[BCM] [Damanat] [E3] [RAR] [T1] List of Threats

Category of Threats

Types of Threats

Description of Threats

Country Level

Organisation Level

Denial of Access – Natural Disaster

Earthquake

Seismic activity affecting buildings, ICT infrastructure and transportation networks.

Saudi Arabia experiences occasional seismic activity, particularly in western regions, which may affect infrastructure and essential services.

Temporary closure of offices, disruption to mortgage guarantee processing, staff safety concerns and possible ICT service interruption.

Flash Flood

Heavy rainfall is causing flash flooding around business premises or transport routes.

Flash floods periodically affect several regions, disrupting transport, utilities and public services.

Employees are unable to reach offices, there is an interruption to business operations and possible damage to facilities.

Severe Sandstorm

Dust storms are reducing visibility and affecting transport, power and communications.

Sandstorms are common climatic events that disrupt travel, aviation and utility services.

Reduced workforce availability, degraded network connectivity and delays in guarantee processing.

Extreme Heat

Prolonged high temperatures affecting people and critical infrastructure.

Seasonal extreme temperatures increase pressure on national power infrastructure and cooling systems.

Reduced employee productivity, overheating of ICT equipment and increased facility operating risks.

Pandemic

Widespread infectious disease outbreak affecting the workforce.

National health emergencies may restrict movement and business operations.

High absenteeism, remote-working dependency, and reduced operational capacity.

Denial of Access – Man-made Disaster

Fire

Fire affecting offices, archives or ICT facilities.

Fire incidents may disrupt utility infrastructure and neighbouring developments.

Damage to facilities, records and ICT equipment resulting in operational disruption.

Explosion

Explosion in or near operational facilities.

Industrial or urban incidents may affect nearby organisations.

Evacuation of premises, damage to infrastructure and prolonged interruption of services.

Hazardous Material Release

Chemical spill or hazardous substance affecting business premises.

Industrial accidents or transportation incidents may create exclusion zones.

Restricted access to facilities and temporary suspension of operations.

Civil Disturbance

Public disorder affecting transportation or access.

Localised security incidents may disrupt movement within affected areas.

Staff are unable to access workplaces and delays in operational activities.

Terrorist Incident

Deliberate attack targeting public infrastructure or critical services.

National critical infrastructure may become the target of security threats.

Activation of crisis management arrangements and prolonged disruption to essential services.

Building Access Restriction

Authorities prohibit access due to safety or security concerns.

Government-imposed restrictions following emergencies or investigations.

Temporary relocation of staff and interruption to customer services.

Unavailability of People

Loss of Key Personnel

Departure, illness or unavailability of personnel with specialist knowledge.

Competition for specialised financial and ICT professionals within the national labour market.

Delays in mortgage guarantee assessments, approvals and strategic decision-making.

Industrial Action

Workforce disputes affecting employee availability.

Labour-related disruptions may affect outsourced service providers or contractors.

Reduced staffing levels and slower service delivery.

High Staff Absenteeism

Significant number of employees unavailable simultaneously.

Public health events or transport disruptions affecting workforce availability.

Processing backlogs and reduced customer service capability.

Skills Shortage

Insufficient availability of specialised personnel.

National demand for skilled financial, cybersecurity and technology professionals.

Increased dependency on a limited number of employees and reduced organisational resilience.

Human Error

Mistakes during operational activities.

Human error remains a universal organisational risk across all industries.

Incorrect mortgage guarantee decisions, operational delays and increased rework.

Disruption to the Supply Chain

Critical Supplier Failure

Failure of a key supplier providing critical business services.

National or regional disruptions affecting suppliers and logistics.

Loss of essential external services supporting business operations.

Cloud Service Provider Outage

Failure of cloud infrastructure supporting applications.

Regional cloud service disruptions affecting multiple organisations.

Reduced availability of business applications and customer services.

Telecommunications Failure

Failure of telecommunications networks.

Nationwide telecommunications outages affecting public and private sectors.

Loss of communication between staff, customers and financial institutions.

Internet Service Provider Failure

Internet connectivity disruption.

National network failures or infrastructure maintenance affecting connectivity.

Inability to access cloud applications and external business services.

Credit Bureau Service Failure

Credit information services become unavailable.

National financial infrastructure disruption affecting credit reporting services.

Delays in borrower verification and guarantee approval processes.

Banking Partner System Failure

Partner financial institutions experience system outages.

Banking sector operational disruptions affecting financial transactions.

Delayed mortgage guarantee issuance and settlement activities.

Outsourced ICT Support Failure

External ICT support provider unavailable.

Service provider disruption affecting multiple customers.

Delayed incident response and extended ICT recovery times.

Equipment and IT-Related Disruption

Commercial Power Failure

Loss of electrical power to business premises or ICT facilities.

National or regional electricity disruptions affecting businesses.

Interruption of business operations and system availability.

HVAC Failure

Failure of cooling or environmental control systems.

Infrastructure failures affecting commercial buildings.

Overheating of ICT equipment and reduced workplace usability.

Network Failure

Failure of internal or external communications networks.

National telecommunications infrastructure issues affecting connectivity.

Business systems become inaccessible, interrupting guarantee processing.

Data Centre Outage

Primary hosting environment unavailable.

Regional infrastructure disruption affecting hosting facilities.

Critical business applications unavailable for extended periods.

Core Mortgage Guarantee System Failure

Failure of the primary mortgage guarantee application.

Software defects or infrastructure failures affecting financial platforms.

Suspension of guarantee processing and customer services.

Database Failure

Corruption or failure of operational databases.

Technology failures affecting enterprise information management.

Loss of transaction integrity and delayed operational recovery.

Identity and Access Management Failure

Authentication or access control services unavailable.

Cyber or infrastructure incidents affecting identity services.

Employees unable to access critical business applications.

Backup Failure

Backup processes fail or cannot be restored successfully.

Technology failures affecting backup infrastructure.

Increased recovery time and potential information loss.

Storage System Failure

Enterprise storage infrastructure becomes unavailable.

Hardware failures affecting digital infrastructure.

Loss of business information availability and operational disruption.

Cybersecurity Threats

Ransomware Attack

Malware encrypting critical systems and business information.

Increasing cyber threats targeting government and financial sectors globally and nationally.

Complete disruption of business systems and recovery operations.

Malware Infection

Malicious software compromising ICT assets.

Continuous cyber threat environment affecting organisations.

Reduced system availability, data compromise and operational disruption.

Phishing Attack

Fraudulent attempts to obtain credentials or confidential information.

Persistent cybercrime targeting financial institutions.

Compromise of user accounts and unauthorised access to systems.

Business Email Compromise

Fraud involving spoofed or compromised email communications.

Increasing financial cybercrime targeting organisations.

Financial losses, fraudulent transactions and reputational damage.

Distributed Denial-of-Service (DDoS) Attack

Attack overwhelming online services.

National critical infrastructure and financial institutions remain potential targets.

Customer-facing services become unavailable.

Insider Cyber Threat

Malicious or negligent actions by employees or contractors.

Insider risks affecting organisations across all sectors.

Data leakage, fraud and operational disruption.

Data Breach

Unauthorised disclosure of confidential information.

Cybersecurity incidents affecting financial institutions worldwide.

Regulatory investigations, reputational damage and stakeholder loss of confidence.

Information Management

Loss of Physical Records

Destruction or loss of paper-based records.

Fire, flooding or accidental loss affecting document repositories.

Delays in regulatory compliance and customer servicing.

Electronic Record Corruption

Corruption of electronic documents and records.

ICT failures affecting enterprise information repositories.

Loss of business information integrity and operational disruption.

Data Integrity Failure

Information becomes inaccurate or incomplete.

Data quality issues affecting financial decision-making.

Incorrect guarantee decisions and financial exposure.

Financial Threats

Fraudulent Mortgage Applications

Submission of false borrower or property information.

Mortgage fraud affecting financial institutions and housing markets.

Financial loss, increased credit risk and reputational damage.

Internal Fraud

Fraud committed by employees or contractors.

Fraud risks inherent across financial organisations.

Financial losses, legal exposure and reduced stakeholder confidence.

Financial Market Instability

Economic fluctuations affecting mortgage markets.

National or global financial uncertainty impacting housing finance.

Increased business volatility and operational planning challenges.

Regulatory and Legal Threats

Regulatory Change

New laws or regulatory expectations were introduced.

Regulatory reforms affecting financial services organisations.

Business process changes, compliance costs and operational adjustments.

Regulatory Investigation

Supervisory reviews or investigations.

Increased regulatory oversight across financial institutions.

Resource diversion, operational disruption and reputational exposure.

Legal Proceedings

Litigation involving the organisation.

Legal disputes affecting financial institutions.

Financial liabilities and management distraction.

Physical Security Threats

Physical Intrusion

Unauthorised access to business premises.

Security incidents affecting commercial buildings.

Theft, sabotage or information compromise.

Theft

Theft of ICT assets or confidential information.

Criminal activities affecting businesses.

Financial loss and disruption to operations.

Vandalism

Deliberate damage to facilities or equipment.

Local criminal activity affecting commercial premises.

Repair costs and temporary service disruption.

Operational Threats

Process Failure

Failure of critical business processes.

Operational weaknesses affecting financial institutions.

Delayed mortgage guarantee processing and customer dissatisfaction.

Manual Workaround Failure

Manual procedures ineffective during ICT disruption.

Organisations unable to sustain operations without technology.

Extended interruption of critical services.

Inadequate Business Continuity Planning

Continuity arrangements are incomplete or outdated.

Organisations insufficiently prepared for disruptive events.

Longer recovery times and increased operational risk.

Inadequate Crisis Management

Ineffective coordination during major incidents.

National emergencies requiring coordinated organisational response.

Poor decision-making and delayed recovery.

Failure of Disaster Recovery Arrangements

ICT recovery capability proves ineffective.

Technology recovery failures affecting critical infrastructure.

Extended ICT outages and prolonged operational disruption.

Reputational Threats

Negative Media Coverage

Adverse publicity concerning the organisation.

Media scrutiny affecting public confidence in financial institutions.

Reduced stakeholder trust and reputational harm.

Social Media Misinformation

False or misleading information is circulating online.

Rapid dissemination of misinformation across digital platforms.

Increased customer enquiries and loss of public confidence.

Service Delivery Failure

Failure to meet customer or stakeholder expectations.

Reduced confidence in financial sector services.

Customer dissatisfaction and reputational damage.

Strategic Threats

Governance Failure

Ineffective leadership or oversight.

Weak governance affecting organisational resilience.

Poor strategic decisions and increased operational risk.

Poor Change Management

Inadequate management of organisational or technology changes.

Transformation initiatives introduce operational risks.

System instability, project failure and business disruption.

Third-Party Concentration Risk

Over-reliance on a small number of suppliers.

National dependence on limited specialised service providers.

Increased exposure to supplier failures and reduced resilience.

Simultaneous Multiple Disruptions

Multiple unrelated incidents occurring concurrently.

Large-scale emergencies affecting multiple sectors simultaneously.

Enterprise-wide disruption requiring coordinated crisis and continuity management.