[OR] [MLRE] [E3] [CBS] [2] [SuPS] Identify Severe but Plausible Scenarios

Sub-CBS Code

Sub-CBS

Severe but Plausible Scenario

Impact / Effect

Proactive Risk Management Action (Evidence)

Link to Integration of Cyber & ICT Risk

2.1

Claim Notification & Receipt

Distributed Denial-of-Service (DDoS) attack on the claims submission portal during a catastrophe event

Inability of cedants to notify claims within the required timeframe; backlog accumulation

Redundant submission channels (secure email, SWIFT, hotline); DDoS mitigation service; tested surge procedures

Cyber attack resilience, network monitoring, SOC alerts, and ICT capacity stress testing

2.2

Document & Data Verification

Ransomware encrypts the document management system

Inaccessibility of claim documents; delay in verification; potential data breach

Immutable backups; endpoint detection & response (EDR); offline recovery testing; cyber playbooks

Backup resilience, privileged access management (PAM), and ransomware response integration

2.3

Preliminary Assessment & Triage

Sudden 300% spike in claims due to regional pandemic or natural catastrophe

Triage bottlenecks; breach of service level agreements (SLAs)

Pre-defined catastrophe surge plan; cross-trained staff; automated triage rules engine

ICT scalability testing, cloud auto-scaling, stress-testing against peak load

2.4

Detailed Claims Assessment

Core claims assessment system outage due to data centre failure

Suspension of assessment activities; impact tolerance breach

Active-active data centre setup; disaster recovery (DR) site with tested RTO/RPO

DR testing aligned to impact tolerance; ICT resilience metrics reporting

2.5

Third-Party Engagement & Investigation

External loss adjuster suffers a cyber breach compromising shared claim data

Confidentiality breach; reputational damage; regulatory reporting requirement

Third-party cyber due diligence; contractual security clauses; secure file transfer protocols

Third-party ICT risk assessment; vendor monitoring; integration into enterprise cyber risk register

2.6

Claims Decisioning & Approval

Internal fraud or manipulation of the approval workflow via compromised credentials

Financial loss; regulatory sanction; erosion of trust

Segregation of duties (SoD); multi-factor authentication (MFA); transaction monitoring

Identity & access management controls; insider threat detection analytics

2.7

Settlement Calculation & Fund Disbursement

Payment system outage or SWIFT connectivity disruption

Delayed settlement to cedants; liquidity strain; contractual penalties

Alternative payment channel; liquidity buffer; payment contingency playbook

Payment system cyber resilience; integration with treasury ICT continuity plans

2.8

Claim Communication & Reporting

Email server compromise leading to phishing or misinformation to cedants

Misinformation; reputational damage; possible financial fraud

Secure email gateway; DMARC/SPF controls; communication verification protocol

Email security controls, cyber awareness training, and incident escalation integration

2.9

Record Archival & Compliance Reporting

Data corruption was discovered in archival storage due to a silent system failure

Inaccurate regulatory reporting; audit qualification risk

Periodic data integrity checks; hash validation; independent audit review

Data integrity monitoring; ICT governance & audit alignment

2.10

Continuous Improvement & Analytics

Manipulation or corruption of analytics data affecting reserving insights

Poor decision-making; mispricing risk exposure

Data governance framework, role-based access, model validation process

ICT data governance, AI/model risk management, cyber monitoring of analytics platforms