases complaints and investigation backlogs. |
| CBS-3.9 | Digital Customer Profile and Banking Preference Management | Unauthorised customer contact changes through a compromised profile management interface | An attacker exploits compromised administrative credentials or a vulnerable interface to alter customer contact details. Security and transaction notifications may then be diverted or suppressed. | Privileged credential compromise or API exploitation. | Customer profile integrity is compromised, and profile changes require investigation and reversal. | Account protection and customer communications are weakened, potentially enabling further unauthorised transactions. |
| CBS-3.10 | Digital Banking Service Request Management | Loss of service request processing during simultaneous system and staffing disruption | A workflow application fails during a period of elevated customer demand. A regional transport or facility disruption also reduces the availability of specialist staff needed to process urgent account and financing requests. | Workflow platform outage combined with the loss of critical operational personnel. | Requests accumulate; urgent cases cannot be prioritised or completed reliably. | Customers experience delayed essential servicing, potentially affecting account access, financing obligations and complaint volumes. |
| CBS-3.11 | Digital Financial Transaction Initiation | Transaction initiation overload with uncertain submission outcomes | A sudden increase in payment traffic exhausts application and API capacity. Some requests time out after submission but before acknowledgement, prompting customers to retry. | Capacity exhaustion and partial API failure. | Digital payment instructions cannot be submitted reliably, and duplicate attempts become difficult to distinguish. | Essential payments are delayed or duplicated; customer transaction volumes and completion rates deteriorate. |
| CBS-3.12 | Digital Transaction Validation and Authorisation Coordination | Compromised transaction authorisation rules during a major payment processing period | An unauthorised change to transaction approval rules rejects valid transactions while some high-risk transactions bypass expected controls. Emergency rollback is delayed because approval services are shared across multiple payment channels. | Privileged access misuse or compromised authorisation configuration. | Transaction validation and authorisation decisions become unreliable. | Legitimate payments are blocked while unauthorised transactions may proceed, creating immediate integrity and financial-harm concerns. |
| CBS-3.13 | Digital Payment and Funds Transfer Processing Coordination | Payment interface disruption with message duplication and delayed acknowledgements | A network routing failure interrupts communication between digital banking and the underlying payment service. Message queues accumulate, and automated retries create duplicate or out-of-sequence instructions. | Network routing disruption and payment messaging failure. | Payment instructions cannot be transferred or confirmed reliably. | Customers face incomplete or duplicated payment outcomes, with potential cascading disruption to CBS-2 Domestic Funds Transfer and Payment Services. |
| CBS-3.14 | Digital Financing and Account Servicing Transactions | Financing servicing failure during a critical repayment period | A financing platform becomes unavailable following a database integrity issue. Repayment requests cannot be processed consistently, while alternative servicing arrangements face high demand and limited specialist capacity. | Financing database corruption combined with operational capacity constraints. | Digital financing balances, servicing instructions, and repayment outcomes become unavailable or unreliable. | Customers may be unable to meet repayment obligations or verify payments, potentially causing financial consequences. |
| CBS-3.15 | Digital Transaction Status and Completion Management | Incorrect payment completion status caused by event messaging and clock synchronisation failure | Transaction completion messages arrive out of sequence after a time synchronisation failure. Some completed payments appear pending, while failed transactions are incorrectly displayed as successful. | Time synchronisation and event messaging failure. | Transaction status cannot be reconciled consistently with authoritative payment records. | Customers may repeat payments or rely on incorrect completion information, creating immediate financial integrity concerns. |
| CBS-3.16 | Digital Banking Customer Notification and Alert Management | Critical messaging provider outage during widespread suspicious account activity | A telecommunications or messaging provider outage prevents the delivery of security warnings and transaction notifications, while fraud monitoring detects unusual activity. An alternative notification route is not immediately available. | Third-party telecommunications or messaging service disruption. | Customer alerts cannot be delivered within the required operational timeframe. | Customers may remain unaware of unauthorised activity or payment outcomes, amplifying financial harm and uncertainty. |
| CBS-3.17 | Digital Banking Customer Enquiry and Assistance Management | Customer support capacity collapses during a simultaneous digital banking outage | Digital banking becomes unavailable during a regional telecommunications disruption. Customer enquiries surge, but contact centre connectivity and staffing are also reduced, leaving urgent cases unanswered. | Telecommunications failure combined with constraints on customer support capacity and personnel. | Customer assistance channels become congested or unavailable. | Customers cannot access essential banking services or obtain timely help, worsening the consequences of the underlying CBS-3 disruption. |
| CBS-3.18 | Digital Banking Complaint and Service Issue Resolution | Loss of investigation records during a surge in disputed digital transactions | A cyber incident affects the case management repository, while a payment integrity issue generates a high volume of disputes. Investigators cannot access complete transaction evidence, delaying customer redress. | A cyberattack or data corruption affects complaint and investigation records. | Complaint investigation, evidence retrieval, and issue resolution become severely delayed. | Financially affected customers remain without resolution, potentially increasing conduct, compliance and reputational consequences. |
| CBS-3.19 | Digital Banking Service Performance and Availability Monitoring | Monitoring blind spot during progressive customer journey degradation | A monitoring configuration change suppresses key application alerts. Digital transaction success rates decline, but infrastructure dashboards remain normal, and customers initially detect the disruption through complaints. | Failed monitoring configuration change and inadequate end-to-end telemetry. | Service degradation goes undetected or is not escalated promptly. | Customer harm accumulates because response teams underestimate the scale and duration of digital banking disruption. |
| CBS-3.20 | Digital Banking Security Event Detection and Response Coordination | Coordinated a ransomware attack with compromised security monitoring | Attackers compromise privileged credentials, interfere with security logging, and deploy ransomware across shared digital banking infrastructure. Containment requires isolating systems that support several customer-facing services. | Advanced cyber intrusion, privileged access compromise, and ransomware. | Threat detection, investigation, and containment are impaired while critical systems become unavailable. | Digital banking may suffer prolonged disruption and potential data integrity compromise, with cascading effects across interconnected CBSs. |
| CBS-3.21 | Digital Banking Incident Assessment and Service Escalation | Delayed crisis escalation caused by incomplete cross-service impact information | A shared technology failure disrupts digital banking, authentication, and payment services. Separate operational teams initially classify the event as isolated incidents, delaying coordinated escalation and activation of continuity plans. | Fragmented incident management, incomplete dependency visibility, and communication failure. | Incident severity and affected customer outcomes are assessed incorrectly or too slowly. | Multiple CBSs deteriorate simultaneously, and delayed management decisions increase the likelihood of exceeding Impact Tolerance. |
| CBS-3.22 | Digital Banking Continuity and Alternative Service Delivery | Regional flooding disables digital operations and overwhelms alternative banking channels | Severe flooding disrupts access to operational facilities, electricity, and telecommunications. Digital services degrade, while branches and contact centres intended to provide alternative support are also affected or overwhelmed. | Regional natural hazards, utility disruptions, and concentration on alternative channels. | Continuity arrangements cannot be activated at the expected capacity or within the required timeframe. | Customers lose both normal digital access and practical alternatives for essential banking activities. |
| CBS-3.23 | Digital Banking Technology Recovery and Service Reinstatement | Simultaneous primary and recovery environment failure following destructive cyber compromise | A destructive cyberattack affects production systems and replicates recovery data. Recovery infrastructure shares administrative or data dependencies with the compromised environment, delaying clean restoration. | A destructive cyberattack combined with concentrated recovery architecture. | Digital banking technology cannot be safely reinstated using standard recovery arrangements. | Essential digital banking services remain unavailable beyond planned recovery targets, potentially affecting other CBSs using shared infrastructure. |
| CBS-3.24 | Digital Banking Service Restoration and Post-Incident Validation | Premature digital banking restoration with unresolved transaction integrity defects | After a major outage, digital channels reopen before all payment states and account records are reconciled. Customers encounter incorrect balances, duplicate transaction statuses, and intermittent failures. | Inadequate recovery validation, unresolved data inconsistency, and pressure to restore services. | Business validation and controlled restoration fail to establish that customer journeys are safe and reliable. | A second disruption or material financial integrity event occurs after apparent recovery, potentially creating unacceptable harm. |
##### **Analysis of the Scenario Portfolio**
The 24 scenarios collectively address the complete digital banking lifecycle.
The early processes focus on customer registration, access, identity assurance and channel availability.
The middle processes examine information accuracy, service requests, payment initiation, transaction authorisation, processing coordination and completion integrity.
The later processes challenge customer communication, incident detection, escalation, continuity, technology recovery and safe restoration.
This distribution matters because a digital banking service can fail in several ways.
Customers may be unable to access the service, may receive inaccurate information, may be unable to complete transactions, or may receive unreliable confirmation of financial outcomes.
The scenarios also incorporate operational stressors that can amplify a technology incident, including high customer demand, reduced staffing, inaccessible facilities, ineffective escalation, limited alternative-channel capacity and simultaneous failure of primary and recovery arrangements.
The scenario portfolio should therefore be assessed as an interconnected set of threats to customer outcomes, not as 24 independent application recovery tests.
#### **Interdependencies, Cyber and ICT Risk Integration, Impact Tolerance and Proactive Risk Management**
Table 2 translates the 24 scenarios into actionable resilience assessments. It identifies the critical dependencies challenged, explains how Cyber and ICT Risks contribute to disruption, evaluates the potential for an Impact Tolerance breach, and establishes preventive actions and auditable evidence.
Breach assessment convention: A scenario is classified as Potential — High where it could materially exceed an approved duration, customer-impact or essential service capability boundary. Potential — Immediate integrity concern indicates that unacceptable financial or security harm could arise before a duration threshold is reached. Neither classification implies that a breach has occurred at MBSB.
Table 2 — Interdependencies, Cyber and ICT Risk Integration, Impact Tolerance and Proactive Risk Management
| Sub-CBS Code | Name of Sub-CBS | Interconnections and Interdependencies Challenged | Cyber and ICT Risk Linkage | Potential Impact Tolerance Breach | Proactive Risk Management Action | Evidence of Proactive Risk Management | Scenario Testing Objective |
| --- | --- | --- | --- | --- | --- | --- | --- |
| CBS-3.1 | Digital Banking Customer Registration and Enrolment | Customer onboarding, identity verification, customer records, third-party verification services and CBS-1 account access. | A third-party API compromise or outage is the trigger; abnormal traffic and insufficient exception capacity amplify disruption. | Potential — Conditional. Prolonged inability to enrol customers may cause significant harm by delaying access to essential banking services. | Establish provider contingency arrangements, enhanced enrolment fraud detection, secure exception processing and surge staffing. | Third-party assurance; API failover results; enrolment fraud-control tests; backlog recovery exercise. | Verify that legitimate enrolment can be resumed securely without accepting unverified identities or losing application records. |
| CBS-3.2 | Digital Banking Access Activation and Maintenance | Identity and Access Management, customer service, device registration, access administration and CBS-8 authentication. | Failed access-policy deployment triggers mass lockouts; shared administrative platform failure delays rollback. | Potential — High. Affected customers may exceed the 20% illustrative boundary or remain unable to access essential services beyond two hours. | Implement staged deployments, automated rollback, independent administrative recovery and controlled mass-reactivation procedures. | Change approval records; rollback tests; access restoration exercise; privileged access review. | Demonstrate timely restoration of legitimate customer access without weakening security controls. |
| CBS-3.3 | Digital Banking Channel Access and Service Availability | Mobile and internet banking, internet connectivity, application infrastructure, hosting, API gateways and CBS-1/CBS-2. | DDoS is the trigger; network concentration and insufficient capacity amplify the outage. | Potential — High. Widespread inability to complete essential journeys could breach duration, customer-scope and completion boundaries. | Strengthen DDoS mitigation, network diversity, capacity management, application failover and customer journey monitoring. | DDoS simulation; network resilience review; load test; failover report; provider assurance. | Verify that essential customer journeys remain available or recover within the approved tolerance during a sustained attack. |
| CBS-3.4 | Digital Customer Authentication and Identity Verification | Shared authentication services, customer identity records, security operations, CBS-8 and transaction authorisation. | Privileged access compromise triggers protective isolation; authentication concentration amplifies cross-service disruption. | Potential — High, with immediate integrity concern. Customer access may fail widely, while untrusted authentication decisions may expose accounts. | Segregate privileged access, test clean authentication recovery, validate trusted identity data and develop secure emergency access arrangements. | Privileged access assessment; cyber simulation; authentication failover report; identity integrity testing. | Demonstrate secure authentication recovery while preventing unauthorised access and controlling downstream CBS disruption. |
| CBS-3.5 | Digital Session Establishment and Management | Digital applications, session stores, authentication, transaction initiation and customer payment interfaces. | Failed deployment triggers session instability; state replication defects amplify duplicate submission risks. | Potential — High. Essential journey completion may fall below 80%, with possible transaction integrity exceptions. | Test session failover, controlled token invalidation, idempotent transaction submission and safe retry handling. | Application resilience tests; deployment validation; duplicate prevention tests; session monitoring. | Confirm that interrupted sessions do not result in unauthorised or duplicate transactions and that customers can resume essential activities safely. |
| CBS-3.6 | Digital Access Security and Customer Account Protection | Fraud operations, identity controls, account restriction interfaces, customer support and CBS-8. | Credential attacks trigger account takeover attempts; failed fraud-control integration prolongs exposure. | Potential — Immediate integrity concern. Material unauthorised transactions could constitute unacceptable harm regardless of duration. | Strengthen account takeover detection, independent account restriction capability, fraud escalation and secure reactivation. | Fraud-control effectiveness results; account restriction test; incident simulation; remediation register. | Verify that compromised accounts can be identified, restricted and restored without exposing customer funds. |
| CBS-3.7 | Digital Account Information Retrieval and Presentation | Core banking records, account information APIs, customer channels, CBS-1 and CBS-2. | Data replication defect triggers inaccurate balances; stale caching and weak reconciliation amplify harm. | Potential — Immediate integrity concern. Materially incorrect authoritative financial outcomes may be intolerable even during short disruption. | Implement freshness validation, authoritative balance reconciliation, automatic suppression of unreliable information and tested data recovery. | Data integrity tests; reconciliation reports; replication monitoring; recovery exercise. | Establish whether inaccurate balances are detected and contained before customers make unsafe financial decisions. |
| CBS-3.8 | Digital Transaction History and Statement Services | Transaction repositories, records management, document delivery, customer service and CBS-1/CBS-2. | Ransomware triggers record unavailability; compromised backups prolong recovery. | Potential — Conditional. Significant harm may arise if records remain unavailable for urgent financial or dispute needs. | Protect historical records, maintain isolated recovery copies, validate backup integrity and prioritise urgent record requests. | Backup restoration report; record integrity testing; ransomware exercise; access-control review. | Demonstrate trustworthy restoration of transaction records and continuity of essential evidence retrieval. |
| CBS-3.9 | Digital Customer Profile and Banking Preference Management | Customer master records, identity controls, messaging services, fraud operations and CBS-8. | Compromised administrative access or API exploitation triggers unauthorised profile changes. | Potential — Immediate integrity concern. Diverted security notifications may enable account compromise or financial loss. | Enforce strong approval for sensitive profile changes, independent customer confirmation, anomaly detection and rapid reversal. | Profile integrity testing; access logs; change-control review; fraud simulation. | Confirm that malicious profile changes are detected, contained and reversed before downstream fraud occurs. |
| CBS-3.10 | Digital Banking Service Request Management | Workflow services, customer service, financing operations, specialist staff, facilities and CBS-1/CBS-5. | Workflow failure is the ICT trigger; loss of specialist personnel amplifies the backlog. | Potential — Conditional. Urgent servicing failures may cause material customer harm despite partial digital channel availability. | Establish controlled manual processing, urgent-case prioritisation, cross-trained staff and workflow queue recovery. | BCM exercise; workforce contingency plan; workflow recovery report; backlog ageing records. | Demonstrate that urgent service requests can be identified and fulfilled during simultaneous system and staffing disruption. |
| CBS-3.11 | Digital Financial Transaction Initiation | Digital channels, account information, payment initiation APIs, CBS-2 and customer authentication. | Capacity exhaustion triggers timeouts; partial API failures and repeated retries amplify transaction uncertainty. | Potential — High. Essential journey completion may fall below 80%, with customer-scope or integrity consequences. | Implement capacity headroom, request identifiers, safe retry controls, queue management, and transaction-initiation monitoring. | Stress testing; API resilience results; duplicate prevention tests; transaction reconciliation. | Verify that essential transactions can be initiated or safely deferred without duplication during severe demand. |
| CBS-3.12 | Digital Transaction Validation and Authorisation Coordination | CBS-8, fraud controls, payment processing, authorisation rules, privileged administration and CBS-2. | Privileged rule manipulation triggers invalid authorisation decisions; shared services amplify cross-channel impact. | Potential — Immediate integrity concern. Unauthorised transactions or compromised approval decisions may cause intolerable harm. | Segregate critical rule changes, enforce dual approval, monitor anomalous decisions and test secure rollback. | Rule-change audit; penetration testing; authorisation control tests; privileged access review. | Demonstrate that unauthorised transactions are blocked and legitimate transactions can be restored safely. |
| CBS-3.13 | Digital Payment and Funds Transfer Processing Coordination | Payment gateways, message queues, CBS-2, payment networks, telecommunications and reconciliation. | Network routing failures trigger messaging disruptions; retries and queue inconsistencies amplify payment integrity risks. | Potential — High, with immediate integrity concern. Payment completion and status may become unreliable across many customers. | Implement resilient interfaces, durable messaging, duplicate suppression, controlled queue replay and reconciliation. | Payment failover test; queue recovery report; reconciliation results; network resilience review. | Verify that authorised payments are neither lost nor duplicated and that customers receive reliable outcomes. |
| CBS-3.14 | Digital Financing and Account Servicing Transactions | Financing systems, core banking, repayment interfaces, specialist staff, CBS-5 and CBS-2. | Database corruption triggers servicing failure; capacity constraints prolong repayment processing. | Potential — High. Customers may miss time-sensitive obligations or receive inaccurate repayment information. | Establish financing data integrity controls, alternative repayment processing and priority handling for due-date-sensitive transactions. | Financing recovery exercise; repayment reconciliation; servicing continuity plan; exception reports. | Confirm that urgent financing obligations can be serviced accurately during prolonged platform disruption. |
| CBS-3.15 | Digital Transaction Status and Completion Management | Payment processing, event messaging, time services, transaction records, CBS-2 and customer channels. | Clock synchronisation and messaging failures trigger out-of-sequence or incorrect transaction status. | Potential — Immediate integrity concern. Incorrect payment confirmation may cause duplicate payments and direct financial harm. | Validate event ordering, synchronised timestamps, authoritative status reconciliation and safe handling of unknown outcomes. | Time synchronisation tests; transaction-state reconciliation; event replay tests; exception monitoring. | Demonstrate accurate payment status and prevention of duplicate transactions under messaging failure. |
| CBS-3.16 | Digital Banking Customer Notification and Alert Management | Messaging providers, telecommunications, customer contact records, fraud operations, CBS-8 and CBS-9. | Third-party messaging outage triggers alert failure; simultaneous fraud activity amplifies customer exposure. | Potential — High. Delayed critical security warnings may increase financial harm before duration thresholds are reached. | Establish independent priority alert routes, delivery monitoring, provider contingency arrangements and fraud-response escalation. | Messaging failover results; provider assurance; alert delivery tests; incident communication exercise. | Verify timely delivery of essential security and transaction information through viable alternatives. |
| CBS-3.17 | Digital Banking Customer Enquiry and Assistance Management | Contact centres, telecommunications, customer records, branches, CBS-9 and incident communications. | Telecommunications failure is the trigger; exhausted support capacity amplifies the consequences of a digital outage. | Potential — High. Customers may lose essential digital access and assistance simultaneously. | Test alternative contact routes, surge staffing, priority support for urgent needs and independent incident communications. | Contact centre continuity exercise; capacity test; CBS-9 joint exercise; support queue reports. | Demonstrate that urgent customer assistance remains accessible during widespread digital and communications disruption. |
| CBS-3.18 | Digital Banking Complaint and Service Issue Resolution | Complaint systems, transaction evidence, investigators, compliance, payment operations and CBS-9. | Cyberattacks or data corruption can make evidence unavailable; dispute surges can overwhelm specialist capacity. | Potential — High. Unresolved financial disputes may prolong customer harm and create compliance exposure. | Protect investigation records, establish priority redress procedures, test evidence recovery and expand specialist contingency capacity. | Complaint recovery test; evidence integrity review; case ageing reports; compliance monitoring. | Verify that materially harmful disputes can be investigated and prioritised even when normal case systems fail. |
| CBS-3.19 | Digital Banking Service Performance and Availability Monitoring | Monitoring systems, customer journey telemetry, technology operations, incident management and CBS owners. | A failed monitoring change creates a detection gap; incomplete telemetry prolongs disruption. | Potential — High. Unrecognised degradation may exceed customer-impact or duration boundaries before escalation. | Implement independent synthetic monitoring, alert validation, customer journey thresholds and fallback monitoring procedures. | Monitoring coverage assessment; alert simulation; synthetic test reports; detection-gap remediation. | Verify that significant customer-facing degradation is detected, classified and escalated before harm becomes intolerable. |
| CBS-3.20 | Digital Banking Security Event Detection and Response Coordination | Security operations, privileged identity, digital applications, core banking, recovery teams and interconnected CBSs. | Privileged compromise and ransomware initiate the incident; tampered logs and shared infrastructure amplify impact. | Potential — High, with immediate integrity concern. Major service unavailability and compromised financial data may occur together. | Run threat-led exercises, strengthen independent security logging, segregate administration, and test containment and clean recovery. | Cyber incident simulation; detection testing; privileged access review; cyber recovery report; remediation tracking. | Demonstrate effective containment, trusted recovery and preservation of essential customer outcomes during coordinated cyberattack. |
| CBS-3.21 | Digital Banking Incident Assessment and Service Escalation | Incident management, technology operations, CBS-1/CBS-2/CBS-8 owners, crisis management and communications. | Shared technology failures trigger multiple incidents; fragmented telemetry and communication delays amplify response failures. | Potential — High. Delayed decisions may cause multiple CBSs to exceed approved disruption boundaries. | Define CBS-level escalation triggers, cross-service impact assessment, alternative crisis communications and decision authority. | Crisis exercise; escalation matrix; incident timeline; management decision records. | Verify that cross-CBS impacts are recognised and continuity decisions are made before tolerance limits are exceeded. |
| CBS-3.22 | Digital Banking Continuity and Alternative Service Delivery | Branches, contact centres, facilities, electricity, telecommunications, core banking and CBS-1/CBS-9. | Regional flooding and utility disruption can trigger facility loss; shared dependencies and staffing shortages undermine alternatives. | Potential — High. Customers may lose both digital banking and viable alternative access for longer than the approved boundary. | Validate geographic separation, independent alternative channels, workforce contingencies, essential service prioritisation and capacity. | Regional BCM exercise; facility dependency review; alternative-channel capacity test; utility contingency evidence. | Demonstrate continued essential customer service despite simultaneous digital, facility and telecommunications disruption. |
| CBS-3.23 | Digital Banking Technology Recovery and Service Reinstatement | Primary and recovery hosting, backups, privileged administration, networks, identity services and dependent CBSs. | A destructive cyberattack triggers production loss; compromised replicated data and shared recovery controls prolong the outage. | Potential — High, with immediate integrity concern. Essential services may remain unavailable beyond two hours or recover with untrusted data. | Test isolated recovery, protected backups, administrative separation, recovery sequencing and integrity verification. | Disaster recovery test; cyber recovery report; backup integrity testing; architecture concentration assessment. | Verify that essential digital banking capabilities can be restored safely when normal production and recovery arrangements are simultaneously compromised. |
| CBS-3.24 | Digital Banking Service Restoration and Post-Incident Validation | Digital channels, core banking, payment reconciliation, cybersecurity, business validation and CBS-1/CBS-2. | Incomplete restoration and unresolved data defects trigger unsafe reopening; weak release controls amplify harm. | Potential — Immediate integrity concern. Incorrect balances or duplicate payments may cause unacceptable harm despite technical recovery. | Require joint business and security acceptance, transaction reconciliation, end-to-end journey testing, enhanced monitoring and rollback capability. | Restoration approval records; reconciliation reports; security clearance; end-to-end test results; post-incident review. | Demonstrate that restoration is approved only after essential customer journeys and financial data integrity are verified. |
##### **Management Observations Arising from Table 2**
The scenarios reveal five important resilience considerations for MBSB.
First, shared dependencies can create disproportionate disruption.
A failure affecting authentication, core banking, payment interfaces or telecommunications may simultaneously impair several Sub-CBS processes and other Critical Business Services.
Second, data integrity failures may be more damaging than temporary unavailability.
Incorrect balances, unauthorised transactions and misleading payment status can cause financial harm before the illustrative two-hour duration boundary is reached.
Third, operational capacity matters during technology incidents.
Even where backup technology exists, insufficient personnel, inaccessible facilities or overwhelmed customer support may prevent essential customer outcomes from being maintained.
Fourth, alternative arrangements must be demonstrably independent.
A recovery site or alternative channel that relies on the same compromised identity platform, core banking database or telecommunications provider may fail at the same time as the primary service.
Fifth, technical recovery alone does not establish service resilience.
CBS-3 should be regarded as safely restored only when customers can complete essential banking activities using trusted information and reliable transaction controls.
#### **Regulatory Considerations for a Malaysian Financial Services Institution**
##### **Reference to the BNM Operational Resilience Discussion Paper**
The principal regulatory reference for this chapter is Bank Negara Malaysia's Operational Resilience — Discussion Paper, issued on 19 December 2025, reference BNM/RH/DP 028-25.
The Discussion Paper outlines BNM's emerging direction to strengthen operational resilience and explores how Malaysian financial institutions can better preserve essential financial services during severe disruption.
It identifies the importance of understanding critical services, mapping dependencies, establishing disruption tolerances, evaluating severe but plausible scenarios, strengthening governance and learning from incidents.
Regulatory status: The document is a Discussion Paper, not a final standalone Operational Resilience policy document. Its proposals, questions and emerging supervisory direction must be distinguished from obligations established under BNM's existing applicable policy documents.
##### **Explicit BNM Discussion Themes and their Relevance**
| BNM Reference | Explicit Discussion Paper Content | Relevance to CBS-3 Scenario Identification |
| --- | --- | --- |
| Paragraphs 2.2–2.4 | Discusses disruptions from cyber incidents, technology failures, third-party outages, compromised information assets, and power failures, alongside growing digital and cloud dependencies. | Supports consideration of ransomware, data corruption, network disruption, infrastructure failure and third-party dependency scenarios. |
| Paragraphs 2.5–2.6 | Discusses customer dependence on digital financial access and concentration risks arising from interconnected financial infrastructure and service providers. | Supports testing widespread digital access failure, shared authentication disruption and common-provider outages. |
| Paragraph 2.7 | Identifies physical and climate-related risks affecting infrastructure, facilities and service availability. | Supports scenarios involving flooding, regional utility disruption, inaccessible facilities and degraded alternative arrangements. |
| Paragraphs 2.8–2.9 | Discusses Malaysian operational disruption experience and highlights the importance of end-to-end visibility, concurrent scenarios, customer-focused tolerances and board oversight. | Supports integrated testing of customer journeys and cascading failures rather than isolated application recovery tests. |
| Paragraph 3.3(b) | Identifies mapping internal and external interdependencies as a foundational operational resilience capability. | Supports using the CBS-3 dependency map to determine how failures propagate between Sub-CBS processes and interconnected services. |
| Paragraph 3.3(c) | Discusses third-party dependencies, contingency planning and viable alternative arrangements. | Supports challenging telecommunications, hosting, identity verification and other external service dependencies. |
| Paragraph 3.3(d) | Discusses tolerances for disruption, including duration, customer or market harm and minimum service capability. | Supports linking every scenario to approved CBS-3 Impact Tolerance measures. |
| Paragraph 3.3(e) | Discusses assessing capabilities under severe but plausible scenarios, including challenging assumptions and anticipating multilayered failures. | Supports combined cyber, operational, ICT and recovery failure scenarios that reveal weaknesses in existing arrangements. |
| Paragraphs 3.4–3.5 | Discusses board and senior management ownership, resource decisions, periodic reviews and continuous improvement. | Supports management-approved scenario portfolios, documented results, remediation and retesting. |
| Paragraphs 4.3–4.5 | Explains how existing BCM, Risk Management in Technology and outsourcing requirements address recovery, technology resilience and external dependencies. | Supports integrating scenario analysis with established BCM, ICT risk, cybersecurity and third-party management processes. |
Source: BNM Operational Resilience Discussion Paper, December 2025.
##### **Disruption Examples Explicitly Discussed by BNM**
The Discussion Paper provides several examples of operational disruption that are particularly relevant to a Malaysian banking institution.
These include:
- A mobile application outage linked to insufficient mainframe storage in a core banking environment, affecting QR payments and funds transfers.
- A core banking outage following an unsuccessful disaster recovery test affected multiple banking channels.
- A ransomware incident associated with weak cybersecurity controls, including obsolete servers and inadequate multifactor authentication.
- International examples include failed technology migrations, payment and settlement infrastructure outages, and widespread power disruptions that affected access to financial services.
These examples appear in the Discussion Paper's discussion of operational disruptions and accompanying notes.
They show why MBSB's scenario portfolio should challenge core banking capacity, recovery change management, cyber control weaknesses, and common infrastructure dependencies.
The 24 detailed CBS-3 scenarios developed in this chapter are consultant implementation recommendations.
They are not scenarios prescribed by BNM.
##### **Alignment with Existing Regulatory Frameworks**
The Discussion Paper explains how operational resilience relates to existing BNM policy areas, including BCM, Risk Management in Technology, outsourcing, operational risk, and governance.
MBSB should therefore integrate the CBS-3 scenario portfolio with existing arrangements rather than create an entirely separate testing and risk management structure.
| Existing Management Discipline | Integration with CBS-3 Scenarios | Recommended Evidence |
| --- | --- | --- |
| Business Continuity Management | Validate essential customer activities, alternative delivery arrangements, critical personnel and recovery coordination. | Business continuity plans; exercise reports; recovery objectives; corrective actions. |
| ICT Risk and Technology Resilience | Challenge technology availability, architecture concentration, failed changes, recovery arrangements and capacity. | ICT risk assessments; architecture reviews; failover and disaster recovery tests. |
| Cybersecurity | Test attack detection, containment, privileged access protection, data integrity and clean recovery. | Cyber threat assessments; penetration testing; incident simulations; cyber recovery evidence. |
| Operational Risk Management | Assess disruption pathways, control weaknesses, residual risks and operational losses. | Risk assessments; control testing; incident analysis; risk treatment records. |
| Third-Party Risk Management | Challenge provider resilience, concentration, substitutability and contingency arrangements. | Due diligence; third-party assurance; dependency assessments; contingency tests. |
| Crisis Management | Validate escalation, decision authority, customer communication and coordinated multi-CBS response. | Crisis exercise reports; escalation timelines; management decision logs. |
| Governance and Internal Audit | Provide oversight of scenario selection, testing quality, findings and remediation effectiveness. | Committee reporting; approved test programmes; remediation registers; independent assurance findings. |
Before formal regulatory use, MBSB should confirm the current status and applicability of each relevant BNM policy document, including any changes following the December 2025 Discussion Paper.
#### **Recommended Integrated Scenario Testing Programme**
Although the 24 scenarios provide comprehensive process coverage, testing each one independently would not necessarily demonstrate CBS-3's end-to-end resilience.
MBSB should combine related scenarios into fewer integrated exercises that challenge multiple Sub-CBS processes and interconnected Critical Business Services.
##### **Proposed Integrated Testing Groups**
| Test Programme | Scenario Coverage | Principal End-to-End Objective |
| --- | --- | --- |
| ST-01 Digital Customer Access and Identity Resilience | CBS-3.1–3.6 | Validate secure registration, access, authentication, session continuity and customer account protection under simultaneous identity and channel disruption. |
| ST-02 Digital Information and Customer Servicing Integrity | CBS-3.7–3.10 and CBS-3.14 | Verify accurate account and financing information, controlled servicing and continuity of urgent customer requests during data and operational disruption. |
| ST-03 Digital Financial Transaction Resilience | CBS-3.11–3.13 and CBS-3.15 | Validate essential transaction initiation, authorisation, payment coordination and reliable completion status under severe processing and messaging failures. |
| ST-04 Customer Communication and Support Resilience | CBS-3.16–3.18 | Assess the ability to provide security alerts, customer assistance and complaint resolution during simultaneous channel and communication failures. |
| ST-05 Detection, Cyber Response and Crisis Escalation | CBS-3.19–3.21 | Verify timely detection, cyber containment, cross-CBS impact assessment and coordinated crisis decision-making. |
| ST-06 Digital Banking Continuity, Cyber Recovery and Restoration | CBS-3.22–3.24, supported by relevant upstream Sub-CBS processes | Demonstrate that essential banking capability can continue or be safely restored despite primary and recovery failures, including data integrity and business validation. |
Each integrated exercise should include a defined customer population, simulated transaction volumes, realistic dependencies, failure injects, expected management decisions and measurable customer outcomes.
##### **Illustrative Integrated Scenario: Coordinated Cyberattack and Digital Banking Recovery Failure**
The following example combines several severe but plausible events into a single end-to-end exercise.
Scenario premise: A coordinated cyberattack disrupts customer authentication and digital banking channels during a high-demand payment period.
The attack compromises privileged administrative access, while recovery teams discover that replicated configuration data cannot be trusted. Customer support demand increases significantly, and management must decide whether to activate alternative service arrangements.
##### **Illustrative Scenario Injects**
| Exercise Stage | Scenario Inject | Expected Response | Key Observation |
| --- | --- | --- | --- |
| Initial disruption | Digital authentication success rates decline sharply while customer complaints increase. | Detect the disruption, identify the affected customer journeys and assess shared dependencies. | Time to detect and establish the scale of customer impact. |
| Escalation | Digital payment initiation begins failing across multiple customer segments. | Escalate to CBS-3 and CBS-2 owners; evaluate Impact Tolerance exposure. | Quality of cross-CBS coordination and impact assessment. |
| Cyber complication | Security teams identify evidence of privileged credential compromise. | Contain the compromise while preserving trusted customer authentication and financial records. | Speed and effectiveness of cyber containment decisions. |
| Recovery complication | Recovery configuration and replicated data cannot immediately be verified as trustworthy. | Activate clean recovery procedures and evaluate alternative arrangements. | Recovery independence, backup integrity and decision discipline. |
| Customer harm | A substantial proportion of customers cannot complete essential transactions; support demand rises. | Prioritise urgent customer needs, activate alternative support and communicate accurately. | Actual essential service capability and customer assistance effectiveness. |
| Restoration decision | Technology teams report that channels are technically available, but some payment states remain unreconciled. | Delay unrestricted reopening until transaction integrity and security validation are complete. | Whether management prioritises safe customer outcomes over technical availability. |
| Post-incident review | The exercise identifies a shared authentication dependency and inadequate capacity in alternative channels. | Assign remediation owners, deadlines, retesting requirements and governance reporting. | Quality of corrective action, management oversight and resilience improvement. |
##### **Expected Testing Outcomes**
The integrated exercise should demonstrate whether MBSB can:
1. Detect and classify severe digital banking disruption promptly.
2. Identify the affected Sub-CBS processes and interconnected Critical Business Services.
3. Contain cyber threats without creating uncontrolled financial integrity risks.
4. Maintain or substitute essential customer banking activities.
5. Monitor customer harm against the approved Impact Tolerance.
6. Restore trusted technology, data, and transaction-processing capabilities.
7. Validate end-to-end customer journeys before restoring service without restrictions.
8. Document vulnerabilities, corrective actions, residual risks and management decisions.
Consider the test successful only when the evidence supports the required resilience outcomes.
Completing the exercise or restoring individual systems is not sufficient.
#### **Proactive Risk Management and Scenario Governance**
##### **Recommended Scenario Governance Responsibilities**
| Responsible Function | Principal Responsibility |
| --- | --- |
| CBS-3 Owner / Digital Banking Management | Confirm essential customer outcomes, approve business assumptions and validate scenario relevance. |
| Operational Resilience | Coordinate scenario identification, link to impact tolerance, integrated testing, and management reporting. |
| Operational Risk | Challenge scenario severity, risk assumptions, control effectiveness and residual risk treatment. |
| Technology and ICT Risk | Validate technology failure mechanisms, shared dependencies, infrastructure concentration and recovery assumptions. |
| Cybersecurity | Provide threat intelligence, attack scenarios, containment assumptions and cyber recovery requirements. |
| BCM and Crisis Management | Validate continuity arrangements, escalation, alternative operating models and crisis coordination. |
| Customer Service and Operations | Assess customer harm, vulnerable customer needs, support capacity and practical alternative channels. |
| Third-Party Risk Management | Assess external provider resilience, concentration and the feasibility of contingency arrangements. |
| Compliance | Identify applicable regulatory and customer protection considerations. |
| Internal Audit | Provide independent assurance over scenario governance, testing evidence and remediation effectiveness, as appropriate. |
| Senior Management and Relevant Board Committees | Review material vulnerabilities, resilience investment needs, risk acceptance and progress in addressing significant findings. |
##### **Minimum Scenario Documentation**
Each approved Severe but Plausible Scenario should have a controlled scenario record containing its identifier, relevant Sub-CBS, business owner, initiating event, disruption progression, challenged dependencies, Cyber and ICT Risk linkages, affected customer outcomes, applicable Impact Tolerance measures, existing controls, expected response and recovery arrangements, testing objectives and required evidence.
After testing, supplement the record with actual observations, measured results, tolerance assessments, identified vulnerabilities, corrective actions, accountable owners, due dates, retest results, and management approval.
##### **Recommended Scenario Selection and Review Cycle**
MBSB should prioritise scenarios based on potential customer harm, dependency concentration, cyber threat relevance, material changes, previous incidents, control weaknesses, and the time elapsed since the last meaningful test.
The portfolio should be reviewed after material technology changes, significant incidents, outsourcing changes, new threat intelligence, changes to customer usage patterns or scenario tests that reveal previously unidentified weaknesses.
Do not retire a scenario merely because the associated technology has passed a disaster recovery test. The bank should establish whether the end-to-end customer service can remain within its approved Impact Tolerance.
#### **From Scenario Identification to Continuous Resilience Improvement**
The scenario identification exercise should produce a clear chain of evidence connecting the Critical Business Service to its resilience outcomes.
This traceability chain enables MBSB to show that scenario testing links to actual customer service outcomes and that identified weaknesses lead to accountable resilience improvements.
Management should use the results to prioritise remediation and investment in areas such as authentication resilience, payment integrity, network diversity, cyber recovery, third-party contingency, monitoring, workforce capability and alternative service delivery.
Material findings should remain open until corrective actions are implemented and their effectiveness is verified through appropriate testing.
[![Banner \[Summing\] \[OR\] \[E3\] Identify Severe but Plausible Scenarios](https://no-cache.hubspot.com/cta/default/3893111/446ccb83-e056-40d0-aae5-834d73c13f43.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/446ccb83-e056-40d0-aae5-834d73c13f43)
Identifying Severe but Plausible Scenarios for CBS-3 Digital Banking Services enables MBSB to understand how severe operational disruption could affect the bank's ability to provide essential digital financial services safely and reliably.
The analysis of all 24 Sub-CBS processes demonstrates that significant disruption can originate from many sources, including cyberattacks, failed technology changes, data corruption, third-party outages, telecommunications failures, insufficient operational capacity, inaccessible facilities and weaknesses in recovery arrangements.
Sub-CBS-level scenario identification strengthens end-to-end resilience analysis by revealing how an initial failure can propagate through shared authentication, core banking, payment processing, customer communications and other interconnected Critical Business Services.
Integrating Cyber and ICT Risks into each scenario is essential because technology and security failures frequently interact with operational processes, personnel constraints, external dependencies and management decisions.
A credible scenario must therefore challenge the entire service delivery chain, not just the recovery of a single application.
The proactive risk management actions and auditable evidence identified in this chapter provide a basis for demonstrating resilience preparedness, control effectiveness and management oversight.
The 24 scenarios should now be developed into an integrated Scenario Testing Programme that evaluates MBSB's ability to remain within its approved CBS-3 Impact Tolerance under severe but plausible conditions.
Testing results should inform remediation, resilience investment, risk treatment, recovery improvements and periodic reassessment of the scenario portfolio.
The ultimate objective is not to demonstrate that individual digital banking systems can recover.
It is to establish, through credible evidence, that MBSB can continue delivering essential digital banking outcomes within acceptable limits of customer harm, even when multiple operational, cyber and technology dependencies fail simultaneously.
Implementation note: The catalogue contains 24 Sub-CBS processes, despite the quality-control instructions referencing 20. Both assessment tables include all 24.
The scenarios, controls and test designs are illustrative and require validation against MBSB's actual operating model, approved Impact Tolerance, current applicable BNM requirements and management-approved resilience arrangements.
[![\[OR\] \[MBSB\] \[3/4 Banner\] Operational Resilience in Action The MBSB Bank's Approach ](https://no-cache.hubspot.com/cta/default/3893111/8c32162b-ac29-4c9c-9413-3d8869a65490.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/8c32162b-ac29-4c9c-9413-3d8869a65490)
| **eBook 3: Starting Your OR Implementation** | | | | |
| --- | --- | --- | --- | --- |
| **CBS-3 Digital Banking Services** | | | | |
| **CBS-3 DP** | **CBS-3 MII** | **CBS-3 ITo** | **CBS-3 SbPS** | **CBS-3 ST** |
| [![\[OR\] \[MBSB\] \[E3\] \[CBS\] \[3\] \[DP\] Digital Banking Services](https://no-cache.hubspot.com/cta/default/3893111/46949462-c4aa-464d-bef5-c0a9b2e6bab6.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/46949462-c4aa-464d-bef5-c0a9b2e6bab6) | [![\[OR\] \[MBSB\] \[E3\] \[CBS\] \[3\] \[MII\] Digital Banking Services](https://no-cache.hubspot.com/cta/default/3893111/74c4f462-7a20-49b5-aaf1-068e2f4956e9.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/74c4f462-7a20-49b5-aaf1-068e2f4956e9) | [![\[OR\] \[MBSB\] \[E3\] \[CBS\] \[3\] \[ITo\] Digital Banking Services](https://no-cache.hubspot.com/cta/default/3893111/56aa144a-f755-4aef-ab05-f29c3cd8ad89.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/56aa144a-f755-4aef-ab05-f29c3cd8ad89) | [![\[OR\] \[MBSB\] \[E3\] \[CBS\] \[3\] \[SbPS\] Digital Banking Services](https://no-cache.hubspot.com/cta/default/3893111/6e7f0ef7-370b-4182-8814-6b83fe57964a.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/6e7f0ef7-370b-4182-8814-6b83fe57964a) | [![\[OR\] \[MBSB\] \[E3\] \[CBS\] \[3\] \[ST\] Digital Banking Services](https://no-cache.hubspot.com/cta/default/3893111/c22a5556-09bb-4c57-b9a4-7ea2ab5be915.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/c22a5556-09bb-4c57-b9a4-7ea2ab5be915) |
**[](https://cta-redirect.hubspot.com/cta/redirect/3893111/084e620a-46c5-419a-82ed-6a681d15c0b6)[](https://cta-redirect.hubspot.com/cta/redirect/3893111/13a448f1-f09c-42da-a57e-0988e41658c5)**
For organisations looking to accelerate their journey, BCM Institute’s training and certification programs, including the **OR-5000 Operational Resilience Expert Implementer course**, provide in-depth insights and practical toolkits for effectively embedding this model.
#### More Information About OR-5000 \[OR-5\] or OR-300 \[OR-3\]
To learn more about the course and schedule, click the buttons below for the OR-300 Operational Resilience Implementer course and the OR-5000 Operational Resilience Expert Implementer course.
| [](https://cta-redirect.hubspot.com/cta/redirect/3893111/3530eccb-515d-401e-afc2-3469e26d7fbf) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/fdd4fa9c-ed69-40c1-925f-4eb6a1c5c255) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/77a34b84-0a6d-44f8-b8d6-6ab04cdf5edd) |
| --- | --- | --- |
| [](https://cta-redirect.hubspot.com/cta/redirect/3893111/6e5c0cda-39b9-4bbd-b3d4-4cf46a790b14) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/a68a08aa-36d3-4216-9551-202c9fde06ea) | [![ \[BL-OR\] \[3-4-5\] View Schedule](https://no-cache.hubspot.com/cta/default/3893111/d0d733a1-16c0-4b68-a26d-adbfd4fc6069.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/d0d733a1-16c0-4b68-a26d-adbfd4fc6069) |
| [![\[BL-OR\] \[3\] FAQ OR-300](https://no-cache.hubspot.com/cta/default/3893111/f20c71b4-f5e8-4aa5-8056-c374ca33a091.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/f20c71b4-f5e8-4aa5-8056-c374ca33a091) | If you have any questions, click to contact us.[![Email to Sales Team \[BCM Institute\]](https://no-cache.hubspot.com/cta/default/3893111/3c53daeb-2836-4843-b0e0-645baee2ab9e.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/3c53daeb-2836-4843-b0e0-645baee2ab9e) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/7f2718a4-ea80-4f84-a319-dc2d4df37a46) |
| [](https://cta-redirect.hubspot.com/cta/redirect/3893111/74b1e556-8cd2-4a74-8821-db1804534955) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/f2bd8eb1-32d2-4732-9267-ea53223cf58f) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/084e620a-46c5-419a-82ed-6a681d15c0b6) |
#### **Your Comments Here:**
---
---
---
---
All rights reserved. Copyright 2026
```json
{
"@context" : "https://schema.org",
"@type" : "BlogPosting",
"author" : {
"@type" : "Person",
"name" : "Dr Goh Moh Heng",
"url" : "https://blog.bcm-institute.org/ebook-or/author/dr-goh-moh-heng"
},
"dateModified" : "2026-10-14T11:30:01.478Z",
"datePublished" : "2026-10-14T03:35:36.000Z",
"headline" : "[OR] [MBSB] [E3] [CBS] [3] [SbPS] Identify Severe but Plausible Scenarios",
"mainEntityOfPage" : {
"@id" : "https://blog.bcm-institute.org/ebook-or/or-mbsb-e3-cbs-3-sbps-identify-severe-but-plausible-scenarios",
"@type" : "WebPage"
},
"publisher" : {
"@type" : "Organization",
"logo" : {
"@type" : "ImageObject",
"url" : "https://blog.bcm-institute.org/hubfs/BCMI%20Logo.png"
},
"name" : "BCMI Pte Ltd"
}
}
```