[OR] [MCIS] [E3] [CBS] [1] [ST] Perform Scenario Testing

Sub-CBS Code

Name of Sub-CBS

Recommended Severe but Plausible Scenario

Scenario Description

Primary Disruption Trigger

Impact on Sub-CBS

Impact on Critical Business Service

CBS-1.1

Customer Application Intake

Simultaneous digital application-channel and telecommunications disruption during peak demand

A Distributed Denial-of-Service attack causes severe degradation of MCIS’s digital application channel while a telecommunications provider experiences a regional connectivity failure. Customers and intermediaries repeatedly resubmit applications after acknowledgements are delayed. Some submissions are duplicated, while others are retained temporarily on intermediary devices and transmitted later. Contact-centre demand rises sharply as customers seek confirmation.

Coordinated DDoS attack, amplified by regional telecommunications failure.

Applications cannot be submitted consistently. Intake personnel cannot confirm whether submissions were received, and duplicate, delayed and incomplete applications accumulate. Alternative intake channels become congested.

New business processing slows immediately. Uncertainty over application receipt propagates to validation, underwriting and customer communication. Prolonged disruption could prevent customers from obtaining timely protection and cause the CBS backlog and disruption duration to exceed tolerance.

CBS-1.2

Application Validation and Completeness Review

Failed technology change causes incomplete applications to pass automated validation

A software deployment incorrectly modifies mandatory-field and document-validation rules. Applications without required declarations, identity evidence or supporting documents are marked complete and transferred to underwriting. The defect remains undetected for several hours because the monitoring dashboard reports only successful system processing rather than validation quality.

Failed software deployment combined with ineffective control monitoring.

Validation outcomes become unreliable. Staff must identify the affected application population, suspend automated processing and conduct retrospective manual validation.

Invalid applications progress into customer profiling, underwriting, compliance screening and pricing. The need to recall and reprocess cases creates delay, customer confusion and a growing backlog that may threaten the CBS Impact Tolerance.

CBS-1.3

Customer Risk Profiling

Risk-profiling data feed becomes stale while automated processing continues

A critical external or internal data feed stops updating, but the interface continues returning technically successful responses. Customer risk profiles are therefore produced using outdated or incomplete attributes. The defect affects selected customer segments and is not immediately apparent from individual case reviews.

Silent data-feed interruption or data-freshness control failure.

Customer profiles may be understated, overstated or inconsistent. Automated case-routing and underwriting requirements become unreliable.

Incorrect profiling can send cases through inappropriate underwriting paths, weaken fraud and compliance controls, cause unsuitable decisions and require large-scale retrospective review. This can delay policy issuance and potentially create customer or regulatory harm.

CBS-1.4

Medical and Financial Underwriting Assessment

Critical medical-information provider outage combined with loss of specialist underwriters

A cyber incident disrupts a provider of medical evidence at the same time that a regional health emergency or workforce event reduces the availability of experienced medical and financial underwriters. Applications requiring specialist assessment rise substantially, while alternative providers have limited capacity.

Critical third-party cyber disruption combined with specialist workforce loss.

Medical reports, financial evidence and expert assessments cannot be obtained or completed within normal timeframes. The specialist-case queue grows rapidly.

Policy decisions for higher-risk and complex customers are delayed. Pressure may develop to weaken evidence requirements or rely on unapproved assumptions. Prolonged delay could cause customer harm and breach service-duration or backlog tolerances.

CBS-1.5

Fraud Screening and Compliance Verification

Compromise of a critical screening provider produces unreliable verification results

A third-party fraud, identity or compliance-screening provider reports unauthorised privileged access. Screening responses received before the incident may have been altered, suppressed or fabricated. At the same time, attackers submit manipulated applications designed to exploit the disruption.

Cyber compromise of a critical third-party screening service.

MCIS cannot rely on recent screening outcomes. New screening requests may be unavailable, while completed cases require revalidation. Suspicious applications must be quarantined.

Policies cannot be issued safely until required screening has been completed or repeated. A large affected population could suspend downstream decision-making and policy issuance, threatening the Impact Tolerance and creating financial crime and compliance exposure.

CBS-1.6

Underwriting Decision Management

Ransomware disrupts the underwriting workflow and corrupts decision-status records

Ransomware encrypts the underwriting workflow environment and compromises part of the decision database. After initial restoration, some applications show conflicting approval, decline or referral statuses. Audit histories are incomplete, and access credentials may have been compromised.

Ransomware combined with database-integrity and identity compromise.

Underwriters cannot retrieve case histories reliably or confirm whether decisions were authorised and completed. Manual decision-making must be introduced under degraded conditions.

Policy issuance must be restricted until decisions are trusted and reconciled. A prolonged inability to make or validate underwriting decisions could become the principal driver of a CBS Impact Tolerance breach.

CBS-1.7

Premium Calculation and Pricing Confirmation

Pricing-engine change produces materially incorrect premiums

An incorrect pricing parameter is deployed to the production environment. The engine remains available and processes transactions normally, but premiums are understated or overstated for selected products or customer profiles. The issue is discovered after quotations and some policy documents have been generated.

Failed technology change and inadequate pricing-data validation.

Premium calculations cannot be trusted. Affected applications must be identified, suspended, recalculated and reviewed by appropriate product or actuarial authorities.

Incorrect premiums may result in financial loss, unfair customer outcomes, policy rework and delayed issuance. If the affected population is material, correction and customer communication requirements may cause the CBS to exceed its tolerance.

CBS-1.8

Policy Documentation Preparation

Malware or template corruption produces inaccurate contractual documents

Malware or an unauthorised template change modifies policy clauses, benefit schedules or customer-data mapping within the document-generation process. Documents appear complete but contain missing exclusions, incorrect benefits or customer information belonging to another application.

Document-template compromise, malware or unauthorised privileged change.

Policy documents cannot be relied upon. Generation must be suspended while approved templates and data mappings are restored and affected documents are identified.

Even where underwriting and pricing are complete, policies cannot be issued safely. Large-scale document regeneration and quality assurance can delay customer cover and create legal, privacy and conduct risks.

CBS-1.9

Policy Approval and Issuance

Simultaneous failure of primary and recovery policy-issuance environments

A major infrastructure fault disables the primary policy-administration environment. Failover is initiated, but the recovery environment cannot complete issuance because of an undetected configuration, authentication or database-replication dependency shared with the primary environment.

Primary infrastructure failure combined with recovery-environment dependency failure.

Policy numbers cannot be assigned reliably, approvals cannot be completed and issued policies cannot be recorded with certainty. Manual issuance options are limited by control and reconciliation requirements.

Completed applications cannot be converted into valid policies. The issuance backlog grows rapidly, customers may remain uncertain about whether cover is effective, and the CBS may breach its maximum disruption-duration tolerance.

CBS-1.10

Customer and Distribution Notification

Multiple notification channels fail while inaccurate status messages are released

A cyberattack or messaging-provider outage disables email, SMS and intermediary-portal notifications. A separate synchronisation defect causes some customers and agents to receive outdated or incorrect application and policy status information.

Third-party messaging outage combined with data-synchronisation failure.

MCIS cannot communicate status reliably through normal channels. The contact centre experiences a severe surge, while staff must verify each case before providing an update.

Customers may not know whether further information is required, whether a decision has been made or whether a policy has been issued. Misinformation may increase complaints, repeat submissions and operational workload, prolonging the CBS disruption.

CBS-1.11

Policy Record Administration

Database corruption creates inconsistent policy records across interconnected systems

A database fault or malicious data manipulation results in differences between issued policy records, contractual documents, premium information, customer-facing records and downstream administration data. Replication mechanisms transmit some corrupted records to the recovery environment.

Data-integrity compromise combined with replication of corrupted information.

MCIS cannot establish which record is authoritative. Processing must be restricted while records are restored and reconciled across multiple repositories.

Customers may receive incorrect policy information, billing may be affected, and downstream servicing may operate on unreliable data. Extended reconciliation or unrecoverable records could breach data-loss and service-restoration tolerances.

CBS-1.12

Exception and Referral Management

Referral workflow outage coincides with unavailability of key decision authorities

The referral queue becomes inaccessible during a disruption affecting remote access. Several senior underwriters and specialist referral authorities are unavailable, and an external expert or reinsurance contact cannot respond. Urgent, non-standard cases continue to enter the process.

Workflow and connectivity failure combined with concentration of specialist authority.

Exceptions cannot be routed, prioritised or assigned through normal processes. Case histories and previous referrals may be unavailable, while remaining staff approach their delegated authority limits.

High-risk applications may remain unresolved, be lost from oversight or face pressure for unauthorised approval. The growing exception queue can delay the wider underwriting and issuance service beyond tolerance.

CBS-1.13

Underwriting Quality Assurance and Compliance Monitoring

Monitoring and audit-data feeds fail while manual underwriting workarounds expand

During a wider technology disruption, quality dashboards, audit-log feeds and compliance reports become unavailable. Operations continue using manual workarounds, but second-line and quality-assurance teams cannot determine whether authority, evidence and pricing controls are operating effectively.

Monitoring and detection control failure during degraded operations.

Quality and compliance teams lose visibility over error rates, override activity, manual decisions and control exceptions. Assurance reviews fall behind as transaction volumes increase.

Control weaknesses may remain undetected while inaccurate or unauthorised policies progress. Continued processing without adequate oversight could amplify customer harm and allow the CBS to operate outside its risk and Impact Tolerance boundaries.

CBS-1.14

Underwriting Incident and Service Recovery Management

Compound ransomware event affects identity services, underwriting systems, policy records and recovery arrangements

A sophisticated ransomware attack compromises privileged credentials, encrypts underwriting applications and disrupts the document repository and policy-administration environment. The primary and recovery environments are both suspected of contamination. A critical third party is unavailable, workforce capacity is reduced, and customer enquiries increase sharply.

Privileged-access compromise followed by enterprise ransomware and simultaneous recovery-environment uncertainty.

Incident teams must contain the attack, determine trusted recovery points, activate controlled workarounds, prioritise applications, coordinate third parties and manage a growing service backlog.

The disruption affects every stage of CBS-1. Failure to contain, communicate, recover trusted data and clear accumulated work could cause a prolonged CBS outage, widespread customer harm and a clear breach of the Impact Tolerance.

Sub-CBS Code

Name of Sub-CBS

Recommended Severe but Plausible Scenario

Scenario Description

Primary Disruption Trigger

Impact on Sub-CBS

Impact on Critical Business Service

CBS-1.1

Customer Application Intake

Simultaneous digital application-channel and telecommunications disruption during peak demand

A Distributed Denial-of-Service attack causes severe degradation of MCIS’s digital application channel while a telecommunications provider experiences a regional connectivity failure. Customers and intermediaries repeatedly resubmit applications after acknowledgements are delayed. Some submissions are duplicated, while others are retained temporarily on intermediary devices and transmitted later. Contact-centre demand rises sharply as customers seek confirmation.

Coordinated DDoS attack, amplified by regional telecommunications failure.

Applications cannot be submitted consistently. Intake personnel cannot confirm whether submissions were received, and duplicate, delayed and incomplete applications accumulate. Alternative intake channels become congested.

New business processing slows immediately. Uncertainty over application receipt propagates to validation, underwriting and customer communication. Prolonged disruption could prevent customers from obtaining timely protection and cause the CBS backlog and disruption duration to exceed tolerance.

CBS-1.2

Application Validation and Completeness Review

Failed technology change causes incomplete applications to pass automated validation

A software deployment incorrectly modifies mandatory-field and document-validation rules. Applications without required declarations, identity evidence or supporting documents are marked complete and transferred to underwriting. The defect remains undetected for several hours because the monitoring dashboard reports only successful system processing rather than validation quality.

Failed software deployment combined with ineffective control monitoring.

Validation outcomes become unreliable. Staff must identify the affected application population, suspend automated processing and conduct retrospective manual validation.

Invalid applications progress into customer profiling, underwriting, compliance screening and pricing. The need to recall and reprocess cases creates delay, customer confusion and a growing backlog that may threaten the CBS Impact Tolerance.

CBS-1.3

Customer Risk Profiling

Risk-profiling data feed becomes stale while automated processing continues

A critical external or internal data feed stops updating, but the interface continues returning technically successful responses. Customer risk profiles are therefore produced using outdated or incomplete attributes. The defect affects selected customer segments and is not immediately apparent from individual case reviews.

Silent data-feed interruption or data-freshness control failure.

Customer profiles may be understated, overstated or inconsistent. Automated case-routing and underwriting requirements become unreliable.

Incorrect profiling can send cases through inappropriate underwriting paths, weaken fraud and compliance controls, cause unsuitable decisions and require large-scale retrospective review. This can delay policy issuance and potentially create customer or regulatory harm.

CBS-1.4

Medical and Financial Underwriting Assessment

Critical medical-information provider outage combined with loss of specialist underwriters

A cyber incident disrupts a provider of medical evidence at the same time that a regional health emergency or workforce event reduces the availability of experienced medical and financial underwriters. Applications requiring specialist assessment rise substantially, while alternative providers have limited capacity.

Critical third-party cyber disruption combined with specialist workforce loss.

Medical reports, financial evidence and expert assessments cannot be obtained or completed within normal timeframes. The specialist-case queue grows rapidly.

Policy decisions for higher-risk and complex customers are delayed. Pressure may develop to weaken evidence requirements or rely on unapproved assumptions. Prolonged delay could cause customer harm and breach service-duration or backlog tolerances.

CBS-1.5

Fraud Screening and Compliance Verification

Compromise of a critical screening provider produces unreliable verification results

A third-party fraud, identity or compliance-screening provider reports unauthorised privileged access. Screening responses received before the incident may have been altered, suppressed or fabricated. At the same time, attackers submit manipulated applications designed to exploit the disruption.

Cyber compromise of a critical third-party screening service.

MCIS cannot rely on recent screening outcomes. New screening requests may be unavailable, while completed cases require revalidation. Suspicious applications must be quarantined.

Policies cannot be issued safely until required screening has been completed or repeated. A large affected population could suspend downstream decision-making and policy issuance, threatening the Impact Tolerance and creating financial crime and compliance exposure.

CBS-1.6

Underwriting Decision Management

Ransomware disrupts the underwriting workflow and corrupts decision-status records

Ransomware encrypts the underwriting workflow environment and compromises part of the decision database. After initial restoration, some applications show conflicting approval, decline or referral statuses. Audit histories are incomplete and access credentials may have been compromised.

Ransomware combined with database-integrity and identity compromise.

Underwriters cannot retrieve case histories reliably or confirm whether decisions were authorised and completed. Manual decision-making must be introduced under degraded conditions.

Policy issuance must be restricted until decisions are trusted and reconciled. A prolonged inability to make or validate underwriting decisions could become the principal driver of a CBS Impact Tolerance breach.

CBS-1.7

Premium Calculation and Pricing Confirmation

Pricing-engine change produces materially incorrect premiums

An incorrect pricing parameter is deployed to the production environment. The engine remains available and processes transactions normally, but premiums are understated or overstated for selected products or customer profiles. The issue is discovered after quotations and some policy documents have been generated.

Failed technology change and inadequate pricing-data validation.

Premium calculations cannot be trusted. Affected applications must be identified, suspended, recalculated and reviewed by appropriate product or actuarial authorities.

Incorrect premiums may result in financial loss, unfair customer outcomes, policy rework and delayed issuance. If the affected population is material, correction and customer communication requirements may cause the CBS to exceed its tolerance.

CBS-1.8

Policy Documentation Preparation

Malware or template corruption produces inaccurate contractual documents

Malware or an unauthorised template change modifies policy clauses, benefit schedules or customer-data mapping within the document-generation process. Documents appear complete but contain missing exclusions, incorrect benefits or customer information belonging to another application.

Document-template compromise, malware or unauthorised privileged change.

Policy documents cannot be relied upon. Generation must be suspended while approved templates and data mappings are restored and affected documents are identified.

Even where underwriting and pricing are complete, policies cannot be issued safely. Large-scale document regeneration and quality assurance can delay customer cover and create legal, privacy and conduct risks.

CBS-1.9

Policy Approval and Issuance

Simultaneous failure of primary and recovery policy-issuance environments

A major infrastructure fault disables the primary policy-administration environment. Failover is initiated, but the recovery environment cannot complete issuance because of an undetected configuration, authentication or database-replication dependency shared with the primary environment.

Primary infrastructure failure combined with recovery-environment dependency failure.

Policy numbers cannot be assigned reliably, approvals cannot be completed and issued policies cannot be recorded with certainty. Manual issuance options are limited by control and reconciliation requirements.

Completed applications cannot be converted into valid policies. The issuance backlog grows rapidly, customers may remain uncertain about whether cover is effective, and the CBS may breach its maximum disruption-duration tolerance.

CBS-1.10

Customer and Distribution Notification

Multiple notification channels fail while inaccurate status messages are released

A cyberattack or messaging-provider outage disables email, SMS and intermediary-portal notifications. A separate synchronisation defect causes some customers and agents to receive outdated or incorrect application and policy status information.

Third-party messaging outage combined with data-synchronisation failure.

MCIS cannot communicate status reliably through normal channels. The contact centre experiences a severe surge, while staff must verify each case before providing an update.

Customers may not know whether further information is required, whether a decision has been made or whether a policy has been issued. Misinformation may increase complaints, repeat submissions and operational workload, prolonging the CBS disruption.

CBS-1.11

Policy Record Administration

Database corruption creates inconsistent policy records across interconnected systems

A database fault or malicious data manipulation results in differences between issued policy records, contractual documents, premium information, customer-facing records and downstream administration data. Replication mechanisms transmit some corrupted records to the recovery environment.

Data-integrity compromise combined with replication of corrupted information.

MCIS cannot establish which record is authoritative. Processing must be restricted while records are restored and reconciled across multiple repositories.

Customers may receive incorrect policy information, billing may be affected, and downstream servicing may operate on unreliable data. Extended reconciliation or unrecoverable records could breach data-loss and service-restoration tolerances.

CBS-1.12

Exception and Referral Management

Referral workflow outage coincides with unavailability of key decision authorities

The referral queue becomes inaccessible during a disruption affecting remote access. Several senior underwriters and specialist referral authorities are unavailable, and an external expert or reinsurance contact cannot respond. Urgent, non-standard cases continue to enter the process.

Workflow and connectivity failure combined with concentration of specialist authority.

Exceptions cannot be routed, prioritised or assigned through normal processes. Case histories and previous referrals may be unavailable, while remaining staff approach their delegated authority limits.

High-risk applications may remain unresolved, be lost from oversight or face pressure for unauthorised approval. The growing exception queue can delay the wider underwriting and issuance service beyond tolerance.

CBS-1.13

Underwriting Quality Assurance and Compliance Monitoring

Monitoring and audit-data feeds fail while manual underwriting workarounds expand

During a wider technology disruption, quality dashboards, audit-log feeds and compliance reports become unavailable. Operations continue using manual workarounds, but second-line and quality-assurance teams cannot determine whether authority, evidence and pricing controls are operating effectively.

Monitoring and detection control failure during degraded operations.

Quality and compliance teams lose visibility over error rates, override activity, manual decisions and control exceptions. Assurance reviews fall behind as transaction volumes increase.

Control weaknesses may remain undetected while inaccurate or unauthorised policies progress. Continued processing without adequate oversight could amplify customer harm and allow the CBS to operate outside its risk and Impact Tolerance boundaries.

CBS-1.14

Underwriting Incident and Service Recovery Management

Compound ransomware event affects identity services, underwriting systems, policy records and recovery arrangements

A sophisticated ransomware attack compromises privileged credentials, encrypts underwriting applications and disrupts the document repository and policy-administration environment. The primary and recovery environments are both suspected of contamination. A critical third party is unavailable, workforce capacity is reduced and customer enquiries increase sharply.

Privileged-access compromise followed by enterprise ransomware and simultaneous recovery-environment uncertainty.

Incident teams must contain the attack, determine trusted recovery points, activate controlled workarounds, prioritise applications, coordinate third parties and manage a growing service backlog.

The disruption affects every stage of CBS-1. Failure to contain, communicate, recover trusted data and clear accumulated work could cause a prolonged CBS outage, widespread customer harm and a clear breach of the Impact Tolerance.