---
title: [OR] [PIDM] [E3] [C1] Starting Your OR Implementation
description: [OR] [PIDM] [E3] [C1] Starting Your OR Implementation
image: https://blog.bcm-institute.org/hubfs/eBook%20Generic%20Morepost/OR/OR%20GEN%20E3%20Morepost/%5BOR%5D%20%5BGEN%5D%20%5BE3%5D%20%5BC1%5D%20Starting%20Your%20BCM%20Implementation.jpg
---
.
[](http://www.bcm-institute.org/)
- [Home](https://www.bcm-institute.org/)
- [About Us](https://www.bcm-institute.org/about-us-3/)
- [A President’s Perspective](https://www.bcm-institute.org/about-us/a-presidents-perspective/)
- [Our History](https://www.bcm-institute.org/about-us/our-history/)
- [Our Advisory Council](https://www.bcm-institute.org/about-us/our-advisory-council/)
- [Customers’ Testimonials](https://www.bcm-institute.org/about-us/customers-testimonials/)
- [Credential Verification](https://www.bcm-institute.org/about-us/credential-verification/)
- [Courses](https://blog.bcm-institute.org/blog/course-fees-for-blended-learning-courses-master-catalog)
- [ISO 22301 Business Continuity Management System Audit](https://blog.bcm-institute.org/audit/business-continuity-management-audit-courses)
- [ISO 22301 Business Continuity Management](https://blog.bcm-institute.org/bcm/business-continuity-management-courses)
- [Crisis Communication](https://blog.bcm-institute.org/crisis-communication/crisis-communication-courses)
- [Crisis Management](https://blog.bcm-institute.org/en/crisis-management/courses)
- [IT Disaster Recovery](https://blog.bcm-institute.org/it-disaster-recovery/courses)
- [Operational Resilience](https://blog.bcm-institute.org/operational-resilience/courses)
- [Operational Resilience Audit](https://blog.bcm-institute.org/operational-resilience-audit/courses)
- [Certification](https://blog.bcm-institute.org/certification/types-of-certifications-offered)
- [ISO 22301 BCMS Audit Certification](https://blog.bcm-institute.org/certification/business-continuity-management-audit-certification)
- [ISO22301 Business Continuity Management Certification](https://blog.bcm-institute.org/bcm/business-continuity-management-certification)
- [Crisis Communication Certification](https://blog.bcm-institute.org/crisis-communication/crisis-communication-certification)
- [Crisis Management Certification](https://blog.bcm-institute.org/en/crisis-management/crisis-management-certification)
- [IT Disaster Recovery Planning Certification](https://blog.bcm-institute.org/it-disaster-recovery/it-disaster-recovery-certification)
- [Operational Resilience Certification](https://blog.bcm-institute.org/operational-resilience/operational-resilience-certification)
- [Operational Resilience Audit Certification](https://blog.bcm-institute.org/operational-resilience-audit)
- [Seminars](https://blog.bcm-institute.org/meet-the-expert/mte-webinar-mainpage)
- [Store](https://www.bcm-institute.org/store-2/)
- [Contact Us](http://www.bcm-institute.org/about-us/contact-us/)
-
-
###### Building Operational Resilience at PIDM: A Strategic Implementation Guide
![BB OR \[C\] 12](https://blog.bcm-institute.org/hs-fs/hubfs/OR%20picture/OR%20Pictures%20A/BB%20OR%20Folder%20C/BB%20OR%20%5BC%5D%2012.jpg?width=2000&height=1333&name=BB%20OR%20%5BC%5D%2012.jpg "BB OR [C] 12")
# \[OR\] \[PIDM\] \[E3\] \[C1\] Starting Your OR Implementation
[](https://cta-redirect.hubspot.com/cta/redirect/3893111/7a6f5c32-e8ae-42c9-acb3-ba7f4b3f4998)
[](https://cta-redirect.hubspot.com/cta/redirect/3893111/7bb680f4-0965-49cd-b448-b88dff6349fb)
Operational Resilience (OR) is an organisation's ability to continue delivering its critical business services during severe operational disruptions, adapt to changing circumstances, and recover without causing unacceptable harm to its stakeholders.
For Perbadanan Insurans Deposit Malaysia (PIDM), Operational Resilience is particularly important because it protects eligible depositors and policy owners, maintains institutional preparedness, and supports the orderly management of member institution failures.
Disruptions affecting these responsibilities may have consequences beyond PIDM's internal operations.
They may affect the timely delivery of protection arrangements, the availability of essential information, stakeholder confidence, and the effective coordination of activities involving member institutions and other relevant authorities.
An effective Operational Resilience programme must therefore extend beyond conventional business continuity and technology recovery arrangements.
![\[OR\] \[E4\] \[C1\] Starting Your OR Implementation](https://blog.bcm-institute.org/hs-fs/hubfs/Banner%20Blog/%5BOR%5D%20%5BE4%5D%20%5BC1%5D%20Starting%20Your%20OR%20Implementation.png?width=1300&height=169&name=%5BOR%5D%20%5BE4%5D%20%5BC1%5D%20Starting%20Your%20OR%20Implementation.png)
[Dr Goh Moh Heng](https://blog.bcm-institute.org/ebook-or/author/dr-goh-moh-heng) Sep 23, 2026
###### Operational Resilience Certified Planner-Specialist-Expert
#### [](https://cta-redirect.hubspot.com/cta/redirect/3893111/52e8419c-3654-4d2f-815d-aa9dca0619a5)Chapter 1
![\[OR\] \[E4\] \[C1\] Starting Your OR Implementation](https://blog.bcm-institute.org/hs-fs/hubfs/Banner%20Blog/%5BOR%5D%20%5BE4%5D%20%5BC1%5D%20Starting%20Your%20OR%20Implementation.png?width=1300&height=169&name=%5BOR%5D%20%5BE4%5D%20%5BC1%5D%20Starting%20Your%20OR%20Implementation.png)
### Introduction to Starting Your Operational Resilience Implementation
[![\[OR\] \[PIDM\] \[E3\] \[C1\] Starting Your OR Implementation](https://no-cache.hubspot.com/cta/default/3893111/04e9ceea-5f97-4ac7-bff1-2496fec14e2d.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/04e9ceea-5f97-4ac7-bff1-2496fec14e2d)
Operational Resilience (OR) is an organisation's ability to continue delivering its critical business services during severe operational disruptions, adapt to changing circumstances, and recover without causing unacceptable harm to its stakeholders.
For Perbadanan Insurans Deposit Malaysia (PIDM), Operational Resilience is particularly important because it protects eligible depositors and policy owners, maintains institutional preparedness, and supports the orderly management of member institution failures.
Disruptions affecting these responsibilities may have consequences beyond PIDM's internal operations.
They may affect the timely delivery of protection arrangements, the availability of essential information, stakeholder confidence, and the effective coordination of activities involving member institutions and other relevant authorities.
An effective Operational Resilience programme must therefore extend beyond conventional business continuity and technology recovery arrangements.
It must establish whether PIDM can continue delivering its Critical Business Services (CBS) within defined limits of acceptable disruption, even when significant operational failures occur.
This third and final eBook, Starting Your OR Implementation, provides a practical framework for translating the concepts and methodologies introduced in the preceding two eBooks into structured implementation activities, business unit submissions, and documented resilience capabilities.
It guides PIDM's business units in preparing the information needed to demonstrate how their respective Critical Business Services are delivered, what they depend on, how much disruption they can tolerate, and whether their resilience arrangements are effective under severe but plausible conditions.
The intended outcome is a coordinated, evidence-based implementation project that supports management oversight, operational decision-making, resilience improvement, and appropriate regulatory engagement.
#### Purpose of This eBook
This eBook's primary purpose is to help PIDM begin implementing its Operational Resilience programme through a structured submission process.
Each business unit responsible for a Critical Business Service must prepare, validate, and submit information covering five implementation stages.
These submissions will form the foundation of PIDM's enterprise-wide Operational Resilience documentation.
The eBook serves five purposes:
1. Provide implementation guidance: Explain how business units should complete each stage of the Operational Resilience methodology.
2. Standardise submissions: Establish a consistent approach to documenting processes, dependencies, tolerances, scenarios, and testing results.
3. Establish accountability: Clarify the responsibilities of CBS owners, supporting functions, technology teams, and risk specialists.
4. Support management review: Produce evidence that enables senior management to identify weaknesses, assess resilience capabilities, and approve improvements.
5. Enable continuous improvement: Establish a repeatable process for updating the programme when PIDM's operating environment, business processes, technologies, or dependencies change.
The eBook is intended as an implementation workbook and reference guide, not solely as introductory reading.
Each chapter should help the relevant business unit produce a defined deliverable that can be consolidated into PIDM's Operational Resilience programme.
#### [![\[OR\] \[Thin Banner\] \[E3\] Positioning of eBook 3 within the OR Journey](https://no-cache.hubspot.com/cta/default/3893111/78f340d2-c422-43df-aadb-d2347dde326e.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/78f340d2-c422-43df-aadb-d2347dde326e)
#### **Position of This eBook Within the Three-Book Series**
The three eBooks form a progressive learning and implementation journey.
#### ![\[OR\] \[PM\] \[PIDM\] Three ebooks positioning](https://blog.bcm-institute.org/hs-fs/hubfs/%5BOR%5D%20%5BPM%5D%20Diagram/%5BOR%5D%20%5BPM%5D%20%5BPIDM%5D%20Three%20ebooks%20positioning.png?width=785&height=650&name=%5BOR%5D%20%5BPM%5D%20%5BPIDM%5D%20Three%20ebooks%20positioning.png)
#### [](https://cta-redirect.hubspot.com/cta/redirect/3893111/7bb680f4-0965-49cd-b448-b88dff6349fb)
#### **[![\[OR\] \[PIDM\] \[E3\] \[C1\] Starting Your OR Implementation](https://no-cache.hubspot.com/cta/default/3893111/04e9ceea-5f97-4ac7-bff1-2496fec14e2d.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/04e9ceea-5f97-4ac7-bff1-2496fec14e2d)**
The first two eBooks provide the pre-reading and methodological guidance needed to complete the third.
Business units should refer to them when interpreting terminology, determining service scope, applying assessment criteria, or preparing evidence.
This third eBook does not replace the earlier publications. It converts their guidance into practical work packages and submissions.
[![\[OR\] \[Thin Banner\] \[E3\] Critical Business Services in Scope](https://no-cache.hubspot.com/cta/default/3893111/29b32779-5983-4232-9cfd-e121ad0db36f.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/29b32779-5983-4232-9cfd-e121ad0db36f)
#### **Scope of the Implementation Project**
[](https://cta-redirect.hubspot.com/cta/redirect/3893111/9f906ebc-f9d2-4053-9e6f-586799079049)[](https://cta-redirect.hubspot.com/cta/redirect/3893111/e1edad86-0c49-4fd4-8885-0d7c7e6e0eb2)
The implementation project covers PIDM's ten identified Critical Business Services.
The catalogue provides the project's enterprise-level scope.
Each CBS will require a designated owner, a validated service boundary, and submissions addressing the five implementation stages.
##### **Table 1.1: Critical Business Services Within the Project Scope**
| CBS Code | Critical Business Service | Principal implementation focus |
| --- | --- | --- |
| CBS-1 | Deposit Insurance Protection Administration | Maintain the processes, information, and administrative capabilities needed to support deposit insurance protection. |
| CBS-2 | Insured Deposit Reimbursement | Maintain the capability to prepare and execute eligible depositor reimbursement following a relevant member institution failure. |
| CBS-3 | Takaful and Insurance Benefits Protection Administration | Maintain the administration of applicable protection arrangements for eligible takaful and insurance benefits. |
| CBS-4 | Protected Takaful and Insurance Benefits Fulfilment | Maintain the capability to fulfil protected benefits when the relevant triggering circumstances arise. |
| CBS-5 | Member Institution Resolution Execution | Maintain the capabilities needed to execute authorised resolution activities and coordinate critical implementation decisions. |
| CBS-6 | Member Institution Failure Preparedness and Resolution Readiness | Maintain the information, plans, resources, and readiness capabilities required before a member institution's failure. |
| CBS-7 | Member Institution Membership and Protection Obligations Administration | Maintain member institution participation records and administer applicable protection-related obligations. |
| CBS-8 | Financial Resources Availability for Protection and Resolution | Maintain access to the financial resources required to support protection and resolution activities. |
| CBS-9 | Critical Depositor, Policy Owner, and Public Communication | Maintain timely, accurate, and authoritative communication with affected stakeholders during significant disruption. |
| CBS-10 | Critical Member Institution Information and Coordination | Maintain essential information exchange and coordination with member institutions and relevant external parties. |
Catalogue status: This is the proposed implementation scope supplied for the guide. PIDM should formally validate each service's boundaries, ownership, and criticality before adopting the catalogue as its approved enterprise CBS register.
Several services may share processes, people, information, technology, and external dependencies. For example, membership information maintained under CBS-7 may support CBS-1, while information coordinated under CBS-10 may support reimbursement and resolution preparedness.
Document these relationships explicitly, rather than assigning the same process or resource to multiple services without identifying primary owners and downstream users.
The implementation should also distinguish continuous administrative services from event-driven services.
Reimbursement and resolution execution may become especially time-critical following an institution's failure, even when its routine operating volumes are comparatively low.
#### [![\[OR\] \[Thin Banner\] \[E3\] From Planning to Execution](https://no-cache.hubspot.com/cta/default/3893111/06de788e-e841-48d3-92e8-735c9e4577f1.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/06de788e-e841-48d3-92e8-735c9e4577f1)The Five Stages of OR Implementation
This eBook's core consists of five interconnected implementation stages of the Implement phase.
[![\[OR\] \[E3\] \[C1\] The Implementation Flow](https://no-cache.hubspot.com/cta/default/3893111/5951b82b-f0be-4192-bb8d-085db66a86f9.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/5951b82b-f0be-4192-bb8d-085db66a86f9)
These stages belong to the Implement phase of the Operational Resilience Planning Methodology. The earlier Plan phase establishes the organisational foundation, strategic direction, risk boundaries and governance required to execute them.
The business unit submissions produced in this eBook should therefore be described as Implement-phase submissions, rather than submissions covering five stages of the Plan phase.
\
##### **Table 1.2: Implementation Stages and Required Submissions**
| Stage | Implementation activity | Principal questions | Required submission |
| --- | --- | --- | --- |
| P2-S1 — DP | Outline Detailed Processes for CBS | What are the constituent processes? What does each process deliver, and where does it begin and end? | Approved Sub-CBS catalogue with descriptions, process boundaries, owners and principal inputs and outputs. |
| P2-S2 — MII | Map Interconnections and Interdependencies | Which processes, people, systems, data, facilities and external parties support the service? How can failure propagate? | Interconnection and dependency maps identifying critical hand-offs, shared resources, concentration risks and cross-CBS dependencies. |
| P2-S3 — iTo | Establish Impact Tolerances | What disruption would cause unacceptable harm? How should duration, scope, capacity and information integrity be measured? | Documented harm assessment, proposed service-level tolerance, supporting rationale and approval record. |
| P2-S4 — SbPS | Identify Severe but Plausible Scenarios | Which credible disruptions could challenge the service? How might simultaneous or cascading failures develop? | Scenario catalogue linking disruption pathways, dependencies, cyber and ICT risks and potential tolerance breaches. |
| P2-S4 — ST | Perform Scenario Testing | Can the service remain within tolerance under the selected scenarios? What evidence supports the result? | Approved test plans, execution records, tolerance assessments, after-action reports and remediation plans. |
This eBook presents scenario identification and scenario testing as separate practical activities, although both form part of the scenario-testing stage of the broader methodology.
##### **[](https://cta-redirect.hubspot.com/cta/redirect/3893111/51659e94-db97-4e76-bfc4-5cae0e0a7e0c)Step 1 — Outline Detailed Processes for CBS \[DP\]**
The first stage decomposes each Critical Business Service into its constituent Sub-CBS processes.
The purpose is to establish how the service is delivered from initiation to completion, including the decisions, information exchanges and operational activities necessary to achieve its intended outcome.
Business units should identify meaningful process groups rather than individual tasks or technology assets.
For each Sub-CBS, the submission should document its code, name, purpose, boundaries, accountable owner, principal inputs, outputs and relationships with other processes.
Expected result: A validated process catalogue that provides the foundation for subsequent dependency mapping.
##### **[](https://cta-redirect.hubspot.com/cta/redirect/3893111/6072e46a-8b7a-441a-9257-0c17043af1f5)Step 2 — Map Interconnections and Interdependencies \[MII\]**
The second stage identifies the relationships and dependencies required to deliver the CBS.
Mapping should cover internal processes, business units, specialist personnel, technology, data, facilities, third parties, member institutions and relevant external authorities.
It should distinguish an interconnection, which represents a linkage, from an interdependency, which represents reliance on another component's availability, performance, integrity or recovery.
Business units should also identify concentration risks, critical hand-offs and single points of dependency.
Expected result: An end-to-end map showing how disruption to one component could affect the CBS and connected services.
##### **[](https://cta-redirect.hubspot.com/cta/redirect/3893111/00e8044a-8a62-4f8f-be7c-9c267d8b3dfc)Step 3 — Establish Impact Tolerances \[iTo\]**
The third stage establishes the maximum disruption level that can be tolerated before unacceptable harm occurs.
The assessment should consider harm to depositors, policy owners, member institutions, PIDM, relevant financial markets and financial stability, where applicable.
Impact Tolerance should be expressed at the CBS level and supported by appropriate measures, such as disruption duration, minimum operating capacity, affected stakeholder scope, information integrity and statutory obligations.
It must not be equated with a system's Recovery Time Objective or an existing service-level agreement.
Expected result: A justified, measurable and formally approved boundary against which resilience capability can be assessed.
##### **Step 4 — Identify Severe but Plausible Scenarios \[SbPS\]**
The fourth stage identifies credible events sufficiently severe to challenge PIDM's ability to deliver a CBS within its Impact Tolerance.
Scenarios should examine operational, cyber, ICT, personnel, facility and third-party disruptions.
Where appropriate, they should include simultaneous failures, unavailable alternatives and cascading consequences across several Sub-CBS processes or CBS.
The purpose is to expose weaknesses rather than design scenarios that existing controls are certain to withstand.
Expected result: A prioritised scenario catalogue containing realistic disruption narratives, affected dependencies, potential harm and testing objectives.
##### **[](https://cta-redirect.hubspot.com/cta/redirect/3893111/58ea4ab9-998a-451c-bb54-801ae4cb782d)Step 5 — Perform Scenario Testing \[ST\]**
The final stage executes approved scenarios and measures the actual performance of the CBS.
Testing should use methods appropriate to the objective, including simulations, data reconciliation, technical recovery, capacity testing, crisis exercises and integrated end-to-end exercises.
Compare results with the approved Impact Tolerance.
A test is not successful solely because an application is restored or participants complete a tabletop exercise.
The assessment must establish whether the essential service remained available, accurate and effective without unacceptable harm.
Expected result: Evidence-based test conclusions, identified weaknesses, assigned remediation and a basis for retesting and continuous improvement.
#### **Business Unit Submission Framework**
This eBook introduces a structured submission process through which each business unit contributes to the enterprise-wide Operational Resilience programme.
The designated CBS owner should coordinate the preparation of the five submissions, with support from process owners, technology teams, cybersecurity, BCM, operational risk and other relevant functions.
Each submission should contain sufficient information for a reviewer to understand the assessment, trace the underlying evidence and determine whether the conclusions are justified.
##### **Table 1.3: Submission Requirements**
| Submission | Prepared by | Validation focus | Approval or review outcome |
| --- | --- | --- | --- |
| DP — Detailed Processes | CBS owner and process owners | Completeness of the service lifecycle, process boundaries and accountability. | Validated Sub-CBS catalogue. |
| MII — Dependency Mapping | Process owners with technology, data, facilities and third-party specialists | Accuracy of resource dependencies, critical hand-offs and cross-CBS relationships. | Validated dependency map and identified concentration risks. |
| iTo — Impact Tolerances | CBS owner with risk, legal, compliance and technology functions | Evidence of unacceptable harm, measurable boundaries and feasibility of proposed controls. | Formally reviewed and approved Impact Tolerance. |
| SbPS — Scenario Identification | CBS owner with BCM, cyber, ICT and operational risk specialists | Plausibility, severity, dependency coverage and relevance to the tolerance. | Approved scenario catalogue. |
| ST — Scenario Testing | CBS owner, test controller and participating functions | Test realism, actual performance, evidence quality and identified weaknesses. | Approved test results, remediation actions and retesting requirements. |
The precise approval authorities should follow PIDM's established governance arrangements.
##### **Standard Submission Structure**
Each submission should use a consistent document structure comprising:
- CBS identification, scope and accountable owner.
- Purpose, methodology and assessment assumptions.
- Detailed assessment and supporting tables.
- Interconnections with other CBS, where relevant.
- Findings, vulnerabilities and material uncertainties.
- Supporting evidence and source references.
- Review comments, approval status and version history.
Where information remains unavailable, the business unit should record the gap and its owner rather than insert an unsupported assumption as an established fact.
##### **Submission Quality Requirements**
A submission should be considered ready for consolidation only when its scope is clear, its material assertions can be traced to evidence, its dependencies have been validated, and its findings are sufficiently specific to support management decisions.
A completed template does not necessarily constitute a completed assessment.
For example, listing a backup system as a dependency is insufficient unless the submission explains what information it protects, whether it shares a failure domain with production, how recovery is performed and whether its effectiveness has been demonstrated.
#### **Roles and Responsibilities**
Operational Resilience requires coordinated accountability across PIDM.
The following structure is recommended for implementation and should be adapted to the organisation's actual governance framework.
##### **Table 1.4: Proposed Implementation Responsibilities**
| Role | Principal responsibilities |
| --- | --- |
| Board and relevant Board committees | Provide oversight of material resilience risks, review significant weaknesses and challenge management's response through established governance arrangements. |
| Senior management | Sponsor the implementation, assign accountability, approve resources and ensure material findings receive timely attention. |
| Operational Resilience programme lead | Coordinate the methodology, submission timetable, quality standards, consolidation and enterprise reporting. |
| CBS owner | Remain accountable for the end-to-end service assessment, coordinate contributing functions and validate service outcomes. |
| Sub-CBS process owners | Document processes, dependencies, disruption consequences, alternative arrangements and operational evidence. |
| Technology and ICT Risk teams | Validate technology architecture, common dependencies, system resilience, technical recovery and technology risk exposures. |
| Cybersecurity team | Assess cyber threats, detection, containment, compromised information and cyber recovery capabilities. |
| BCM and crisis management teams | Validate continuity arrangements, incident escalation, crisis coordination and alternative service delivery. |
| Operational risk, legal and compliance functions | Challenge harm assessments, identify applicable obligations and review material residual risks. |
| Third-party relationship owners | Validate external dependencies, contractual arrangements, provider recovery capabilities and alternative arrangements. |
| Internal Audit | Provide independent assurance according to its approved mandate and audit plan, without assuming management's implementation responsibilities. |
A CBS owner may depend on resources controlled by other departments. Such dependencies do not transfer accountability for the end-to-end assessment away from the CBS owner.
The programme should therefore establish clear arrangements for resolving disagreements over service boundaries, shared resources, recovery priorities and proposed Impact Tolerances.
#### **Implementation Workflow and Project Deliverables**
The project should proceed through a controlled sequence of preparation, submission, review, approval and improvement.
![\[OR\] \[PM\] Implementation Workflow and Project Deliverables](https://blog.bcm-institute.org/hs-fs/hubfs/%5BOR%5D%20%5BPM%5D%20Diagram/%5BOR%5D%20%5BPM%5D%20Implementation%20Workflow%20and%20Project%20Deliverables.png?width=793&height=718&name=%5BOR%5D%20%5BPM%5D%20Implementation%20Workflow%20and%20Project%20Deliverables.png)
##### **Enterprise-level deliverables**
Once PIDM has consolidated submissions for all ten CBS, it should have a coherent set of Operational Resilience implementation records.
These should include an approved CBS and Sub-CBS catalogue, dependency maps, service-level Impact Tolerances, severe but plausible scenario catalogues, scenario testing records and a consolidated resilience improvement plan.
The consolidated view should identify dependencies shared across services.
It should also highlight circumstances in which recovering one service competes for the same people, infrastructure, information, or third-party capacity required by another.
Such enterprise-level findings may not be visible when business units assess their services independently.
#### **BCM Institute's Training-Led Implementation Approach**
This eBook forms part of the value-added support available to organisations undertaking Operational Resilience implementation or upgrading an existing programme through BCM Institute's training-led implementation approach.
The approach combines professional learning with the practical application of a structured methodology.
Participants attending relevant certification or competency-based training courses can apply the concepts introduced during training to their own organisation's Critical Business Services.
For PIDM, the intended learning and implementation cycle is:
[![\[OR\] \[BCM\] \[CM\] \[E1\] BCM Institute Training-Led Implementation Approach](https://no-cache.hubspot.com/cta/default/3893111/b5bb56a5-de62-4593-947c-845b2b21f30b.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/b5bb56a5-de62-4593-947c-845b2b21f30b)
This approach supports developing internal implementation capability while producing documentation that PIDM can maintain after the initial project.
Training materials, example assessments and submission templates should be treated as guidance.
PIDM's business units remain responsible for validating the accuracy of their information, and management retains responsibility for approving risk decisions and resilience arrangements.
The objective is to establish a sustainable internal capability rather than depend indefinitely on external documentation preparation.
#### **Regulatory Context and Implementation Governance**
PIDM operates within Malaysia's financial protection and resolution environment and interacts with Bank Negara Malaysia and other relevant stakeholders in carrying out its mandate.
The Operational Resilience programme should therefore account for applicable Malaysian legislation, PIDM's statutory responsibilities, relevant regulatory instruments, and the requirements of its own governance framework.
BNM's December 2025 Operational Resilience Discussion Paper provides useful conceptual guidance concerning critical services, dependency mapping, disruption tolerances, severe but plausible testing and management oversight.
However, the paper's status and scope must be distinguished from binding requirements that apply directly to PIDM.
This eBook should not be interpreted as establishing that PIDM is subject to every BNM policy applicable to banks or other regulated financial institutions.
The programme should maintain a regulatory applicability assessment that identifies actual obligations and distinguishes them from implementation practices voluntarily adopted to strengthen resilience.
The five implementation stages provide a practical way to organise evidence for management review and, where appropriate, regulatory or supervisory engagement. They do not replace PIDM's statutory obligations or internal approval processes.
#### **How to Use This eBook**
Each business unit should begin by identifying the CBS for which it is responsible and confirming the corresponding service boundary with the Operational Resilience programme team.
The business unit should then complete the five stages in the prescribed sequence.
Revisit earlier submissions when later work reveals new information. For example, scenario testing may expose an undocumented dependency, requiring an update to the MII submission.
It may also demonstrate that an assumed minimum service capacity is inadequate, requiring reassessment of the proposed Impact Tolerance.
The process is therefore iterative, even though the five stages follow a logical implementation sequence.
The programme team should maintain version control so that updated assessments remain consistent across all five submissions.
##### **Implementation readiness checklist**
![\[OR\] \[PM\] Implementation Readiness Checklist](https://blog.bcm-institute.org/hs-fs/hubfs/%5BOR%5D%20%5BPM%5D%20Diagram/%5BOR%5D%20%5BPM%5D%20Implementation%20Readiness%20Checklist.png?width=790&height=391&name=%5BOR%5D%20%5BPM%5D%20Implementation%20Readiness%20Checklist.png)
**[](https://cta-redirect.hubspot.com/cta/redirect/3893111/0e4a08ff-ad9d-4277-b69d-9916925aafc4)**Starting Your OR Implementation marks the transition from understanding Operational Resilience and learning its planning methodology to applying that methodology across PIDM's Critical Business Services.
The five implementation stages—Detailed Processes, Mapping Interconnections and Interdependencies, Impact Tolerances, Severe but Plausible Scenarios and Scenario Testing—provide a structured approach for business units to document how their services operate, identify vulnerabilities and demonstrate resilience capabilities.
Through consistent submissions, cross-functional validation and management oversight, PIDM can establish an enterprise-wide view of its critical services and the resources on which they depend.
The resulting evidence should support informed decisions about resilience priorities, risk treatment, capability development and investment. It should also provide a foundation for periodic review and continuous improvement as PIDM's operating environment changes.
The next chapter begins Stage 1: Outline Detailed Processes for Critical Business Services (DP). Each CBS owner will identify and document the Sub-CBS processes required to deliver the service, establishing the foundation for all subsequent implementation activities.
[](https://cta-redirect.hubspot.com/cta/redirect/3893111/3aefb2d2-3110-47c1-ad4f-d3e6e5381066)
Blogs marked \[x\] are under construction
[](https://cta-redirect.hubspot.com/cta/redirect/3893111/56090723-e91a-4dcf-bae2-9a0dfc3808b0)
| **eBook 3: Starting Your OR Implementation** |
| --- |
| **CBS-1 ** | **CBS-2 \[x\]** | **CBS-3 \[x\]** | **CBS-4 \[x\]** | **CBS-5 \[x\]** | **List of CBS ** |
| --- | --- | --- | --- | --- | --- |
| [![\[OR\] \[GEN\] \[E3\] \[CBS\] \[1\] \[DP\] Detailed Business Processes](https://no-cache.hubspot.com/cta/default/3893111/a85ab1b7-4717-438b-a45a-f0dc04aa3a85.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/a85ab1b7-4717-438b-a45a-f0dc04aa3a85) | [![\[OR\] \[GEN\] \[E3\] \[CBS\] \[2\] \[DP\] Detailed Business Processes](https://no-cache.hubspot.com/cta/default/3893111/413aa19f-1c5e-4192-a4ce-f7623a422f33.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/413aa19f-1c5e-4192-a4ce-f7623a422f33) | [![\[OR\] \[GEN\] \[E3\] \[CBS\] \[3\] \[DP\] Detailed Business Processes](https://no-cache.hubspot.com/cta/default/3893111/c264bded-2ba8-499f-8776-551ed90f86be.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/c264bded-2ba8-499f-8776-551ed90f86be) | [![\[OR\] \[GEN\] \[E3\] \[CBS\] \[4\] \[DP\] Detailed Business Processes](https://no-cache.hubspot.com/cta/default/3893111/c2d1e3a3-5c66-4bb5-ad52-ff47a2004d19.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/c2d1e3a3-5c66-4bb5-ad52-ff47a2004d19) | [![\[OR\] \[GEN\] \[E3\] \[CBS\] \[5\] \[DP\] Detailed Business Processes](https://no-cache.hubspot.com/cta/default/3893111/21f9a85e-9b81-4f58-bf0a-d37a13b08b20.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/21f9a85e-9b81-4f58-bf0a-d37a13b08b20) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/e1edad86-0c49-4fd4-8885-0d7c7e6e0eb2) |
| **CBF-6 \[x\]** | **CBS-7 \[x\]** | **CBS-8 \[x\]** | **eBook 1** | **eBook 2** | **eBook 3** |
| [![\[OR\] \[GEN\] \[E3\] \[CBS\] \[6\] \[DP\] Detailed Business Processes](https://no-cache.hubspot.com/cta/default/3893111/2453b356-f23e-4167-9ae3-6390b9fa7448.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/2453b356-f23e-4167-9ae3-6390b9fa7448) | [![\[OR\] \[GEN\] \[E3\] \[CBS\] \[7\] \[DP\] Detailed Business Processes](https://no-cache.hubspot.com/cta/default/3893111/d6755aa3-fe6a-409b-ac62-e333a8c698fa.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/d6755aa3-fe6a-409b-ac62-e333a8c698fa) | [![\[OR\] \[GEN\] \[E3\] \[CBS\] \[8\] \[DP\] Detailed Business Processes](https://no-cache.hubspot.com/cta/default/3893111/a04c298c-943f-43a1-ae41-4009623ff7a1.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/a04c298c-943f-43a1-ae41-4009623ff7a1) | [![eBook Cover \[OR\] \[PIDM\] \[E1\] \[2D\] ](https://no-cache.hubspot.com/cta/default/3893111/6dd47adf-d0be-42c1-9f8c-27b4a9421256.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/6dd47adf-d0be-42c1-9f8c-27b4a9421256) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/ec53b531-aa72-45a7-92e6-500f45d3d29c) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/7bb680f4-0965-49cd-b448-b88dff6349fb) |
| **Consolidated Report (CR)** | | | | | |
| **DP \[x\]** | **MD \[x\]** | **MPR \[x\]** | **ITo \[x\]** | **SuPS \[x\]** | **ST \[x\]** |
| **[![\[OR\] \[GEN\] \[E3\] \[CR\] \[P1\] \[DP\] Detailed Processes (Sub-CBS)](https://no-cache.hubspot.com/cta/default/3893111/2ed59124-3a65-48e5-aa14-8596578585f9.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/2ed59124-3a65-48e5-aa14-8596578585f9)** | **[![\[OR\] \[GEN\] \[E3\] \[CR\] \[P2\] \[MD\] Map Dependency](https://no-cache.hubspot.com/cta/default/3893111/5341285b-11e4-4f7f-bdcd-af246434ddb3.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/5341285b-11e4-4f7f-bdcd-af246434ddb3)** | **[![\[OR\] \[GEN\] \[E3\] \[CR\] \[P3\] \[MPR\] Map Processes and Resources](https://no-cache.hubspot.com/cta/default/3893111/dfc007a2-14de-479a-ba96-c4a2cc531cee.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/dfc007a2-14de-479a-ba96-c4a2cc531cee)** | **[![\[OR\] \[GEN\] \[E3\] \[CR\] \[P4\] \[ITo\] Establish Impact Tolerance](https://no-cache.hubspot.com/cta/default/3893111/c922c2b8-e63b-4305-9e8c-e7491707b5bc.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/c922c2b8-e63b-4305-9e8c-e7491707b5bc)** | **[![\[OR\] \[GEN\] \[E3\] \[CR\] \[P5\] \[SuPS\] Identify Severe but Plausible Scenarios](https://no-cache.hubspot.com/cta/default/3893111/2447d25d-92f1-444d-87c8-55563195f14e.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/2447d25d-92f1-444d-87c8-55563195f14e)** | **[![\[OR\] \[GEN\] \[E3\] \[CR\] \[P6\] \[ST\] Perform Scenario Testing](https://no-cache.hubspot.com/cta/default/3893111/9cc4faa3-60cb-4b09-8582-f9edd8103ed0.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/9cc4faa3-60cb-4b09-8582-f9edd8103ed0)** |
**[](https://cta-redirect.hubspot.com/cta/redirect/3893111/084e620a-46c5-419a-82ed-6a681d15c0b6)**[](https://cta-redirect.hubspot.com/cta/redirect/3893111/309c3a80-4c3c-4eb9-811d-bd401ccb1610)For organisations looking to accelerate their journey, BCM Institute’s training and certification programs, including the **OR-5000 Operational Resilience Expert Implementer course**, provide in-depth insights and practical toolkits to embed this model effectively.
#### More Information About OR-5000 \[OR-5\] or OR-300 \[OR-3\]
Gain Competency: For organisations looking to accelerate their journey, BCM Institute’s training and certification programs, including the OR-5000 Operational Resilience Expert Implementer course, provide in-depth insights and practical toolkits for effectively embedding this model.
To learn more about the course and schedule, click the buttons below for the \[OR-3\] OR-300 Operational Resilience Implementer course and the \[OR-5\] OR-5000 Operational Resilience Expert Implementer course.
| [](https://cta-redirect.hubspot.com/cta/redirect/3893111/3530eccb-515d-401e-afc2-3469e26d7fbf) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/fdd4fa9c-ed69-40c1-925f-4eb6a1c5c255) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/77a34b84-0a6d-44f8-b8d6-6ab04cdf5edd) |
| --- | --- | --- |
| [](https://cta-redirect.hubspot.com/cta/redirect/3893111/6e5c0cda-39b9-4bbd-b3d4-4cf46a790b14) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/a68a08aa-36d3-4216-9551-202c9fde06ea) | [![ \[BL-OR\] \[3-4-5\] View Schedule](https://no-cache.hubspot.com/cta/default/3893111/d0d733a1-16c0-4b68-a26d-adbfd4fc6069.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/d0d733a1-16c0-4b68-a26d-adbfd4fc6069) |
| [![\[BL-OR\] \[3\] FAQ OR-300](https://no-cache.hubspot.com/cta/default/3893111/f20c71b4-f5e8-4aa5-8056-c374ca33a091.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/f20c71b4-f5e8-4aa5-8056-c374ca33a091) | If you have any questions, click to contact us.[![Email to Sales Team \[BCM Institute\]](https://no-cache.hubspot.com/cta/default/3893111/3c53daeb-2836-4843-b0e0-645baee2ab9e.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/3c53daeb-2836-4843-b0e0-645baee2ab9e) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/7f2718a4-ea80-4f84-a319-dc2d4df37a46) |
| [](https://cta-redirect.hubspot.com/cta/redirect/3893111/74b1e556-8cd2-4a74-8821-db1804534955) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/f2bd8eb1-32d2-4732-9267-ea53223cf58f) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/084e620a-46c5-419a-82ed-6a681d15c0b6) |
#### **Your Comments Here:**
---
---
---
---
All rights reserved. Copyright 2026
```json
{
"@context" : "https://schema.org",
"@type" : "BlogPosting",
"author" : {
"@type" : "Person",
"name" : "Dr Goh Moh Heng",
"url" : "https://blog.bcm-institute.org/ebook-or/author/dr-goh-moh-heng"
},
"dateModified" : "2026-09-23T16:00:05.106Z",
"datePublished" : "2026-09-23T08:07:46.000Z",
"headline" : "[OR] [PIDM] [E3] [C1] Starting Your OR Implementation",
"mainEntityOfPage" : {
"@id" : "https://blog.bcm-institute.org/ebook-or/or-pidm-e3-c1-starting-your-or-implementation",
"@type" : "WebPage"
},
"publisher" : {
"@type" : "Organization",
"logo" : {
"@type" : "ImageObject",
"url" : "https://blog.bcm-institute.org/hubfs/BCMI%20Logo.png"
},
"name" : "BCMI Pte Ltd"
}
}
```