[BCM] [Damanat] [E3] [BCS] [T3] [CBF] [1] Minimum Resources Required During a Disaster

Business Continuity Management extends beyond identifying recovery strategies by ensuring that the minimum resources required to implement them are available during a disruption.

Recovery strategies define how critical business activities will resume, whereas minimum recovery resources identify what is required to achieve that recovery.

These resources encompass personnel, facilities, technology, information, communications, equipment, and external services necessary to sustain operations at the minimum acceptable service level until full operational capability can be restored.

For The Saudi Mortgage Guarantees Services Company (Damanat), CBF-1: Mortgage Guarantee Origination represents one of its most critical operational functions.

The ability to continue receiving, assessing, approving and registering mortgage guarantees supports financial institutions, borrowers, regulatory obligations and national housing initiatives.

Consequently, sufficient recovery resources must be available immediately following a disruption to enable Damanat to resume essential guarantee origination activities within the approved or indicative Recovery Time Objectives (RTOs).

The resource requirements presented in this chapter represent minimum recovery capacity rather than normal operational capacity.

The figures provided are indicative assumptions developed using recognised Business Continuity Management practices and should be validated by business process owners, Human Resources, ICT, Facilities Management, Procurement and Executive Management during the Business Impact Analysis and Business Continuity Strategy approval process.

 

Recovery Resource Planning Principles

The minimum recovery resources are based on the following principles:

• Recover the highest-priority business activities first.
• Provide sufficient resources to achieve the minimum acceptable level of service.
• Share recovery resources wherever practical.
• Restore technology before dependent business activities.
• Scale recovery resources progressively as operations stabilise.
• Maintain sufficient resilience to withstand extended disruptions.

 

Resource Categories

For planning purposes, recovery resources have been grouped into the following categories:

1. People Resources
2. Workplace Resources
3. ICT Infrastructure
4. Business Applications
5. Information Resources
6. Communications Resources
7. Equipment and Office Facilities
8. Third-Party Resources

Table BCS P3: Minimum Recovery Resources for CBF-1 Mortgage Guarantee Origination (Part 1)

Assumptions

• Resources represent the minimum required to maintain essential operations.
• Quantities are indicative and require validation by Damanat.
• Recovery may initially operate at approximately 30–50% of normal operational capacity, increasing progressively as additional resources become available.

 

Sub-CBF	Minimum People (Indicative)	Workplace Requirement	Minimum ICT Resources	Critical Information	Essential Third Parties	Priority
1.1 Mortgage Guarantee Application Intake	3 Operations Officers + 1 Supervisor	Secure alternate workplace or remote working	Mortgage Origination System, secure email, internet connectivity, document management system	Mortgage applications, customer records, application forms	Participating financial institutions, telecommunications provider	Critical
1.2 Application Validation	2 Validation Officers	Remote working or alternate office	Workflow management system, document repository	Application documents, validation checklist	Participating financial institutions	Critical
1.3 Borrower Eligibility Assessment	3 Credit Assessment Officers	Secure recovery workplace	Credit assessment application, identity verification platform	Borrower financial records, customer profiles	Credit bureau, identity verification provider	Critical
1.4 Property Eligibility Assessment	2 Property Assessment Specialists	Remote working	Property assessment system, document repository	Property valuation reports, ownership records	Property valuation firms	High
1.5 Mortgage Risk Assessment	3 Mortgage Risk Analysts	Alternate workplace	Risk assessment application, analytics platform	Risk models, borrower information	Banking partners	Critical
1.6 Guarantee Policy Compliance Review	2 Compliance Officers	Remote working	Compliance management system	Regulatory policies, guarantee guidelines	Compliance advisory services	High
1.7 Financial Institution Verification	2 Relationship Officers	Alternate workplace	CRM system, secure communications	Financial institution profiles	Participating financial institutions	High
1.8 Guarantee Approval Decision	2 Approving Officers	Executive recovery workspace	Approval workflow system with MFA	Approval records, delegated authority register	Executive management	Critical

Resource Requirements by Category

 Minimum People Resources

Recovery personnel should possess sufficient competencies to perform multiple operational roles where practical. Cross-training reduces dependency on specialist staff and improves recovery flexibility.

The initial recovery team for the first eight Sub-CBFs should include:

 

Role	Indicative Minimum Number
Operations Supervisor	1
Mortgage Guarantee Officers	5
Validation Officers	2
Mortgage Risk Analysts	3
Compliance Officers	2
Relationship Officers	2
Approving Officers	2
ICT Support Engineers	2
Information Security Specialist	1
Business Continuity Coordinator	1
Administrative Support	2

Total Initial Recovery Team: 21 personnel (Indicative)

These resources represent only the minimum staffing required to maintain essential mortgage guarantee origination activities. Additional personnel should be deployed progressively as recovery capacity increases.

Workplace Resources

To support the initial recovery phase, Damanat should ensure the availability of:

• Secure alternate workplace facilities.
• Approved remote working capability.
• Executive coordination room.
• Meeting facilities for operational decision-making.
• Secure printing and document handling capability.
• Access-controlled working environment.
• Emergency power supply.
• Adequate environmental controls.

Recovery workplaces should be able to support essential business activities for an extended period if access to the primary office remains unavailable.

ICT Infrastructure

The minimum ICT infrastructure required during the initial recovery period includes:

Infrastructure Component	Minimum Requirement
Network Connectivity	Redundant internet access
Secure Remote Access	VPN with Multi-Factor Authentication
Identity Management	Active Directory or equivalent authentication services
Virtual Desktop Infrastructure	Where remote operations are required
Database Services	Restored production databases
Backup Systems	Latest verified backup available
Disaster Recovery Site	Operational and synchronised
Cybersecurity Monitoring	SIEM and endpoint protection operational
Voice Communications	IP telephony or equivalent
Video Conferencing	Executive and operational coordination capability

 

Planning Assumptions

The indicative resource quantities are based on several assumptions:

• Recovery occurs outside the primary workplace.
• Core ICT services have been recovered within the approved ICT Disaster Recovery objectives.
• Participating financial institutions remain operational.
• Telecommunications services remain available.
• Key suppliers continue providing contracted services.
• Electronic records have been successfully restored.
• Essential personnel remain available or suitable alternates have been activated.

Where these assumptions cannot be met, additional contingency arrangements—including manual processing, mutual assistance agreements, or expanded recovery resources—may be required.

 

BCS P3: Minimum Recovery Resources for CBF-1 Mortgage Guarantee Origination (Part 2)

The next section will complete the chapter by covering Sub-CBFs 1.9–1.15, followed by:

• ICT Disaster Recovery Infrastructure Requirements
• Minimum Information Resources
• Communications Resources
• Equipment and Workplace Resources
• Third-Party Recovery Resources
• Resource Gap Analysis
• Resource Scaling Strategy
• Chapter Conclusion

Table BCS P3: Minimum Recovery Resources for CBF-1 Mortgage Guarantee Origination (Part 2)

This section completes the minimum recovery resource assessment for the remaining Sub-Critical Business Functions (Sub-CBFs). The resource quantities shown are indicative minimum requirements intended to sustain essential business operations during a disruption. They should be validated by Damanat's business owners, Human Resources, ICT, Facilities Management and Executive Management.

 

Sub-CBF	Minimum People (Indicative)	Workplace Requirement	Minimum ICT Resources	Critical Information	Essential Third Parties	Priority
1.9 Guarantee Certificate Generation	2 Guarantee Officers	Alternate workplace or secure remote operations	Guarantee Management System, document generation software, digital signature platform	Approved guarantee records, certificate templates	Digital certificate service provider, participating financial institutions	High
1.10 Guarantee Registration	2 Registration Officers	Alternate workplace	Guarantee Register database, workflow application	Guarantee register, registration logs	Financial institutions	High
1.11 Stakeholder Notification	2 Communications Officers	Remote working or communications centre	CRM system, email platform, SMS gateway, website content management	Stakeholder contact database, communication templates	Telecommunications provider, messaging gateway provider	Critical
1.12 Documentation and Record Management	2 Records Officers	Secure records management workspace	Electronic Document Management System (EDMS), secure storage	Electronic records, document repository, audit logs	Off-site records storage provider	Critical
1.13 Guarantee Fee Administration	2 Finance Officers	Finance recovery workspace	Financial management system, banking interfaces	Fee schedules, financial records, billing data	Banking partners, payment gateway provider	High
1.14 Post-Issuance Quality Assurance	2 Quality Assurance Officers	Remote working	Quality management application, reporting tools	Audit trails, review checklists, transaction history	Internal Audit, participating financial institutions	Medium
1.15 Management Reporting and Regulatory Monitoring	2 Reporting Analysts + 1 Compliance Officer	Executive recovery workspace	Business Intelligence platform, reporting database	Operational reports, regulatory submissions, KPI dashboard	Saudi Central Bank (SAMA), Insurance Authority	High

 

Summary of Minimum Recovery Resources

Minimum Recovery Personnel

The complete minimum recovery team supporting CBF-1 Mortgage Guarantee Origination should comprise approximately:

 

Functional Area	Indicative Minimum Staff
Mortgage Guarantee Operations	10
Risk Assessment	3
Compliance	3
Relationship Management	2
Registration & Certification	4
Finance	2
Records Management	2
Quality Assurance	2
Management Reporting	2
ICT Support	3
Information Security	1
Business Continuity Coordination	1
Administrative Support	2
Total Minimum Recovery Staff	37 Personnel

This represents the minimum staffing necessary to maintain approximately 30–50% of normal operational capacity during the initial recovery phase.

Minimum Workplace Resources

To sustain the minimum recovery workforce, Damanat should ensure that the following facilities are available:

Resource	Indicative Minimum Requirement
Recovery Workstations	40
Secure Remote Working Licences	40
Meeting Room	1
Executive Coordination Room	1
Printer / Scanner	2 Multi-function devices
Secure Storage Cabinets	4
Emergency Power Supply	Continuous UPS and standby generator support
Internet Connectivity	Dual redundant internet connections
Access Control	Electronic access management
CCTV	Operational security monitoring

These facilities should support both short-term relocation and prolonged recovery operations.

Minimum ICT Disaster Recovery Infrastructure

Successful recovery of Mortgage Guarantee Origination depends on restoring critical ICT services before business activities can resume.

 

ICT Resource	Minimum Recovery Requirement
Mortgage Guarantee Processing System	Fully operational
Workflow Management System	Fully restored
Customer Relationship Management (CRM)	Operational
Document Management System	Operational
Financial Management System	Operational
Business Intelligence Platform	Available for priority reporting
Active Directory / Identity Management	Fully operational
Multi-Factor Authentication	Enabled
VPN Services	Available for all recovery staff
Corporate Email	Operational
Internet Access	Dual connectivity
Database Servers	Restored from verified backup
Storage Systems	Replicated and synchronised
Backup Environment	Verified and recoverable
Disaster Recovery Site	Operational
SIEM Platform	Active monitoring enabled
Endpoint Detection and Response (EDR)	Operational

Minimum Information Resources

The following information assets are considered essential for the continuation of CBF-1:

• Mortgage guarantee application records
• Borrower eligibility information
• Property valuation documentation
• Mortgage risk assessment records
• Guarantee approval records
• Guarantee certificates
• Registration database
• Financial institution master records
• Customer contact database
• Regulatory compliance documentation
• Fee schedules and billing information
• Management reports
• Regulatory reporting templates
• Delegation of authority register
• Business Continuity Plans
• Crisis Management procedures
• ICT Disaster Recovery documentation

All information should be replicated to secure off-site storage and protected through encryption, backup, and integrity validation.

Minimum Communications Resources

Effective communication is essential during recovery operations.

 

Communication Resource	Purpose
Corporate Email	Internal and external communication
Mobile Telephones	Executive and operational coordination
Microsoft Teams or equivalent	Virtual collaboration
Emergency Notification System	Staff activation
SMS Gateway	Stakeholder notification
Corporate Website	Public service updates
Secure Messaging Platform	Coordination with financial institutions
Crisis Hotline	Incident reporting and escalation

Third-Party Recovery Resources

Damanat's recovery capability depends upon several external organisations.

 

Third Party	Recovery Role
Participating Financial Institutions	Continue submission and verification of guarantee applications
Credit Bureau	Borrower verification
Property Valuation Firms	Property assessment support
Cloud Service Provider	Recovery of hosted applications
Telecommunications Provider	Internet and communications
Banking Partners	Fee collection and settlement
Digital Certificate Provider	Guarantee certificate issuance
Cybersecurity Service Provider	Incident monitoring and response
Off-site Records Storage Provider	Recovery of physical records where required

Third-party resilience should be validated through supplier continuity assessments, contractual service level agreements, and periodic resilience reviews.

 

Resource Gap Analysis

Based on the indicative recovery resource assessment, Damanat should validate the following areas during implementation:

People

• Cross-training coverage for all critical operational roles.
• Succession arrangements for specialist personnel.
• Availability of recovery teams outside normal working hours.

Workplace

• Capacity of alternate recovery locations.
• Suitability of long-duration remote working arrangements.
• Availability of secure executive coordination facilities.

ICT

• Disaster Recovery capability for all critical applications.
• Recovery sequencing of integrated systems.
• Recovery testing of cloud-hosted services.
• Cybersecurity monitoring during recovery operations.

Information

• Integrity of replicated electronic records.
• Restoration testing of document repositories.
• Availability of regulatory reporting information.

Third Parties

• Supplier Business Continuity Plans.
• Recovery commitments in service agreements.
• Periodic supplier resilience assessments.

 

Resource Scaling Strategy

Recovery resources should be deployed progressively as operational capability improves.

 

Recovery Phase	Target Capacity	Indicative Duration
Initial Response	30%	First 24 hours
Essential Operations	50%	Days 2–5
Expanded Recovery	75%	Week 2
Full Restoration	100%	Following successful restoration of primary operations

The progression between phases should be determined by management based on the availability of personnel, ICT systems, facilities, and third-party services rather than fixed timelines alone. 

Identifying minimum recovery resources translates Damanat's Business Continuity Strategy into practical operational capability.

By defining the minimum personnel, facilities, technology, information, communications, equipment, and third-party services required to sustain CBF-1 Mortgage Guarantee Origination, the organisation establishes a realistic foundation for implementing effective Business Continuity Plans.

These resource estimates are intentionally conservative and represent the minimum capability required to maintain essential mortgage guarantee services rather than normal operating capacity.

Before implementation, each resource assumption should be validated through the Business Impact Analysis, Recovery Strategy workshops, dependency mapping, and consultation with business owners and support functions.

Regular testing, exercising, and periodic reviews should then confirm that these resources remain available and sufficient to achieve Damanat's approved recovery objectives as its business processes, technology, and operating environment continue to evolve.