[BCM] [KKH] [E3] [BCS] [P1] Mitigation Strategies and Justification

More Information About Business Continuity Management Courses

Written by Dr Goh Moh Heng | Aug 7, 2026, 8:17:00 AM

Introduction

Business Continuity Strategy (BCS) builds upon the findings of the Risk Assessment Report (RAR) and Business Impact Analysis (BIA) by identifying practical measures to reduce the likelihood and consequences of disruptions affecting critical healthcare services.

While the Risk Assessment identifies credible threats and evaluates their associated risks, the Business Continuity Strategy determines the mitigation measures required to strengthen organisational resilience before an incident occurs.

For a specialist tertiary healthcare institution such as KK Women's and Children's Hospital (KKH), mitigation strategies must focus on protecting patient safety, ensuring continuity of emergency and critical clinical services, safeguarding essential information systems, maintaining workforce capability, and strengthening dependencies on critical suppliers and infrastructure.

The strategies should align with the principles of ISO 22301 Business Continuity Management Systems, support enterprise risk management objectives, and complement clinical governance, emergency preparedness, crisis management and operational resilience initiatives.

The mitigation strategies presented in this chapter are based on the representative threats identified during the Risk Assessment process. They assume a baseline level of existing controls commonly found in a modern tertiary hospital and recommend additional measures that further reduce residual risk.

The proposed strategies should be reviewed, prioritised and validated by the relevant business owners, clinical departments, ICT teams, facilities management, procurement, security and senior management before implementation.

Table T1: Mitigation Strategies

Threat	Existing Controls	Risk Rating	Risk Level	Risk Treatment (Residual Risk)	Additional Mitigation Strategy	Justification for Selected Mitigation Strategy
Flash Flood	Building drainage, emergency response procedures, weather monitoring	12	High	Reduce	Improve flood barriers, relocate critical equipment above flood level, enhance drainage inspections	Reduces facility disruption and protects critical clinical infrastructure.
Severe Storm	Building maintenance, standby generators, weather alerts	12	High	Reduce	Strengthen roof inspections, secure external equipment, improve severe weather response procedures	Minimises weather-related operational interruptions.
Lightning Strike	Lightning protection system, UPS, surge protection	12	High	Reduce	Upgrade surge suppression, improve grounding and electrical monitoring	Protects sensitive medical equipment and ICT systems.
Extreme Heat	HVAC systems, environmental monitoring	12	High	Reduce	Increase cooling redundancy and monitor critical clinical areas continuously	Ensures safe environmental conditions for patients and equipment.
Haze	Indoor air filtration, PPE availability	12	High	Reduce	Increase HEPA filtration capacity and implement flexible staffing arrangements	Protects vulnerable patients and healthcare workers during prolonged haze.
Pandemic Movement Restrictions	Pandemic plans, telemedicine capability, split teams	15	High	Reduce	Expand remote consultation capability, strengthen workforce surge planning	Supports continuity of clinical services during mobility restrictions.
Regional Earthquake Effects	Structural compliance, emergency response plans	8	Moderate	Accept with Monitoring	Conduct structural resilience assessments and emergency exercises	Earthquakes are infrequent but preparedness improves resilience.
Fire	Fire detection, suppression systems, evacuation procedures	15	High	Reduce	Increase compartmentalisation, conduct frequent fire drills and equipment testing	Essential to protect patients who may not be able to self-evacuate.
Explosion	Hazardous materials procedures, security controls	10	High	Reduce	Enhance hazardous materials management and emergency coordination	Reduces consequences of rare but severe incidents.
Chemical Spill	Hazardous substance management, spill kits	12	High	Reduce	Improve chemical inventory management and spill response training	Minimises patient and staff exposure.
Medical Gas Leak	Gas monitoring systems, preventive maintenance	10	High	Reduce	Install additional monitoring sensors and automatic isolation valves	Ensures uninterrupted life-support capability.
Structural Failure	Preventive maintenance, engineering inspections	10	High	Reduce	Increase structural monitoring and contingency relocation plans	Supports continued clinical operations if facilities become unsafe.
Bomb Threat	Security screening, evacuation procedures	8	Moderate	Reduce	Improve threat assessment procedures and staff awareness	Enhances coordinated response while minimising disruption.
Terrorism	Security programme, CCTV, access controls	10	High	Reduce	Strengthen multi-agency coordination and active threat exercises	Improves readiness for low-frequency, high-impact incidents.
Active Assailant	Security officers, emergency communication	10	High	Reduce	Conduct lockdown drills and enhance staff response training	Protects patients, visitors and staff during violent incidents.
Public Transport Disruption	Flexible rostering	12	High	Reduce	Arrange staff transport support and temporary accommodation	Maintains workforce availability during transport disruption.
Major Traffic Incident	Emergency access routes	12	High	Reduce	Develop alternate ambulance routing and coordination with authorities	Preserves emergency patient access.
Pandemic	Infection prevention programme, PPE stockpile	15	High	Reduce	Increase strategic stockpiles and expand workforce resilience planning	Essential for sustained healthcare delivery during prolonged outbreaks.
Infectious Disease Outbreak	Isolation protocols, surveillance systems	20	Very High	Reduce	Expand isolation capacity and rapid diagnostic capability	Protects patients and prevents healthcare-associated transmission.
Mass Illness	Cross-trained staff, surge rosters	15	High	Reduce	Develop reserve workforce arrangements and volunteer mobilisation	Maintains minimum staffing levels.
Loss of Key Personnel	Succession planning	15	High	Reduce	Expand cross-training and knowledge management programmes	Reduces dependency on individual specialists.
Skills Shortage	Recruitment and training programmes	20	Very High	Reduce	Build multidisciplinary workforce capability and retention initiatives	Addresses long-term workforce sustainability.
Staff Fatigue	Shift management policies	20	Very High	Reduce	Enhance fatigue monitoring, wellbeing programmes and staffing flexibility	Improves patient safety and staff performance.
Psychological Stress	Employee assistance programme	16	High	Reduce	Increase mental health support and peer resilience initiatives	Supports workforce wellbeing during prolonged incidents.
Mandatory Quarantine	Workforce contingency plans	15	High	Reduce	Develop remote clinical support and reserve staffing models	Maintains service continuity during quarantine events.
Supplier Failure	Procurement monitoring, approved suppliers	15	High	Reduce	Diversify critical suppliers and maintain strategic inventories	Reduces dependency on single suppliers.
Cloud Service Provider Failure	Cloud resilience architecture	15	High	Reduce	Establish multi-region resilience and alternate hosting capability	Improves ICT service continuity.
Telecommunications Failure	Dual communication channels	15	High	Reduce	Introduce additional network diversity and satellite communications	Maintains operational communications during outages.
Utility Failure	Backup generators, UPS	15	High	Reduce	Increase fuel reserves and redundant utility connections	Supports uninterrupted clinical operations.
Logistics Disruption	Inventory monitoring	12	High	Reduce	Increase buffer stocks of critical medical supplies	Reduces risk of treatment delays.
Fuel Supply Disruption	Generator fuel storage	8	Moderate	Reduce	Establish multiple fuel suppliers and emergency replenishment agreements	Improves generator sustainability.
Vendor Insolvency	Vendor evaluation process	8	Moderate	Reduce	Strengthen financial monitoring and identify alternate vendors	Reduces third-party dependency risk.
Third-Party Cyber Incident	Third-party security requirements	15	High	Reduce	Expand supplier cyber assurance and incident notification requirements	Strengthens digital supply chain resilience.
Single Source Dependency	Procurement oversight	15	High	Reduce	Establish dual sourcing for critical medical products	Improves supply continuity.
Regulatory Import Restrictions	Procurement planning	10	High	Reduce	Increase local sourcing and emergency procurement arrangements	Supports continuity during international supply disruptions.
Cyber Attack	Security monitoring, firewalls, MFA	20	Very High	Reduce	Implement Zero Trust architecture, enhanced SOC monitoring and threat hunting	Strengthens protection against evolving cyber threats.
Ransomware	Endpoint protection, offline backups	20	Very High	Reduce	Enhance immutable backups, privileged access management and cyber exercises	Minimises recovery time and data loss.
Malware Infection	Antivirus and endpoint detection	20	Very High	Reduce	Deploy advanced endpoint detection and response (EDR) solutions	Improves early detection and containment.
Distributed Denial of Service (DDoS)	Network monitoring	15	High	Reduce	Implement DDoS mitigation services and redundant internet connectivity	Maintains external digital services.
Insider Threat	Access controls, audit logging	15	High	Reduce	Strengthen behavioural monitoring and privileged access governance	Reduces internal security risks.
Data Breach	Encryption, access management	15	High	Reduce	Expand data loss prevention and continuous security monitoring	Protects confidential patient information.
Network Failure	Redundant network infrastructure	20	Very High	Reduce	Increase network path diversity and automated failover capability	Supports uninterrupted clinical ICT services.
Server Failure	Virtualisation and clustering	15	High	Reduce	Increase high-availability architecture and proactive monitoring	Reduces service downtime.
Database Corruption	Database backup and recovery	15	High	Reduce	Introduce continuous replication and integrity validation	Protects critical clinical records.
Cloud Service Outage	Cloud resilience architecture	15	High	Reduce	Multi-cloud recovery capability and regular failover testing	Improves resilience of hosted services.
Power Failure	UPS and standby generators	15	High	Reduce	Increase generator redundancy and preventive maintenance	Ensures continuity of critical clinical equipment.
Hardware Failure	Preventive maintenance programme	15	High	Reduce	Maintain critical spare equipment and lifecycle replacement programme	Reduces equipment-related downtime.
Software Failure	Change management and testing	15	High	Reduce	Improve software resilience testing and rollback capability	Minimises service interruptions after upgrades.
Backup Failure	Backup monitoring and testing	10	High	Reduce	Introduce immutable backup verification and recovery validation	Improves recoverability of critical systems.
Data Centre Failure	Disaster Recovery Site	10	High	Reduce	Enhance geographic redundancy and automated failover	Ensures rapid restoration of critical ICT services.
Identity & Access Management Failure	IAM platform, MFA	15	High	Reduce	Deploy redundant authentication services and emergency access procedures	Maintains secure access to clinical systems.
Artificial Intelligence System Failure	Human clinical oversight	8	Moderate	Accept with Monitoring	Establish AI governance framework and manual clinical fallback procedures	Ensures patient safety while AI capabilities mature.

Mitigation strategies form a critical bridge between risk assessment and business continuity planning by translating identified risks into practical actions that strengthen organisational resilience. Rather than eliminating every threat, the objective is to reduce the likelihood of disruption, minimise operational consequences, and improve KKH's ability to continue delivering essential healthcare services during incidents, emergencies and disasters.

The strategies presented in this chapter recognise that different threats require different approaches.

Physical threats demand resilient facilities and emergency preparedness; workforce risks require succession planning and staff wellbeing initiatives; supply chain disruptions necessitate supplier diversification and inventory resilience; while cyber threats require robust technical controls, continuous monitoring and well-rehearsed incident response capabilities.

The proposed mitigation measures should be prioritised according to the organisation's risk appetite, available resources and the criticality of the services they protect.

Mitigation strategies should not remain static. They should be reviewed regularly in response to emerging threats, lessons learned from incidents and exercises, technological developments, regulatory changes and evolving clinical practices.

By integrating these strategies into its Business Continuity Management System, KKH can enhance patient safety, maintain critical healthcare services, strengthen operational resilience and improve its ability to respond effectively to future disruptions.

eBook 3: Starting Your BCM Implementation

RAR T1

RAR T2

RAR T3

BCS T1

eBook 1

To learn more about the course and schedule, click the buttons below for the BCM-300 Business Continuity Management Implementer [BCM-3] and the BCM-5000 Business Continuity Management Expert Implementer [BCM-5].



	Please feel free to send us a note if you have any questions.

View full post