Following the completion of the Risk Analysis and Review (RAR) and Business Impact Analysis (BIA), the next step in the BCM planning methodology is to determine appropriate mitigation strategies that reduce the organisation's exposure to identified threats before they develop into business continuity incidents.
For the Saudi Mortgage Guarantees Services Company (Damanat), mitigation strategies should strengthen the resilience of critical mortgage guarantee operations, protect essential information assets, improve the reliability of technology and infrastructure, enhance workforce preparedness, and minimise dependence on single points of failure.
These strategies complement the existing preventive and detective controls identified during the Risk Analysis and Review while supporting Damanat's ability to continue providing mortgage guarantee services to financial institutions and stakeholders across the Kingdom of Saudi Arabia.
The purpose of Table BCS P1 – Mitigation Strategies is to evaluate the current residual risk associated with each identified threat and determine whether additional measures should be implemented to further reduce the likelihood of disruption or lessen its potential consequences.
The recommended mitigation strategies should be practical, proportionate to the level of risk, and aligned with recognised Business Continuity Management and Enterprise Risk Management practices.
They should also support regulatory expectations issued by the Saudi Central Bank (SAMA) and the Insurance Authority of Saudi Arabia, while recognising that the final treatment decisions remain subject to management review, available resources, and organisational priorities.
|
Threat |
Existing Controls |
Risk Rating |
Risk Level |
Risk Treatment (Residual Risk) |
Additional Mitigation Strategy |
Justification for Selected Mitigation Strategy |
|
Flood |
Building protection measures, emergency response procedures, insurance coverage, alternate workplace arrangements |
8 |
Moderate |
Reduce |
Enhance flood monitoring, improve facility protection, periodically validate alternate workplace readiness |
Reduces operational disruption and improves continuity of critical services should flooding affect premises. |
|
Severe Storm |
Emergency response procedures, facility maintenance, remote working capability |
6 |
Moderate |
Reduce |
Improve weather monitoring, strengthen emergency communications and remote access capability |
Minimises disruption arising from adverse weather and enables timely activation of continuity arrangements. |
|
Fire |
Fire detection and suppression systems, evacuation procedures, fire drills, insurance |
10 |
High |
Reduce |
Conduct periodic fire risk assessments, strengthen protection of critical records, review alternate site readiness |
Reduces the probability of extensive facility damage and improves recovery capability. |
|
Building Access Restriction |
Physical security, visitor management, remote access capability |
12 |
High |
Reduce |
Expand hybrid working capability, identify additional alternate office locations, strengthen access contingency procedures |
Enables continuity of essential operations when physical access to offices is restricted. |
|
Pandemic |
Health and safety policies, remote working, succession planning, hygiene measures |
15 |
High |
Reduce |
Expand cross-training, strengthen workforce resilience planning, periodically review pandemic response procedures |
Reduces dependence on individual personnel and improves sustained operational capability during prolonged workforce disruption. |
|
Loss of Key Personnel |
Succession planning, documented procedures, knowledge management |
12 |
High |
Reduce |
Increase cross-functional training, develop role-based contingency plans, maintain competency matrices |
Reduces operational dependency on specialised personnel and improves organisational resilience. |
|
Critical Supplier Failure |
Supplier due diligence, service agreements, vendor monitoring |
12 |
High |
Reduce |
Develop alternate suppliers, strengthen supplier resilience assessments, periodically test supplier continuity arrangements |
Reduces dependency on individual suppliers supporting critical mortgage guarantee operations. |
|
Power Failure |
UPS systems, standby generators, preventive maintenance |
12 |
High |
Reduce |
Increase generator testing frequency, improve power redundancy for critical ICT infrastructure |
Enhances resilience of essential technology supporting business operations. |
|
Telecommunications Failure |
Multiple communication channels, resilient network infrastructure |
12 |
High |
Reduce |
Implement additional network redundancy, diversify telecommunications providers |
Improves communication resilience and reduces reliance on a single network provider. |
|
Cyberattack |
Cybersecurity framework, firewalls, endpoint protection, security monitoring, incident response |
20 |
Extreme |
Reduce |
Strengthen Security Operations Centre (SOC) monitoring, implement Zero Trust architecture, increase cybersecurity awareness training |
Addresses evolving cyber threats and strengthens protection of critical systems and sensitive information. |
|
Ransomware |
Secure backups, endpoint detection, access controls, malware protection |
20 |
Extreme |
Reduce |
Implement immutable backup solutions, strengthen privileged access management, increase ransomware simulation exercises |
Reduces recovery time and limits operational impact following a ransomware incident. |
|
Application Failure |
Application monitoring, change management, disaster recovery procedures |
12 |
High |
Reduce |
Increase application resilience testing, improve application redundancy and monitoring |
Improves availability of systems supporting mortgage guarantee processing and regulatory reporting. |
|
Data Centre Outage |
Disaster Recovery site, backup infrastructure, data replication |
15 |
High |
Reduce |
Enhance geographic redundancy, automate disaster recovery testing, strengthen cloud resilience capabilities |
Improves continuity of ICT services and reduces recovery time following major infrastructure failures. |
The mitigation strategies identified in Table BCS P1 provide Damanat with a structured approach to reducing the likelihood and impact of threats that may disrupt its critical business functions.
While existing controls establish an important baseline for managing operational risk, the recommended additional mitigation measures strengthen organisational resilience by addressing residual risks that remain after current controls have been considered.
The implementation of these strategies should be prioritised according to the organisation's risk appetite, available resources, regulatory obligations, and business priorities.
High and Extreme residual risks, particularly those associated with cybersecurity, technology resilience, critical suppliers, workforce availability, and operational infrastructure, should receive management attention as part of Damanat's continual improvement programme.
The approved mitigation strategies documented in this chapter provide the foundation for the next stage of the Business Continuity Strategy (BCS), where appropriate recovery strategies and minimum resource requirements will be developed to ensure that critical mortgage guarantee services can continue or be restored within acceptable timeframes following a disruptive event.
| eBook 3: Starting Your BCM Implementation |
||||||
| MBCO | P&S | RAR T1 | RAR T2 | RAR T3 | BCS T1 | CBF |
To learn more about the course and schedule, click the buttons below for the BCM-300 Business Continuity Management Implementer [BCM-3] and the BCM-5000 Business Continuity Management Expert Implementer [BCM-5].
|
Please feel free to send us a note if you have any questions. |
||