[BCM] [E3] [Damanat] [BIA] Corporate MBCO

 Corporate and Business Unit Minimum Business Continuity Objective (MBCO)

The Saudi Mortgage Guarantees Services Company (Damanat)

 

 

Purpose of the Corporate Minimum Business Continuity Objective

A successful Business Continuity Management (BCM) programme begins by clearly defining what the organisation must continue to deliver during a disruption.

Before recovery strategies, Business Impact Analysis (BIA), recovery objectives, or Business Continuity Plans (BCPs) can be developed, senior management must determine the minimum level of products and services that the organisation considers acceptable during a disruptive event.

This minimum acceptable operating capability is referred to as the Corporate Minimum Business Continuity Objective (Corporate MBCO).

For the Saudi Mortgage Guarantees Services Company (Damanat), the Corporate MBCO establishes the minimum operational capability required to continue supporting Saudi Arabia's housing finance ecosystem during disruptions.

It provides executive management with a common understanding of which customer services, regulatory obligations, and operational activities must remain available until normal operations are fully restored.

Unlike a Recovery Time Objective (RTO), which specifies when an activity should resume, or the Maximum Tolerable Period of Disruption (MTPD), which defines how long an activity may remain unavailable before unacceptable impacts occur, the Corporate MBCO defines what minimum level of service must be maintained throughout the disruption.

It therefore becomes the strategic benchmark against which recovery priorities, resource allocation, continuity strategies, and recovery capabilities are measured.

The Corporate MBCO also supports compliance with the principles of ISO 22301, which emphasises the continuity of products and services that fulfil an organisation's obligations to customers, regulators, and other interested parties.

For a regulated financial services organisation such as Damanat, these obligations include maintaining public confidence, supporting participating financial institutions, protecting customer information, meeting regulatory reporting requirements, and ensuring that critical mortgage guarantee services remain available even during adverse events.

Once the Corporate MBCO has been established, each business function develops its own Business Unit Minimum Business Continuity Objective (Business Unit MBCO).

These business unit objectives collectively support the Corporate MBCO and provide measurable targets that guide Business Impact Analysis, recovery planning, resource prioritisation, and operational resilience activities.

 

Relationship Between Corporate MBCO and Business Unit MBCOs

The Corporate MBCO establishes the organisation-wide continuity objective, while individual Business Unit MBCOs translate that objective into measurable operational targets for each Critical Business Service (CBS).

The relationship can be summarised as follows:

• Corporate MBCO defines the minimum level of organisational capability required during a disruption.
• Business Unit MBCOs define the minimum operational capability required to sustain each Critical Business Function.
• Recovery Time Objectives (RTOs) determine how quickly each business activity must resume.
• The Maximum Tolerable Period of Disruption (MTPD) is the maximum period before unacceptable impacts occur.

Although related, these four concepts serve different purposes and should not be used interchangeably.

Proposed Corporate Minimum Business Continuity Objective

For planning purposes, the following Corporate MBCO is appropriate for Damanat.

Table P0:  Corporate MBCO

To maintain the minimum acceptable capability to continue delivering priority mortgage guarantee services, protect customers and participating financial institutions, fulfil statutory and regulatory obligations, safeguard critical information assets, maintain financial integrity, and preserve stakeholder confidence throughout a disruption until normal business operations can be fully restored.

This Corporate MBCO reflects Damanat's regulatory responsibilities, public service obligations, and role in supporting the Kingdom of Saudi Arabia's mortgage finance ecosystem.

Table P0: Business Unit MBCO

CBF Code	Critical Business Function	Business Unit Minimum Business Continuity Objective (MBCO)
CBF-1	Mortgage Guarantee Origination	Maintain the capability to receive, assess, approve, and process mortgage guarantee applications for priority cases while ensuring regulatory compliance, service quality, and timely decision-making.
CBF-2	Guarantee Risk Assessment	Continue performing credit, financial, operational, and property risk assessments necessary to support sound guarantee decisions and prudent risk management during disruptions.
CBF-3	Guarantee Issuance and Administration	Maintain the capability to issue, register, administer, amend, renew, and manage mortgage guarantees while ensuring the integrity and availability of guarantee records.
CBF-4	Claims Assessment and Settlement	Continue receiving, evaluating, approving, and settling eligible guarantee claims within acceptable service levels while maintaining financial controls and regulatory compliance.
CBF-5	Financial and Treasury Management	Maintain essential financial operations, including liquidity management, financial accounting, payments, budgeting, reconciliations, and treasury activities, to ensure financial stability throughout a disruption.
CBF-6	Enterprise Risk Management	Continue monitoring enterprise risks, emerging threats, key risk indicators, and risk reporting to support informed executive decision-making and organisational resilience.
CBF-7	Regulatory Compliance and Reporting	Maintain compliance monitoring and timely submission of mandatory regulatory reports, statutory returns, and supervisory information to the Saudi Central Bank (SAMA), Insurance Authority, and other relevant authorities.
CBF-8	Information Technology Services	Maintain the availability and recovery of critical business applications, ICT infrastructure, databases, networks, and user support services required to sustain priority business operations.
CBF-9	Information Security and Cyber Resilience	Continue protecting information assets through cybersecurity monitoring, incident response, identity and access management, vulnerability management, and cyber recovery capabilities during disruptions.
CBF-10	Customer and Financial Institution Relationship Management	Maintain essential communication, relationship management, customer support, and service coordination with participating financial institutions, customers, and strategic stakeholders throughout the disruption.
CBF-11	Legal and Corporate Governance	Continue providing legal advice, governance oversight, regulatory interpretation, contractual support, corporate secretariat services, and decision-making support to executive management.
CBF-12	Human Resource Management	Maintain essential workforce management activities including employee communications, payroll coordination, workforce availability, welfare support, and mobilisation of critical personnel.
CBF-13	Procurement and Vendor Management	Continue managing critical suppliers, contracts, procurement activities, outsourced services, and third-party performance to support uninterrupted delivery of priority business functions.
CBF-14	Corporate Communications and Stakeholder Management	Maintain timely, accurate, and coordinated communications with employees, regulators, participating financial institutions, government agencies, media, and other stakeholders during disruptive events.
CBF-15	Business Continuity and Crisis Management	Maintain the capability to coordinate incident response, activate Business Continuity Plans, manage crisis decision-making, oversee organisational recovery, and support the restoration of priority business functions.

 

Relationship to the Corporate MBCO

Collectively, these fifteen Business Unit MBCOs support Damanat's Corporate Minimum Business Continuity Objective by defining the minimum operational capability that each Critical Business Function must sustain during a disruption.

During the Business Impact Analysis (BIA), these objectives provide the benchmark for determining recovery priorities, resource requirements, Recovery Time Objectives (RTOs), recovery strategies, and continuity arrangements.

Together, they ensure that Damanat can continue delivering its essential mortgage guarantee services, meet regulatory obligations, safeguard financial stability, and maintain stakeholder confidence while progressively restoring normal operations.

 

Management Considerations When Establishing MBCOs

The Corporate MBCO and Business Unit MBCOs should be approved by executive management because they establish the minimum operational expectations during a disruption. These objectives should be reviewed periodically to ensure they remain aligned with:

• organisational strategy;
• regulatory expectations;
• changes in business services;
• customer needs;
• technology transformation;
• outsourcing arrangements;
• emerging operational risks; and
• organisational resilience objectives.

Each Business Unit MBCO should also be validated during the Business Impact Analysis process to confirm that it accurately reflects the minimum acceptable level of operational capability required to support the Corporate MBCO.

 

Benefits of Establishing Corporate and Business Unit MBCOs

Implementing clearly defined MBCOs provides significant benefits, including:

• establishing consistent recovery priorities across the organisation;
• aligning business continuity planning with organisational objectives;
• supporting Business Impact Analysis and recovery strategy development;
• improving resource prioritisation during disruptions;
• strengthening operational resilience;
• enhancing regulatory compliance;
• supporting executive decision-making during crises;
• improving coordination between business units;
• facilitating communication with regulators and stakeholders; and
• providing measurable targets for continuity exercises and continual improvement.

 

The Corporate Minimum Business Continuity Objective provides the strategic foundation for the entire Business Continuity Management programme.

It defines the minimum level of organisational capability that Damanat must sustain to continue fulfilling its obligations to customers, participating financial institutions, regulators, and other stakeholders during disruptive events. 

Rather than focusing solely on recovery times, the Corporate MBCO establishes the minimum products, services, and operational outcomes that the organisation is committed to maintaining under adverse conditions.

Business Unit MBCOs translate this strategic objective into measurable operational expectations for each Critical Business Service. 

Together, they provide a structured framework for conducting Business Impact Analysis, prioritising recovery resources, designing continuity strategies, and validating recovery capabilities through exercising and continual improvement. 

By clearly defining these continuity objectives before detailed planning begins, Damanat strengthens its ability to maintain essential services, support financial sector stability, comply with regulatory expectations, and enhance its overall organisational resilience in accordance with recognised Business Continuity Management good practices.