[BCM] [JS] [E3] [RAR] [P2] Treatment and Control

Treatment and Control

RAR Part 2: Treatment and Control for Jamiyah Singapore

Introduction

Risk Analysis and Review (RAR) Part 2 examines how an organisation manages the threats identified in its Threat Register.

While Part 1 identifies potential sources of disruption, Part 2 considers the treatment approaches and controls that may prevent disruption, reduce its consequences, share certain exposures with external parties or formally retain residual risk.

For Jamiyah Singapore (JS), this assessment is particularly important because disruptions may affect residential care, essential healthcare support, early childhood services, student care, welfare assistance, food distribution, beneficiary case management and the supporting capabilities required to sustain these services.

The objective is to establish whether appropriate treatment and control arrangements exist for each identified threat and to recommend practical improvements where existing arrangements may be insufficient.

Relationship Between Threats, Treatments and Controls

A threat is a potential source of disruption, such as a fire, pandemic, supplier failure or ransomware attack.

A risk treatment is the overall approach selected to manage the associated exposure.

A control is a specific measure that implements the treatment approach.

For example, an organisation may address a ransomware threat through risk reduction. Supporting controls could include endpoint protection, restricted administrative privileges, protected backups, incident response procedures and recovery testing.

The existence of these controls does not automatically establish that the risk is adequately managed.

JS must also assess their coverage, reliability, ownership, effectiveness, and suitability for JS's critical services.

The Four Risk Treatment Approaches

Treatment Approach	Application to Jamiyah Singapore
Risk Avoidance	Discontinue or redesign an activity that creates unacceptable exposure, such as ceasing occupancy of an unsafe facility or retiring unsupported software.
Risk Reduction	Reduce the occurrence or consequences of disruption through safeguards, redundancy, training, monitoring, recovery arrangements and testing.
Risk Transference	Share defined financial, contractual or service-delivery consequences through insurance, service agreements or third-party arrangements. Accountability for essential services remains with JS.
Risk Acceptance	Formally retain residual exposure within approved risk appetite, supported by documented rationale, authorisation, monitoring and periodic review.

A single threat may require more than one treatment approach. For example, a building fire may involve risk reduction through fire safety measures and partial financial transference through insurance.

Risk acceptance does not replace unresolved safety requirements or unaddressed material control deficiencies.

Assessment Basis and Evidence Limitations

The assessment uses the 100 specific threats identified in the preceding Jamiyah Singapore RAR Part 1 Threat Register, across the five prescribed categories.

The externally supplied JS threat-register link is treated as supplementary context rather than as a replacement for the Jamiyah Singapore register established in this conversation.

Important distinction: No JS-specific evidence confirming actual implemented controls has been supplied.

Accordingly, every existing control described below is assumed and requires validation, not a verified implementation. The assessment does not represent a completed audit or assurance opinion.

For compactness, the following conventions apply throughout the tables:

AV — Assumed existing control; documentary and operational validation required.
NE — Not evidenced.
NA — Not applicable.
RV — Risk reduction arrangement requiring validation.
Acceptance: NE — No formally approved acceptance evidenced. The CBF owner and BCM Coordinator must refer any proposed acceptance to the authorised management or governance body for documented approval, periodic monitoring and reconsideration following material change.

The planned controls are recommendations, not confirmed JS implementation commitments.

Proposed owners and timeframes are planning assumptions.

Part 1: Treatment and Control Assessment

The seven required columns are retained in each category table. Each row represents a distinct threat from RAR Part 1.

Category 1 — Denial of Access: Natural Disaster

Table RAR P2-C1: Treatment and Control for Jamiyah Singapore

Threat	Existing Risk Treatment – Risk Avoidance	Existing Risk Treatment – Risk Reduction	Existing Risk Treatment – Risk Transference	Existing Risk Treatment – Risk Acceptance	Existing Controls	Additional Planned Controls
Flood	NE — Flood-zone avoidance in site selection unverified.	RV — Drainage maintenance and facility emergency arrangements.	NE — Property insurance coverage unverified.	NE	AV: Drain inspection, water ingress reporting and evacuation procedures.	Facilities, High, 6 months: map site flood exposure; verify alternative entrances and relocate critical equipment above identified flood levels. Evidence: inspection and access exercise.
Flash Flood	NA — External flash flooding cannot be eliminated.	RV — Weather monitoring and alternative travel arrangements.	NE	NE	AV: Weather advisories, incident notification and access restrictions.	Facilities, High, 3 months: document flood-triggered access decisions and test staff and supplier rerouting.
Severe Thunderstorm	NA — Weather event unavoidable.	RV — Building maintenance, weather advisories and indoor activity arrangements.	NE — Storm damage coverage unverified.	NE	AV: Roof inspections, outdoor activity restrictions and incident reporting.	Facilities, Medium, 6 months: assess wind-exposed structures and test continuity during severe weather.
Lightning Strike	NA — Natural hazard unavoidable.	RV — Lightning protection and electrical safeguards.	NE — Equipment damage coverage unverified.	NE	AV: Building lightning protection inspection and surge protection, where installed.	Facilities, Medium, 6 months: verify protection certification and assess surge protection for essential equipment.
Earthquake and Regional Tremors	NA — Regional seismic activity unavoidable.	RV — Evacuation and structural safety assessment arrangements.	NE — Property insurance terms unverified.	NE	AV: Emergency evacuation procedures and building inspection escalation.	Facilities, Medium, 9 months: establish post-tremor occupancy criteria and exercise decision-making.
Tsunami or Coastal Inundation	NE — Avoidance of exposed sites unverified.	RV — Emergency alerts and alternative access planning.	NE	NE	AV: General emergency notification and evacuation arrangements.	Facilities, Medium, 12 months: screen relevant facilities and transport dependencies for coastal exposure; document site-specific response where applicable.
Landslide or Slope Failure	NE — Slope-adjacent site avoidance unverified.	RV — Property inspection and unsafe-area isolation.	NE	NE	AV: Facilities defect reporting and emergency cordoning.	Facilities, Medium, 9 months: inspect slope or retaining-wall exposure at applicable sites and establish access alternatives.
Vegetation or Wildfire	NA — External vegetation fires cannot be fully avoided.	RV — Fire safety and smoke exposure procedures.	NE — Fire insurance unverified.	NE	AV: Fire detection, evacuation procedures and external fire reporting.	Facilities, Medium, 6 months: review nearby vegetation exposure and smoke-related facility operating criteria.
Extreme Heat	NA — Ambient heat cannot be eliminated.	RV — Cooling, hydration and temperature monitoring.	NE	NE	AV: Air-conditioning maintenance and resident welfare observation.	Facilities / Care Management, High, 3 months: establish temperature thresholds, vulnerable-resident checks and cooling-failure procedures.
Transboundary Haze	NA — Regional haze cannot be prevented by JS.	RV — Air-quality monitoring and indoor activity arrangements.	NE	NE	AV: Public air-quality advisory monitoring and facility ventilation arrangements.	Facilities / Service Owners, Medium, 3 months: document service adjustments by air-quality conditions and verify filtration capability.
Pandemic-Related Movement Restrictions	NA — Public restrictions cannot be avoided.	RV — Remote administration and continuity of essential on-site care.	NE — Reciprocal support agreements unverified.	NE	AV: Public health communications and service access procedures.	BCM / Service Owners, High, 6 months: validate essential staff access arrangements and exercise restricted-movement scenarios.
Prolonged Severe Weather	NA — Weather conditions unavoidable.	RV — Supplies, alternate transport and service prioritisation.	NE	NE	AV: Weather monitoring and emergency supplier contact lists.	BCM / Logistics, High, 6 months: test 72-hour essential supply continuity and staff transport alternatives.
Sinkhole or Ground Subsidence	NE — Ground-condition screening unverified.	RV — Facility inspections and access restrictions.	NE	NE	AV: Building defect reporting and emergency evacuation procedures.	Facilities, Medium, 9 months: establish ground movement escalation and alternative access routes.
Regional Volcanic Ash	NA — Regional eruption unavoidable.	RV — Alternative sourcing and logistics flexibility.	NE	NE	AV: Supplier communication and emergency procurement arrangements.	Procurement, Low, 12 months: identify time-critical imported supplies and alternative delivery routes.
Coastal Storm Surge and Sea-Level Extremes	NE — Coastal exposure avoidance unverified.	RV — Site monitoring and alternate facility planning.	NE	NE	AV: General flood and facility emergency procedures.	Facilities, Medium, 12 months: assess relevant premises and transport dependencies against coastal inundation scenarios.

Category 1 implementation focus: JS should prioritise site-specific exposure verification, resident safety requirements, access arrangements and the availability of suitable alternative premises. Assess natural hazard controls by location rather than assuming they apply equally across all facilities.

Category 2 — Denial of Access: Man-made Disaster

Table RAR P2-C2: Treatment and Control for Jamiyah Singapore

Threat	Existing Risk Treatment – Risk Avoidance	Existing Risk Treatment – Risk Reduction	Existing Risk Treatment – Risk Transference	Existing Risk Treatment – Risk Acceptance	Existing Controls	Additional Planned Controls
Building Fire	Partially Applicable — Unsafe occupancy may be discontinued; current arrangements NE.	RV — Fire detection, evacuation and fire safety maintenance.	NE — Property and business interruption coverage unverified.	NE	AV: Fire alarms, extinguishers, evacuation plans and drills.	Facilities / Safety, High, 3 months: verify fire safety records and conduct resident evacuation and accountability exercise.
Explosion	NE — Restriction of hazardous activities unverified.	RV — Equipment maintenance, gas safety and emergency response.	NE	NE	AV: Equipment inspections and emergency evacuation arrangements.	Facilities, High, 6 months: identify explosion-related exposures and establish isolation and recovery procedures.
Chemical Spill	Partially Applicable — Hazardous materials may be excluded from unsuitable areas; NE.	RV — Chemical storage controls and emergency notification.	NE — Specialist response arrangements unverified.	NE	AV: Chemical inventories, safety information and incident reporting.	Facilities / Safety, High, 6 months: assess on-site and neighbouring chemical exposure; exercise shelter or evacuation decisions.
Gas Leak	Partially Applicable — Discontinue unsafe gas use; NE.	RV — Gas system inspection and leak reporting.	NE	NE	AV: Gas maintenance records and emergency contact arrangements.	Facilities, High, 3 months: verify isolation points, competent contractors and emergency escalation.
Structural Failure	Partially Applicable — Close unsafe areas; NE.	RV — Building inspections and defect management.	NE — Property insurance unverified.	NE	AV: Defect reporting and building maintenance procedures.	Facilities, High, 6 months: establish structural defect escalation and independent inspection criteria.
Building Collapse	Partially Applicable — Unsafe facilities may be vacated; NE.	RV — Structural inspections and evacuation arrangements.	NE	NE	AV: Facility condition monitoring and emergency evacuation procedures.	Facilities / BCM, High, 6 months: validate full-site loss recovery and alternative accommodation capacity.
Civil Disturbance	NA — External disturbance cannot be eliminated.	RV — Security monitoring and alternative access arrangements.	NE	NE	AV: Incident notification and facility access control.	Security / BCM, Medium, 6 months: define lockdown, access suspension and beneficiary communication procedures.
Riot	NA — Public disorder beyond organisational control.	RV — Security escalation and alternate operations.	NE	NE	AV: Emergency contact lists and facility closure procedures.	Security, Medium, 9 months: exercise prolonged area denial and recovery-site activation.
Terrorist Attack	NA — External attack cannot be fully avoided.	RV — Security awareness, emergency response and evacuation.	NE — Relevant insurance coverage unverified.	NE	AV: Access controls and emergency response procedures.	Security / CMT, High, 6 months: conduct scenario-based crisis exercise covering resident protection and family communications.
Bomb Threat or Suspicious Object	NA — Threat occurrence cannot be eliminated.	RV — Security reporting and evacuation procedures.	NE	NE	AV: Suspicious-object reporting and emergency contact arrangements.	Security, High, 3 months: document police notification, exclusion and re-entry decision procedures.
Sabotage or Deliberate Property Damage	NA — Deliberate acts cannot be fully eliminated.	RV — Access control, monitoring and asset protection.	NE — Property damage coverage unverified.	NE	AV: Visitor management, security patrols and incident logs.	Security / Facilities, Medium, 6 months: review critical access points and conduct targeted physical security assessment.
Active Assailant	NA — External hostile acts cannot be fully avoided.	RV — Emergency security procedures and personnel awareness.	NE	NE	AV: Emergency reporting and access control.	Security / Service Owners, High, 3 months: establish facility-specific protective action and emergency service coordination procedures.
Public Disorder Near Facilities	NA — External behaviour cannot be eliminated.	RV — Security monitoring and access restrictions.	NE	NE	AV: Visitor controls and incident reporting.	Security, Medium, 6 months: establish decision criteria for temporary closure and alternative beneficiary access.
Utility Infrastructure Incident	NA — External infrastructure incidents cannot be avoided.	RV — Backup utilities and alternative site arrangements.	NE — Utility provider commitments unverified.	NE	AV: Utility fault reporting and emergency contact lists.	Facilities, High, 6 months: map critical utility dependencies and test loss-of-utility response.
Road Closure	NA — Public road restrictions outside JS control.	RV — Alternate routes and staff communications.	NE — Alternative transport agreements unverified.	NE	AV: Transport coordination and contact lists.	Logistics / BCM, Medium, 3 months: document alternative routes for resident transfer and food distribution.
Public Transport Disruption	NA — Network disruptions outside JS control.	RV — Flexible reporting and contingency staffing.	NE	NE	AV: Notify staff and adjust duty rosters.	HR / Service Owners, High, 3 months: identify staff concentration by commuting dependency and test emergency staffing.
Major Traffic Incident	NA — External road incidents unavoidable.	RV — Alternative transport and route coordination.	NE	NE	AV: Driver contact procedures and service scheduling.	Logistics, Medium, 6 months: validate alternative transport availability for urgent care and distribution.
Aircraft Accident	NA — Aviation incident outside JS control.	RV — Alternate sourcing and travel arrangements.	NE	NE	AV: Supplier communication and travel notification.	Procurement / BCM, Low, 12 months: identify essential services dependent on air freight or specialist travel.
Nearby Industrial Accident	NA — External industrial incident cannot be eliminated.	RV — Hazard alerts, evacuation and alternative access.	NE	NE	AV: Emergency notification and building evacuation arrangements.	Facilities / Security, Medium, 6 months: assess neighbouring hazardous activities and exercise external exclusion-zone scenario.
Construction Accident or Excavation Damage	Partially Applicable — Avoid unsafe contractor activities under JS control; NE.	RV — Contractor supervision and utility reporting.	NE — Contractor indemnities unverified.	NE	AV: Contractor access approvals and incident reporting.	Facilities / Procurement, Medium, 6 months: require pre-work utility checks and review contractor emergency obligations.
Security Lockdown or Police Cordoning	NA — Authority-imposed restrictions cannot be avoided.	RV — Alternate communications and operating locations.	NE	NE	AV: Emergency contact lists and facility access procedures.	BCM / Security, High, 6 months: test denial-of-access scenario without access to on-site records or equipment.

Category 2 implementation focus: Prioritise life safety, resident and child accountability, authorised evacuation or lockdown decisions, and continuity when an entire facility becomes inaccessible.

Category 3 — Unavailability of People

Table RAR P2-C3: Treatment and Control for Jamiyah Singapore

Threat	Existing Risk Treatment – Risk Avoidance	Existing Risk Treatment – Risk Reduction	Existing Risk Treatment – Risk Transference	Existing Risk Treatment – Risk Acceptance	Existing Controls	Additional Planned Controls
Pandemic	NA — Community transmission cannot be fully avoided.	RV — Infection prevention, workforce segregation and contingency staffing.	NE — External staffing support unverified.	NE	AV: Infection-control instructions, staff health reporting and emergency rosters.	HR / Service Owners, High, 3 months: validate minimum safe staffing for simultaneous illness and increased care demand; exercise a multi-site outbreak.
Epidemic	NA — External disease spread cannot be eliminated.	RV — Health surveillance, staff absence monitoring and service prioritisation.	NE	NE	AV: Health advisories, illness reporting and service continuity arrangements.	HR / BCM, High, 6 months: define absenteeism escalation triggers and test continuity at reduced staffing.
Infectious Disease Outbreak Within a Facility	Partially Applicable — Suspend non-essential exposure-generating activities; NE.	RV — Infection-control procedures and separation of affected activities.	NE — Specialist cleaning support unverified.	NE	AV: Hygiene procedures, illness reporting and care escalation.	Residential Care / Relevant Service Owners, High, 3 months: test cohorting feasibility, staffing continuity and essential resident care during an outbreak.
Mass Illness or Foodborne Illness	Partially Applicable — Discontinue unsafe food sources or activities; NE.	RV — Food safety controls, illness reporting and contingency staffing.	NE — Catering liability arrangements unverified.	NE	AV: Food handling procedures and staff illness notification.	Facilities / HR, High, 6 months: verify food supplier traceability and exercise simultaneous staff absence.
Labour Strike	NA — Collective action cannot be fully eliminated by routine controls.	RV — Workforce relations and essential service staffing arrangements.	NE — Alternative staffing contracts unverified.	NE	AV: HR grievance procedures and operational escalation.	HR, Medium, 9 months: identify essential duties and lawful alternative staffing arrangements.
Industrial Action or Work Stoppage	NA — Disruption cannot be fully avoided.	RV — Employee engagement and service continuity planning.	NE — Contractor substitution arrangements unverified.	NE	AV: HR consultation and incident escalation processes.	HR / Procurement, Medium, 9 months: document continuity arrangements for affected internal and outsourced functions.
High Staff Turnover	NA — Workforce departures cannot be eliminated.	RV — Recruitment, induction and knowledge transfer.	NE — Recruitment agency support unverified.	NE	AV: Recruitment procedures, handover records and competency tracking.	HR / Service Owners, High, 6 months: identify turnover-sensitive roles and establish documented replacement competencies.
Loss of Key Personnel	Partially Applicable — Eliminate unnecessary sole-person dependencies; NE.	RV — Succession planning and delegated authority.	NE — Specialist support contracts unverified.	NE	AV: Organisation charts, job descriptions and leave handovers.	HR / Senior Management, High, 3 months: appoint alternates for all critical roles and exercise delegated decisions.
Specialist Skills Shortage	Partially Applicable — Redesign work dependent on unnecessary specialist skills; NE.	RV — Competency planning, cross-training and recruitment.	NE — Specialist service contracts unverified.	NE	AV: Training records and qualification checks.	HR / Care Leads, High, 6 months: develop a critical skills matrix and verify safe staffing under shortage scenarios.
Workplace Accident	Partially Applicable — Discontinue unsafe work practices; NE.	RV — Workplace safety controls and incident reporting.	NE — Relevant insurance arrangements unverified.	NE	AV: Safety procedures, induction and accident reporting.	Safety / HR, High, 6 months: review task-specific hazards and test replacement of injured essential personnel.
Workplace Violence	Partially Applicable — Restrict activities presenting unacceptable immediate danger; NE.	RV — Security arrangements, staff training and incident escalation.	NE	NE	AV: Workplace conduct procedures, visitor controls and incident reporting.	Security / HR, High, 6 months: implement role-specific violence response training and verify escalation procedures.
Staff Fatigue	Partially Applicable — Prohibit unsafe excessive-duty arrangements; NE.	RV — Duty rostering, breaks and workload monitoring.	NE — Relief staffing arrangements unverified.	NE	AV: Shift schedules and supervisor oversight.	HR / Residential Care, High, 3 months: establish maximum-duty escalation triggers and validate extended recovery rosters.
Psychological Stress and Burnout	NA — Workplace stress cannot be entirely eliminated.	RV — Workload supervision and employee support.	NE — External counselling arrangements unverified.	NE	AV: Staff welfare channels and supervisory check-ins.	HR, Medium, 6 months: establish post-incident welfare reviews and referral arrangements for affected personnel.
Travel Restrictions	NA — Government or cross-border restrictions cannot be avoided.	RV — Local staffing, remote work and alternative transport.	NE	NE	AV: Staff location records and emergency communications.	HR / BCM, High, 6 months: map cross-border workforce dependencies and test restricted-travel staffing.
Mandatory Quarantine or Isolation	NA — Applicable public health requirements cannot be avoided.	RV — Alternate staffing and remote administration.	NE	NE	AV: Absence reporting and contingency rosters.	HR / Service Owners, High, 3 months: test simultaneous isolation of a complete duty team.
Family or Caregiving Emergencies	NA — Personal emergencies cannot be eliminated.	RV — Flexible staffing and contingency rosters.	NE	NE	AV: Emergency leave and supervisor notification procedures.	HR, Medium, 6 months: establish an emergency relief pool for essential service roles.
Mass Resignation	Partially Applicable — Reduce sole-team dependency through workforce redesign; NE.	RV — Retention, succession and knowledge management.	NE — Recruitment support contracts unverified.	NE	AV: Exit handovers and workforce reporting.	HR / Senior Management, High, 6 months: identify roles with concentrated knowledge and establish replacement plans.
Volunteer Unavailability	Partially Applicable — Avoid assigning safety-critical duties exclusively to volunteers; NE.	RV — Volunteer coordination and alternative staffing.	NE — Partner support arrangements unverified.	NE	AV: Volunteer rosters and programme coordinator contact lists.	Volunteer Management, Medium, 6 months: establish minimum volunteer-independent delivery arrangements for essential assistance.
Concurrent Leave or Scheduling Failure	Partially Applicable — Prohibit unapproved simultaneous absence of critical roles; NE.	RV — Roster review and leave coordination.	NE	NE	AV: Approve leave and check duty rosters.	HR / Service Owners, High, 3 months: introduce competency-based roster coverage checks and monthly exception reporting.
Loss of Leadership or Decision-Making Capacity	Partially Applicable — Remove unnecessary single-person approval dependencies; NE.	RV — Delegation, succession and crisis governance.	NA — Governance accountability cannot be transferred.	NE	AV: Delegation schedules and management contact lists.	Senior Management / BCM, High, 3 months: establish emergency decision succession and exercise unavailable-leadership scenarios.
Contractor Workforce Shortage	Partially Applicable — Avoid sole-contractor dependence for essential services; NE.	RV — Contractor monitoring and alternate supplier arrangements.	NE — Contractual staffing commitments unverified.	NE	AV: Supplier service schedules and escalation contacts.	Procurement / Facilities, Medium, 6 months: verify contractor minimum staffing commitments and identify substitutes.

Category 3 implementation focus: JS should distinguish general workforce availability from the availability of personnel qualified and authorised to perform specific duties.

For residential care, nursing-related support, safeguarding and childcare, an available person is not automatically a suitable replacement.

Category 4 — Disruption to the Supply Chain

Table RAR P2-C4: Treatment and Control for Jamiyah Singapore

Threat	Existing Risk Treatment – Risk Avoidance	Existing Risk Treatment – Risk Reduction	Existing Risk Treatment – Risk Transference	Existing Risk Treatment – Risk Acceptance	Existing Controls	Additional Planned Controls
Supplier Operational Failure	Partially Applicable — Avoid unsuitable suppliers or exclusive reliance; NE.	RV — Supplier monitoring and alternative sourcing.	NE — Contractual service commitments unverified.	NE	AV: Purchase records, supplier contacts and delivery monitoring.	Procurement, High, 6 months: classify critical suppliers and verify alternatives for essential goods and services.
Outsourcing Service Failure	Partially Applicable — Retain critical functions internally where outsourcing creates unacceptable exposure; NE.	RV — Service oversight and contingency arrangements.	NE — SLA and indemnity provisions unverified.	NE	AV: Contractor performance reviews and escalation procedures.	Procurement / Service Owners, High, 6 months: test loss of cleaning, security, catering or other critical outsourced services.
Cloud Service Provider Failure	Partially Applicable — Avoid unsuitable or unsupported hosting dependencies; NE.	RV — Provider resilience, backups and manual workarounds.	NE — Cloud availability commitments unverified.	NE	AV: Vendor support agreements and system backup arrangements.	ICT, High, 6 months: test recovery from complete provider unavailability and verify data export capability.
Telecommunications Provider Failure	Partially Applicable — Avoid unnecessary single-provider dependence; NE.	RV — Alternative communications and network resilience.	NE — Telecom service commitments unverified.	NE	AV: Provider fault reporting and emergency contact procedures.	ICT / Communications, High, 3 months: validate independent backup communication channels.
Electricity Supply Failure	NA — External power failures cannot be eliminated.	RV — Backup power and safe facility shutdown arrangements.	NE — Utility commitments unverified.	NE	AV: Electrical maintenance and power outage procedures.	Facilities, High, 6 months: test backup power against essential residential and ICT loads.
Water Supply Interruption	NA — External supply interruption cannot be fully avoided.	RV — Emergency water arrangements and alternative premises.	NE	NE	AV: Report utility faults and keep emergency supplier contacts.	Facilities / Residential Care, High, 3 months: validate potable water, hygiene and sanitation requirements for extended disruption.
Fuel Supply Disruption	Partially Applicable — Avoid unnecessary fuel-dependent operations; NE.	RV — Alternative transport and supply planning.	NE — Fuel supplier commitments unverified.	NE	AV: Transport provider contact lists and procurement procedures.	Logistics, Medium, 9 months: identify fuel-dependent critical services and confirm alternative transport capacity.
Logistics and Freight Disruption	Partially Applicable — Reduce dependence on single import routes; NE.	RV — Alternative suppliers and stock management.	NE — Logistics service agreements unverified.	NE	AV: Supplier delivery tracking and procurement escalation.	Procurement, Medium, 6 months: map essential imported items and validate local substitutes.
Transportation Provider Failure	Partially Applicable — Avoid sole-provider dependence for essential transport; NE.	RV — Alternative vehicle and driver arrangements.	NE — Transport service commitments unverified.	NE	AV: Transport booking and emergency contacts.	Logistics / Care Management, High, 3 months: test emergency resident transfer capacity and accessible vehicle availability.
Banking Service Disruption	Partially Applicable — Avoid unnecessary concentration of critical payment channels; NE.	RV — Alternative payment scheduling and manual authorisation.	NE — Banking service commitments unverified.	NE	AV: Bank contact arrangements and payment approval records.	Finance, High, 6 months: test urgent beneficiary and supplier payments during bank service unavailability.
Payment System Failure	Partially Applicable — Avoid reliance on a single payment channel where feasible; NE.	RV — Alternative payment methods and transaction records.	NE — Payment provider SLA unverified.	NE	AV: Finance reconciliation and transaction escalation.	Finance / ICT, High, 6 months: establish approved emergency disbursement procedures and reconciliation tests.
Regulatory or Administrative Restrictions	NA — External legal requirements cannot be avoided.	RV — Regulatory monitoring and service adaptation.	NA — Compliance accountability cannot be transferred.	NE	AV: Governance review and relevant authority communications.	Governance / Service Owners, Medium, 6 months: map applicable service obligations and document continuity decisions under restrictions.
Import Restrictions	Partially Applicable — Avoid exclusive dependence on restricted imports; NE.	RV — Alternative sourcing and inventory monitoring.	NE	NE	AV: Procurement tracking and supplier communications.	Procurement, Medium, 9 months: identify import-sensitive essential items and verify approved substitutes.
Vendor Insolvency	Partially Applicable — Avoid financially unsuitable suppliers; NE.	RV — Supplier due diligence and alternate sourcing.	NE — Contractual recovery rights unverified.	NE	AV: Supplier registration and payment monitoring.	Procurement / Finance, Medium, 6 months: assess critical supplier financial dependency and replacement lead times.
Third-Party Cyber Incident	Partially Applicable — Avoid providers unable to meet minimum security requirements; NE.	RV — Vendor security review and service continuity arrangements.	NE — Cyber indemnities or insurance unverified.	NE	AV: Vendor contracts and ICT incident escalation.	ICT / Procurement, High, 6 months: require incident notification obligations and conduct a joint supplier outage exercise.
Contract Termination or Dispute	Partially Applicable — Avoid contracts with unacceptable termination dependencies; NE.	RV — Contract monitoring and alternative suppliers.	NE — Exit and transition clauses unverified.	NE	AV: Contract records and renewal tracking.	Procurement / Legal, Medium, 6 months: review continuity, termination assistance and data-return clauses for critical suppliers.
Single-Source Supplier Dependency	Partially Applicable — Diversify sourcing where feasible; NE.	RV — Emergency stocks and supplier alternatives.	NE — Reciprocal supply commitments unverified.	NE	AV: Supplier registers and procurement approvals.	Procurement, High, 6 months: identify single-source essential items and qualify at least one substitute where practicable.
Supplier's Subcontractor Failure	Partially Applicable — Avoid unacceptable opaque dependencies; NE.	RV — Supplier oversight and contingency requirements.	NE — Subcontractor performance obligations unverified.	NE	AV: Primary supplier contact and escalation arrangements.	Procurement, Medium, 9 months: request critical subcontractor dependency information and verify supplier recovery capability.
Food Supply Contamination or Recall	Partially Applicable — Withdraw unsafe food products or suppliers; NE.	RV — Food safety checks, traceability and substitute supply.	NE — Supplier liability provisions unverified.	NE	AV: Food receiving inspections and supplier records.	Catering / Procurement, High, 3 months: exercise recall, stock isolation and emergency meal replacement.
Healthcare Product Shortage	Partially Applicable — Avoid unnecessary reliance on non-substitutable products; NE.	RV — Monitor inventory and use authorised alternatives.	NE	NE	AV: Stock records and healthcare supplier contacts.	Care / Healthcare Lead, High, 6 months: identify time-critical products and validate clinically authorised alternatives.
Geopolitical Trade Disruption	NA — International geopolitical events cannot be avoided.	RV — Supplier diversification and inventory planning.	NE — Contractual alternatives unverified.	NE	AV: Procurement monitoring and supplier communications.	Procurement / Finance, Medium, 9 months: map imported critical goods and test extended supply interruption.
Port or Airport Disruption	NA — External transport infrastructure disruption unavoidable.	RV — Local stock and alternative delivery arrangements.	NE — Freight service commitments unverified.	NE	AV: Shipment tracking and supplier escalation.	Procurement, Medium, 9 months: establish local inventory requirements for time-critical imported supplies.
Supplier Concentration Across Multiple Services	Partially Applicable — Remove avoidable common-provider dependencies; NE.	RV — Vendor concentration monitoring and contingency sourcing.	NE — Cross-service continuity commitments unverified.	NE	AV: Contract and supplier registers.	Procurement / BCM, High, 6 months: map common suppliers across all ten CBFs and test simultaneous service failure.
Donor or Funding Channel Interruption	Partially Applicable — Avoid unnecessary reliance on a single collection channel; NE.	RV — Cash-flow planning and alternative funding administration.	NE — Funding commitments unverified.	NE	AV: Finance forecasts, donation records and grant tracking.	Finance / Fundraising, High, 6 months: model interrupted funding receipts and validate essential expenditure coverage.

Category 4 implementation focus: The primary concern is not only whether a supplier can continue operating, but whether JS can continue delivering its own critical services when the supplier cannot. Contractual commitments and outsourcing arrangements must therefore be supported by operationally viable alternatives.

Category 5 — Equipment and IT-Related Disruption

Table RAR P2-C5: Treatment and Control for Jamiyah Singapore

Threat	Existing Risk Treatment – Risk Avoidance	Existing Risk Treatment – Risk Reduction	Existing Risk Treatment – Risk Transference	Existing Risk Treatment – Risk Acceptance	Existing Controls	Additional Planned Controls
Cyberattack	Partially Applicable — Discontinue unsafe exposed services; NE.	RV — Access security, monitoring and incident response.	NE — Cyber insurance or managed security agreements unverified.	NE	AV: Firewalls, endpoint protection and security incident procedures.	ICT / Security, High, 3 months: conduct critical-system security review and test cyber incident escalation.
Ransomware	Partially Applicable — Retire unsupported systems and unsafe access methods; NE.	RV — Endpoint protection, backups and access restrictions.	NE — Cyber insurance unverified.	NE	AV: Antivirus, backup schedules and privileged account controls.	ICT, High, 3 months: verify immutable or offline backup protection and perform isolated restoration exercise.
Malware Infection	Partially Applicable — Prohibit unapproved software and unsafe devices; NE.	RV — Endpoint protection and patching.	NE	NE	AV: Device security tools and software update procedures.	ICT, High, 3 months: measure endpoint coverage and test malware containment procedures.
Distributed Denial of Service (DDoS)	NA — Internet-facing attack traffic cannot be fully eliminated.	RV — Hosting resilience and traffic protection.	NE — Provider DDoS commitments unverified.	NE	AV: Hosting support and website availability monitoring.	ICT / Web Provider, Medium, 6 months: confirm DDoS protection and test essential communication alternatives.
Insider Threat	Partially Applicable — Eliminate unnecessary privileged access; NE.	RV — Access control, segregation of duties and monitoring.	NE	NE	AV: User provisioning, access approvals and account termination.	ICT / HR, High, 6 months: review privileged access and establish periodic access recertification.
Personal Data Breach	Partially Applicable — Eliminate unnecessary collection and retention; NE.	RV — Data protection, access restrictions and incident response.	NE — Cyber liability arrangements unverified.	NE	AV: Data protection policies, access controls and breach escalation.	Data Protection Officer / ICT, High, 3 months: test personal data breach response, record handling and applicable notification decision-making.
Network Failure	Partially Applicable — Remove avoidable single-network dependencies; NE.	RV — Network maintenance and fault monitoring.	NE — Vendor support commitments unverified.	NE	AV: Network equipment support and fault reporting.	ICT, High, 6 months: map critical network components and test alternative connectivity.
Server Failure	Partially Applicable — Retire obsolete unsupported servers; NE.	RV — Hardware monitoring, backups and virtualisation.	NE — Hardware warranties unverified.	NE	AV: Server maintenance and backup records.	ICT, High, 6 months: verify recovery times for systems supporting resident and beneficiary information.
Database Corruption	Partially Applicable — Eliminate unsupported data handling processes; NE.	RV — Database backups and integrity checks.	NE — Database support contracts unverified.	NE	AV: Scheduled backups and application error monitoring.	ICT / Data Owners, High, 3 months: test point-in-time restoration and business data reconciliation.
Cloud Service Outage	Partially Applicable — Avoid unnecessary sole-platform dependency; NE.	RV — Cloud backups and downtime procedures.	NE — Provider availability commitments unverified.	NE	AV: Cloud support arrangements and user incident reporting.	ICT / BCM, High, 6 months: test prolonged SaaS outage with manual service continuation.
Power Failure Affecting ICT	NA — External power interruptions unavoidable.	RV — UPS and safe shutdown arrangements.	NE	NE	AV: UPS maintenance and electrical fault reporting.	ICT / Facilities, High, 6 months: verify backup runtime for essential network and communication equipment.
Hardware Failure	Partially Applicable — Remove end-of-life devices; NE.	RV — Maintenance and spare equipment.	NE — Warranties and replacement commitments unverified.	NE	AV: Asset register and hardware support.	ICT, Medium, 6 months: maintain critical-device replacement inventory and test device restoration.
Software Failure	Partially Applicable — Retire unsupported applications; NE.	RV — Change testing, vendor support and rollback.	NE — Software support commitments unverified.	NE	AV: Application support tickets and change approval procedures.	ICT / Application Owners, High, 6 months: test rollback and manual workarounds for essential applications.
Telecommunications System Failure	Partially Applicable — Remove single-system dependencies where practicable; NE.	RV — Alternative telephone channels and provider support.	NE — Service commitments unverified.	NE	AV: Telephony fault reporting and mobile contact lists.	ICT / Communications, High, 3 months: test emergency contact procedures without the primary phone system.
Internet Connectivity Failure	Partially Applicable — Avoid unnecessary single-link dependence; NE.	RV — Alternative connectivity and offline processes.	NE — ISP SLA unverified.	NE	AV: Internet fault reporting and provider contacts.	ICT, High, 6 months: validate independent secondary connectivity for critical facilities.
Mobile Communications Outage	NA — Public mobile network disruption cannot be eliminated.	RV — Alternative voice and data channels.	NE	NE	AV: Fixed-line contacts and staff communication procedures.	Communications / ICT, High, 3 months: test staff mobilisation without mobile messaging.
Backup Failure	Partially Applicable — Discontinue unreliable backup technologies; NE.	RV — Backup monitoring and restoration testing.	NE — Managed backup commitments unverified.	NE	AV: Backup schedules and failure alerts.	ICT, High, 3 months: conduct full restoration tests and document achieved RTO/RPO results.
Data Centre Failure	Partially Applicable — Avoid unacceptable single-site hosting; NE.	RV — Off-site backups and infrastructure recovery.	NE — Hosting recovery commitments unverified.	NE	AV: Data centre support and backup arrangements.	ICT, High, 6 months: test complete hosting-site loss and verify alternative recovery capability.
Authentication System Failure	Partially Applicable — Remove unnecessary single-authentication dependencies; NE.	RV — Identity service recovery and emergency access.	NE — Identity provider commitments unverified.	NE	AV: Identity administration and support escalation.	ICT / Security, High, 3 months: test authorised emergency access during identity service outage.
Identity and Access Management Failure	Partially Applicable — Eliminate unsupported identity components; NE.	RV — Access monitoring and account recovery.	NE	NE	AV: Account provisioning and access approval procedures.	ICT / Security, High, 6 months: test restoration of role-based access and privileged account recovery.
Artificial Intelligence System Failure	Partially Applicable — Suspend AI use for unsuitable critical decisions; NE.	RV — Human review and alternative manual processing.	NE — AI vendor commitments unverified.	NE	AV: General application support, if AI is deployed.	ICT / Governance, Medium, 9 months: inventory AI-dependent processes and verify manual fallback and human oversight.
AI-Enabled Phishing or Impersonation	Partially Applicable — Prohibit unauthorised approval through unverified messages; NE.	RV — Security awareness and independent transaction verification.	NE	NE	AV: Payment authorisation and suspicious-message reporting.	ICT / Finance, High, 3 months: introduce callback verification for urgent payment and sensitive-data requests; conduct simulation.
Software Supply Chain Compromise	Partially Applicable — Avoid untrusted or unsupported components; NE.	RV — Vendor assessment and controlled updates.	NE — Supplier security commitments unverified.	NE	AV: Software procurement and update approval procedures.	ICT / Procurement, High, 6 months: verify software provenance and test response to compromised vendor updates.
Misconfiguration or Failed System Change	Partially Applicable — Prohibit unapproved high-risk changes; NE.	RV — Change review, testing and rollback.	NE — Vendor change responsibilities unverified.	NE	AV: Change tickets, approval records and configuration backups.	ICT, High, 3 months: test emergency rollback and review failed-change incidents.
Loss or Theft of ICT Devices	Partially Applicable — Eliminate unnecessary local storage of sensitive information; NE.	RV — Device encryption, inventory and remote management.	NE — Asset insurance unverified.	NE	AV: Asset register and lost-device reporting.	ICT / Data Protection Officer, High, 6 months: verify encryption coverage and test remote device revocation.
Cyber-Physical Equipment Failure	Partially Applicable — Retire unsafe connected equipment; NE.	RV — Preventive maintenance and manual operation.	NE — Equipment warranties unverified.	NE	AV: Facilities maintenance and equipment fault reporting.	Facilities / ICT, High, 6 months: identify safety-critical connected equipment and test manual operation or safe shutdown.
Cooling or Environmental Control Failure	NA — Equipment failure cannot be fully eliminated.	RV — Maintenance, temperature monitoring and alternative premises.	NE — Maintenance SLA unverified.	NE	AV: Air-conditioning maintenance and facility fault reporting.	Facilities, High, 3 months: define resident safety thresholds and test cooling outage response.
Data Synchronisation Failure	Partially Applicable — Eliminate unnecessary uncontrolled interfaces; NE.	RV — Reconciliation and data integrity monitoring.	NE — Integration support commitments unverified.	NE	AV: Application error logs and periodic data reconciliation.	ICT / Data Owners, Medium, 6 months: implement exception reporting and test recovery from conflicting records.
Electronic Records or Document Management Failure	Partially Applicable — Retire unsupported repositories; NE.	RV — Backups and controlled offline records.	NE — Vendor recovery commitments unverified.	NE	AV: Document access permissions and backup arrangements.	Records / ICT, High, 6 months: test retrieval of vital records without the primary repository.
Payment Application or Finance System Failure	Partially Applicable — Avoid unnecessary single-application dependency; NE.	RV — Finance workarounds and transaction reconciliation.	NE — Vendor SLA unverified.	NE	AV: Payment approval controls and finance support procedures.	Finance / ICT, High, 6 months: test emergency procurement and beneficiary payment procedures during system outage.
Communication Platform Failure	Partially Applicable — Avoid exclusive reliance on one collaboration platform; NE.	RV — Alternative communication channels.	NE — Provider availability commitments unverified.	NE	AV: Staff contact lists and application support.	Communications / ICT, High, 3 months: test recovery coordination without email or collaboration applications.
Digital Service Provider Concentration	Partially Applicable — Reduce unnecessary common-provider dependence; NE.	RV — Dependency mapping and recovery alternatives.	NE — Provider resilience commitments unverified.	NE	AV: Vendor and application inventories.	ICT / Procurement, High, 6 months: map shared cloud, identity and network providers and exercise correlated outage.

Category 5 implementation focus: JS should prioritise the availability and integrity of essential resident and beneficiary information, emergency communications, secure access, payment capabilities and the ability to continue critical services during technology outages.

Part 2: Control Validation and Gap Assessment

Establishing the Actual Control Environment

The treatment tables are an initial assessment framework. Before JS can rely on any assumed existing control, the responsible control owner must confirm whether the control exists, is appropriately designed and operates effectively.

Table RAR Part 2-A: Control Validation Requirements

Assessment Area	Validation Requirement	Evidence to Obtain
Control existence	Confirm that the stated control has been implemented.	Approved procedures, contracts, asset records or configuration evidence
Control ownership	Identify the person accountable for operation and maintenance.	Control ownership register
Control design	Determine whether the control addresses the relevant disruption mechanism.	Control specifications, operating procedures and technical designs
Operating effectiveness	Verify that the control functions in normal conditions.	Inspection records, system logs, review records and operational samples
Recovery effectiveness	Determine whether the control supports continuity within approved recovery objectives.	Exercise reports, recovery tests and observed results
Dependency reliability	Identify other people, systems or suppliers required for the control to work.	Dependency maps and supplier assurance evidence
Control gaps	Record missing, incomplete or ineffective controls.	Gap assessment and corrective action register
Management approval	Confirm the treatment decision and any accepted residual exposure.	Approval records and risk acceptance documentation

Do not classify a control as comprehensive solely because a policy or procedure exists. Its practical effectiveness must be demonstrated.

Prioritising Planned Controls

The priorities and timeframes in the tables are provisional implementation recommendations. They are not substitutes for the formal risk assessment.

The BCM Coordinator should consolidate the proposed actions and confirm priorities based on beneficiary safety, approved recovery objectives, control deficiencies, resource requirements and management direction.

Table RAR Part 2-B: Proposed Implementation Priority

Priority	Indicative Implementation Approach	Examples
High	Begin promptly; target completion generally within 3–6 months, subject to the actual exposure	Resident evacuation, safe staffing, essential records, ransomware recovery, critical supplier alternatives
Medium	Incorporate into the next planned improvement cycle, generally within 6–9 months	Additional supplier assurance, alternative routes, selected facility resilience enhancements
Low	Review and implement proportionately, generally within 12 months	Low-exposure regional disruption dependencies and longer-term contingency enhancements

Where an unverified control could expose residents, children or other beneficiaries to immediate harm, the responsible service owner should assess the need for urgent interim action rather than wait for the indicated implementation period.

Part 3: Formal Risk Acceptance

No formal JS risk acceptance has been evidenced in the information provided.

Risk acceptance may be considered only after the relevant exposure, control effectiveness and remaining consequences have been assessed.

Table RAR Part 2-C: Risk Acceptance Requirements

Requirement	Implementation Guidance
Acceptance rationale	Explain why additional treatment is unnecessary, impracticable or disproportionate, with supporting evidence.
Residual exposure	Document the remaining risk after existing and planned controls are considered.
Approving authority	Obtain approval from the designated authority within JS's risk governance framework.
Service owner acknowledgement	Confirm that the affected CBF owner understands the operational consequences.
Monitoring	Define indicators or changes that require reassessment.
Review frequency	Review at least annually as a proposed baseline, and sooner following material change or incident.
Reconsideration triggers	Include control failure, service expansion, changes in beneficiary dependency, regulatory changes or significant incidents.
Documentation	Maintain an approved acceptance record with an owner, review date and supporting evidence.

Do not accept risks involving unacceptable resident safety, safeguarding, or mandatory compliance consequences merely because remediation is expensive or operationally difficult.

Part 4: Integration with BCM and Operational Resilience

The treatment and control assessment supports subsequent BCM activities in several ways.

Business Impact Analysis: Identified threats and control dependencies help determine which critical activities may be disrupted and whether existing arrangements can sustain minimum service objectives.

Business Continuity Strategy: Verified control gaps inform decisions concerning alternate accommodation, contingency staffing, backup systems, alternative suppliers, manual workarounds and recovery resources.

Crisis Management: Threat scenarios and escalation weaknesses inform strategic crisis exercises, decision-making arrangements, and stakeholder communication procedures.

Operational Resilience: Examine dependencies shared across multiple CBFs to identify common points of failure and correlated disruption scenarios.

Testing and Exercising: Planned controls should be supported by evidence demonstrating that they work under realistic disruption conditions.

Table RAR Part 2-D: Recommended Control Assurance Activities

Control Area	Proposed Assurance Activity	Responsible Function
Residential safety and relocation	Resident evacuation and alternative accommodation exercise	Residential Care / Facilities
Workforce resilience	Minimum staffing and leadership succession exercise	HR / Service Owners
ICT recovery	Backup restoration and application recovery test	ICT
Cybersecurity	Cyber incident tabletop and technical recovery simulation	ICT / Information Security
Supplier resilience	Critical supplier continuity review and joint exercise	Procurement
Communications	Emergency contact tree and alternate communications test	Communications / BCM
Financial continuity	Emergency payment and procurement simulation	Finance
Crisis governance	Multi-CBF disruption tabletop exercise	CMT / BCM Coordinator

Part 5: Responsibilities and Deliverables

Table RAR Part 2-E: Treatment and Control Responsibilities

Activity	Responsible Contributor	Required Review
Validate existing operational controls	Relevant CBF Owners	BCM Coordinator
Validate premises and physical safety controls	Facilities / Safety	Relevant Service Management
Validate workforce controls	HR	CBF Owners
Validate ICT and cybersecurity controls	ICT / Information Security	ICT Manager
Validate supplier and outsourcing controls	Procurement	Relevant Business Owners
Validate financial controls	Finance	Finance Management
Consolidate control gaps	BCM Coordinator / Risk Management	BCM Steering Committee
Develop planned control actions	Designated Control Owners	Relevant Department Heads
Approve significant treatment decisions	Designated Senior Management	Authorised Governance Body
Approve formal risk acceptance	Delegated Risk Acceptance Authority	According to JS's approved risk governance framework
Monitor corrective actions	BCM Coordinator / Risk Management	BCM Steering Committee

The principal deliverables should include a validated treatment and control register, supporting evidence, documented control gaps, a planned control improvement register, formal acceptance records where applicable and a management-approved basis for subsequent risk evaluation.

RAR Part 2 provides Jamiyah Singapore with a structured approach to examining how it manages identified threats through risk avoidance, reduction, transference, and acceptance.

The assessment demonstrates that different threats require different combinations of treatment approaches.

Natural disasters may require physical protection and continuity arrangements, while workforce threats require staffing and competency measures.

Supply chain disruption requires attention to external dependencies, and technology threats require cybersecurity, information protection and recovery capabilities.

For JS, the effectiveness of these arrangements must ultimately be assessed against the organisation's ability to maintain essential services for residents, children, students, vulnerable beneficiaries and other stakeholders.

The presence of a control does not automatically demonstrate adequate protection. Controls must be verified, assigned to accountable owners, maintained, tested and reviewed.

Where weaknesses are identified, translate them into specific improvement actions with defined responsibilities, implementation timeframes, and evidence of completion.

Risk transference through insurance, outsourcing or contractual arrangements may share certain consequences, but it does not remove JS's responsibility for maintaining essential services.

Similarly, risk acceptance must be informed, documented, appropriately authorised and monitored. It should never justify an unidentified control gap or an unacceptable safety exposure.

The completed treatment and control assessment will support Business Impact Analysis, Business Continuity Strategy, Crisis Management and Operational Resilience planning.

The next stage, RAR Part 3 — Risk Impact and Likelihood Assessment, should evaluate each relevant threat against its verified controls, operational consequences, and remaining exposure before determining risk ratings and further treatment priorities.

Assessment integrity note from author: The chapter reproduces the specific threats from the preceding Jamiyah Singapore RAR Part 1 register, organised across all five categories.

The earlier introduction referred to 100 threats; counting the individual entries gives 108 threats (15 natural, 20 man-made, 21 people, 23 supply chain and 29 equipment/IT).

The actual control environment has not been independently verified.

All assumed controls and proposed actions require validation before this chapter is approved as JS's formal Risk Assessment Report.

eBook 3: Starting Your BCM Implementation
MBCO	P&S	RAR T1	RAR T2	RAR T3	BCS T1	CBF

More Information About Business Continuity Management Courses

To learn more about the course and schedule, click the buttons below for the BCM-300 Business Continuity Management Implementer [B-3] course and the BCM-5000 Business Continuity Management Expert Implementer [B-5].



	If you have any questions, click to contact us.

Resilient Communities: Implementing Business Continuity Management at Jamiyah Singapore

[BCM] [JS] [E3] [RAR] [P2] Treatment and Control

Business Continuity Management Certified Planner-Specialist-Expert

Treatment and Control

RAR Part 2: Treatment and Control for Jamiyah Singapore

Introduction

Relationship Between Threats, Treatments and Controls

The Four Risk Treatment Approaches

Assessment Basis and Evidence Limitations

Part 1: Treatment and Control Assessment

Category 1 — Denial of Access: Natural Disaster

Category 2 — Denial of Access: Man-made Disaster

Category 3 — Unavailability of People

Category 4 — Disruption to the Supply Chain

Category 5 — Equipment and IT-Related Disruption

Part 2: Control Validation and Gap Assessment

Establishing the Actual Control Environment

Prioritising Planned Controls

Part 3: Formal Risk Acceptance

Part 4: Integration with BCM and Operational Resilience

Part 5: Responsibilities and Deliverables

More Information About Business Continuity Management Courses

Your Comments Here:

More Posts

Resilient Communities: Implementing Business Continuity Management at Jamiyah Singapore

[BCM] [JS] [E3] [RAR] [P2] Treatment and Control

Business Continuity Management Certified Planner-Specialist-Expert

hbspt.cta._relativeUrls=true;hbspt.cta.load(3893111, '7a1ba6dc-8352-46e7-b150-d25945acf3d9', {"useNewLoader":"true","region":"na1"});

Treatment and Control hbspt.cta._relativeUrls=true;hbspt.cta.load(3893111, '121caffe-2e46-49cd-9bc5-976ed1c4cca9', {"useNewLoader":"true","region":"na1"});

RAR Part 2: Treatment and Control for Jamiyah Singapore

Introduction

Relationship Between Threats, Treatments and Controls

The Four Risk Treatment Approaches

Assessment Basis and Evidence Limitations

Part 1: Treatment and Control Assessment

Category 1 — Denial of Access: Natural Disaster

Category 2 — Denial of Access: Man-made Disaster

Category 3 — Unavailability of People

Category 4 — Disruption to the Supply Chain

Category 5 — Equipment and IT-Related Disruption

Part 2: Control Validation and Gap Assessment

Establishing the Actual Control Environment

Prioritising Planned Controls

Part 3: Formal Risk Acceptance

Part 4: Integration with BCM and Operational Resilience

Part 5: Responsibilities and Deliverables

More Information About Business Continuity Management Courses

Your Comments Here:

More Posts

Treatment and Control