[OR] [MBT] [E3] [CBS] [7] [ST] Perform Scenario Testing

Sub-CBS Code

Sub-CBS

Scenario Testing Description

Integration with Cyber & ICT Risks

Evidence of Proactive Risk Management Action

7.1

Online Banking Platform Management

Simulate a major core system outage caused by database corruption or load balancer failure during peak transaction hours.

Evaluate ICT infrastructure resilience and data recovery capabilities.

Post-test implementation of enhanced database replication and failover testing.

7.2

Mobile Banking Application Services

Conduct a simulation of widespread mobile app downtime caused by a faulty version release or a DDoS attack.

Cyber resilience validation via mobile app firewall and anti-DDoS protocols.

Strengthened DevSecOps pipeline with pre-deployment integrity checks.

7.3

Digital Account Access and Authentication

Test multi-factor authentication (MFA) failure or compromise due to phishing or credential stuffing attacks.

Integration of threat intelligence and identity protection systems.

Deployment of adaptive authentication and user anomaly detection tools.

7.4

Online Funds Transfer and Payment Processing

Scenario of delayed or failed payments due to API malfunction with payment gateways or NPSA.

ICT dependency testing of integration layers and data encryption mechanisms.

Implementation of backup APIs and continuous monitoring of transaction queues.

7.5

Digital Customer Onboarding and e-KYC

Simulate the KYC verification system downtime due to a third-party data provider failure.

Third-party ICT dependency validation and data privacy risk assessment.

Establishment of alternate KYC provider arrangements and vendor SLA enforcement.

7.6

Digital Customer Support and Service Channels

Test live chat and chatbot unavailability due to cloud provider service degradation.

Cyber risk review of third-party cloud services and API security.

Multi-cloud fallback strategy and service continuity testing documentation.

7.7

Card-Not-Present (CNP) and e-Commerce Transaction Processing

Simulate a fraudulent CNP transaction surge causing false-positive blocking of legitimate users.

Cyber fraud analytics integration and machine learning model resilience.

Continuous tuning of fraud detection algorithms and alert escalation processes.

7.8

ATM and Electronic Channel Management

Test network communication loss between core banking and ATM switches due to telecom outage.

ICT resilience assessment of connectivity layers and data transmission security.

Deployment of redundant communication channels and enhanced network monitoring.

7.9

Cybersecurity and Fraud Monitoring for Digital Channels

Conduct red-team/blue-team cyberattack simulation targeting online channels.

Directly tests cybersecurity incident response and detection systems.

Refinement of incident playbooks, SOC escalation criteria, and forensic readiness.

7.10

Digital Banking Data Management and Reporting

Scenario of corrupted reporting data due to ransomware encryption or data loss.

Cyber-incident and ICT backup-recovery capability evaluation.

Enhanced data integrity validation, air-gapped backups, and regular restore testing.