[OR] [MLRE] [E3] [CBS] [1] [SuPS] Identify Severe but Plausible Scenarios

Sub-CBS Code

Sub-CBS

Severe but Plausible Scenario

Impact / Effect

Proactive Risk Management Action (Evidence of Readiness)

Link to Integration of Cyber and ICT Risks

1.1

Risk Appetite & Strategy Setting

Senior management decisions are delayed or distorted due to incomplete risk data following a prolonged analytics platform outage

Misaligned underwriting strategy; accumulation of unintended risk exposures

Board-approved fallback decision thresholds; periodic stress testing of underwriting appetite assumptions

Dependency on strategic dashboards, BI tools, and executive reporting platforms

1.2

Data Acquisition & Validation

Critical mortality and experience data corrupted by ransomware during peak renewal season

Inaccurate pricing assumptions; inability to validate treaty terms

Offline data backups; data integrity checks; cyber incident playbooks tested via simulations

Core data repositories, ETL pipelines, and cyber resilience of data lakes

1.3

Risk Modelling & Pricing Analytics

Cloud-based actuarial modelling engine becomes unavailable due to regional cloud service disruption

Pricing delays; reliance on outdated or simplified models

Secondary modelling environment; model tiering and prioritisation framework

Cloud availability risk, model platforms, and vendor resilience

1.4

Underwriting Submission Intake

The automated submission portal is taken offline by a DDoS attack

Inability to receive or track new underwriting submissions

Manual intake procedures; pre-defined service degradation tolerance

Customer-facing portals, network resilience, and perimeter security

1.5

Underwriting Risk Assessment

Key underwriting tools generate inconsistent outputs due to unpatched software defects

Erroneous risk acceptance or rejection decisions

Patch management governance; independent underwriting review triggers

Underwriting systems, version control, and ICT change management

1.6

Pricing & Quotation Formulation

The pricing engine produces incorrect quotations due to a configuration error after an urgent system update

Financial loss; reputational damage with cedants

Maker-checker controls; automated pricing validation rules

Pricing engines, configuration management, and release controls

1.7

Regulatory & Compliance Review

Regulatory reporting logic fails to update following changes in BNM requirements

Non-compliance; supervisory findings

Regulatory change management process; compliance system testing

Compliance tools, regulatory rule engines, and data lineage

1.8

Decision Governance & Approval

Digital approval workflows fail during high-value treaty approvals

Approval bottlenecks; missed market opportunities

Delegation of authority matrices; manual approval escalation paths

Workflow systems, identity access management, and availability controls

1.9

Documentation & Contract Issuance

Contract management system outage delays issuance of legally binding reinsurance treaties

Contractual disputes; revenue recognition delays

Standardised contract templates; secure document repositories

Document management systems and secure storage platforms

1.10

Portfolio Monitoring & Experience Analysis

Experience monitoring dashboards unavailable for an extended period due to a data warehouse failure

Late identification of adverse trends and loss concentrations

Periodic offline reporting packs; predefined monitoring KPIs

Data warehouses, reporting tools, and ICT capacity planning

1.11

Exception & Escalation Handling

Escalation alerts fail due to email and messaging system outage

Delayed management response to underwriting breaches

Multi-channel escalation protocols; manual call-tree activation

Messaging platforms, alerting systems, and ICT redundancy

1.12

Reporting & Feedback Loop

Internal performance and risk feedback reports are delayed due to an analytics system compromise

Weak learning loop; slow corrective actions

Resilience-based reporting timelines; alternative reporting tools

Analytics platforms, cyber monitoring, and data access controls