[CM] [BDCB] [E1] [C6] Assessing Risks and Threats

Chapter 6

What Are the Types of Threats to Business Continuity Management for the Brunei Darussalam Central Bank?

Introduction

Business Continuity Management (BCM) for Brunei Darussalam Central Bank (BDCB) must be designed around the disruptions that could prevent or materially constrain the organisation from continuing its priority activities.

This requires more than identifying isolated hazards. BDCB should understand the sources of disruption, how they could affect critical activities and resources, how dependencies could transmit disruption, and what continuity and recovery capabilities are required.

This is particularly important because BDCB's responsibilities include monetary policy, currency issuance, regulation and supervision of banks and other financial institutions, financial-system stability, and the establishment, functioning, and oversight of efficient payment systems.

BDCB also operates Brunei Darussalam's National Payment and Settlement Systems (NPSS), comprising the Real-Time Gross Settlement (RTGS), Automated Clearing House (ACH), and Central Securities Depository (CSD).

ISO 22301:2019 provides the international requirements for a Business Continuity Management System (BCMS). Its purpose includes enabling organisations to protect against, reduce the likelihood of, and recover from disruptive incidents while maintaining the capability to continue required products and services.

ISO 22301:2019 remains the published standard as of October 2026; a third edition is under development but has not yet replaced it.

For the Brunei government context, publicly available Brunei government material has described BCM as an integrated management process for identifying serious organisational risks early, reducing disruption to critical business activities, responding appropriately to incidents, and restoring activities as quickly as practicable.

Brunei government reporting has also explicitly recognised ISO 22301:2019 as a framework for establishing and managing an effective BCMS.

Accordingly, this chapter applies an all-hazards approach to BDCB. The threats described are planning scenarios, not statements that particular incidents have occurred at BDCB or that particular weaknesses currently exist.

Threats, Risks, and Business Continuity

A threat is a potential source of disruption. A risk is considered the uncertainty associated with that threat and its consequences. A business continuity impact concerns the resulting inability or reduced ability to deliver priority activities, products, or services within required timeframes.

These concepts should therefore be connected:

Threat → Disruptive Event → Resources or Dependencies Affected → Critical Activity Disrupted → Business Impact → Continuity Response → Recovery

For BDCB, the same threat may produce several consequences. A prolonged telecommunications failure, for example, could affect employees, technology connectivity, financial institutions, payment-system participants, and stakeholder communications simultaneously.

The purpose of threat assessment is consequently not to predict precisely which disaster will occur. It is to ensure that BDCB has continuity capabilities robust enough to respond to credible disruptions regardless of their initiating cause.

Threat Categories Relevant to BDCB

A practical BDCB BCM threat taxonomy should include the following major categories.

These categories should not be treated as mutually exclusive. Major disruptions frequently cross several categories.

Natural Hazards

Natural hazards can disrupt BDCB even without directly damaging its premises. They may affect employees, transport, utilities, telecommunications, suppliers, and financial institutions.

Relevant scenarios include:

• flooding;
• flash flooding;
• severe rainfall and thunderstorms;
• lightning;
• strong winds;
• prolonged haze;
• extreme heat;
• regional seismic events;
• landslides where relevant to supporting infrastructure;
• natural fires; and
• regional natural disasters affecting critical suppliers or connectivity.

The BCM concern is therefore broader than physical damage:

Natural Hazard → Premises/Transport/Utilities/People Affected → Critical Resources Unavailable → BDCB Activities Disrupted

Continuity measures should consider alternate premises, remote working, workforce availability, alternative communications, technology resilience, supplier contingencies, and recovery arrangements.

Flood and Severe Weather

Flooding and severe weather deserve particular consideration because they can create simultaneous disruptions.

Potential consequences include:

• inability to access BDCB premises;
• employee transport disruption;
• electrical disruption;
• telecommunications problems;
• equipment damage;
• supplier delays;
• reduced staffing;
• financial-institution disruption; and
• increased demand for BDCB coordination.

The critical BCM issue is therefore correlated disruption.

An alternate workplace provides limited resilience if the same event also prevents employees from reaching it or disrupts the telecommunications services on which it depends.

Fire and Premises Loss

A major building fire could create immediate life-safety requirements followed by prolonged business interruption.

The disruption pathway is:

Fire → Evacuation → Premises Unavailable → People/Equipment/Records Affected → Alternate Working Arrangements → Business Recovery

Continuity arrangements should therefore consider:

• evacuation and employee accountability;
• alternate workspace;
• remote-working capability;
• technology access;
• vital records;
• specialist equipment;
• security requirements;
• dependencies on physical facilities; and
• long-duration premises loss.

BCM should plan not only for a building that is destroyed, but also for a building that remains physically intact yet cannot be occupied because of smoke, utilities, security restrictions or emergency-service control.

Technology Failure

Technology is fundamental to modern central-banking operations.

Potential disruptions include:

• hardware failure;
• software/application failure;
• database failure;
• network failure;
• telecommunications failure;
• storage failure;
• virtualisation failure;
• identity-service failure;
• data-centre failure;
• failed technology changes;
• interface failures;
• capacity problems; and
• disaster-recovery failure.

The continuity pathway is:

Technology Failure → Application/Infrastructure Unavailable → Critical Activity Affected → Workaround or DR Activation → Technology Recovery → Business Validation

Technology recovery should be based on business recovery requirements, not solely technical priorities.

Cyber Threats

Cyber incidents can become BCM events when they prevent priority activities from being performed.

Examples include:

• ransomware;
• destructive malware;
• DDoS;
• cyber sabotage;
• compromised privileged accounts;
• widespread endpoint compromise;
• data corruption;
• attacks against critical suppliers; and
• attacks affecting payment infrastructure.

The most difficult cyber continuity problem may be integrity rather than availability.

System Availability — Can BDCB operate the system?

Information Integrity — Can BDCB trust the information and transactions within it?

A compromised system should not necessarily be returned to service simply because it can technically be made available.

Data and Information Integrity

Information is itself a critical resource.

Potential threats include:

• data corruption;
• accidental deletion;
• database failure;
• incomplete replication;
• inaccurate transaction records;
• loss of vital records;
• backup corruption; and
• loss of access to essential information.

The continuity problem becomes:

Information Unavailable or Untrusted → Critical Decisions/Transactions Cannot Proceed Reliably → Manual or Alternate Arrangements Required → Information Restored and Validated

BDCB's recovery procedures should therefore address both restoration and verification.

Power and Utility Failure

Technology and facilities depend on reliable supporting utilities.

Potential scenarios include:

• prolonged electricity failure;
• unstable power;
• UPS failure;
• generator failure;
• cooling/HVAC failure;
• water disruption; and
• fuel-supply constraints affecting backup generation.

A common mistake is to treat emergency power as sufficient protection.

The complete dependency may instead be:

Utility Supply → UPS → Generator → Fuel → Cooling → Data Centre → Technology → Critical Business ActivityThe 

BCM assessment should examine the entire chain.

Telecommunications and Connectivity

A telecommunications failure may prevent BDCB from interacting with employees, financial institutions, payment participants, suppliers, and government stakeholders, even when internal systems remain available.

Threats include:

• telecom-provider outage;
• internet failure;
• fibre damage;
• network-carrier failure;
• mobile communications failure;
• simultaneous provider outage; and
• failure of crisis communication platforms.

Alternative communications should avoid excessive reliance on the same underlying infrastructure.

Payment and Settlement System Disruption

Payment-system continuity is especially important for BDCB.

BDCB operates RTGS, ACH, and CSD as part of Brunei Darussalam's NPSS. RTGS handles large-value and urgent interbank payments; ACH facilitates bulk clearing, with resulting obligations submitted to RTGS for settlement.

BDCB has itself described RTGS as the heart of a modern national payment system and noted the need for such a system to remain reliable, robust, and resilient.

Relevant BCM scenarios include:

• RTGS unavailability;
• ACH disruption;
• CSD disruption;
• participant-connectivity failure;
• transaction-integrity problems;
• supporting database failure;
• network failure;
• common infrastructure failure; and
• simultaneous disruption of multiple NPSS components.

The cascading effect could be:

Payment-System Failure → Financial Institutions Affected → Settlement/Clearing Delayed → Businesses and Consumers Affected → Wider Financial-System Consequences

This is why payment-system BCM should address both BDCB recovery and external dependencies.

Workforce and People Threats

A building and its technology can remain available while critical activities fail because the necessary people are unavailable.

Threats include:

• infectious disease;
• pandemic;
• mass absenteeism;
• transport disruption;
• loss of key personnel;
• simultaneous unavailability of specialists;
• workplace injury;
• family-care obligations during national emergencies; and
• prolonged fatigue during extended response operations.

Continuity strategies may include:

• succession;
• alternates;
• cross-training;
• split teams;
• remote working;
• documented procedures;
• skill redundancy; and
• sustainable staffing rotations.

A key principle is:

Critical Person → Critical Knowledge → Critical Activity

BCM should reduce dependence on any single individual.

Pandemic and Infectious Disease

A pandemic differs from many conventional disasters because infrastructure may remain operational while workforce availability is progressively reduced.

The disruption can develop as:

Disease Outbreak → Employee Absence → Reduced Staffing → Critical Skills Constrained → Service Capacity Reduced → Prolonged Continuity Arrangements

Planning should consider:

• minimum staffing;
• remote working;
• team separation;
• succession;
• health measures;
• employee welfare;
• prolonged duration;
• supplier absenteeism; and
• simultaneous financial-sector effects.

Third-Party and Supply-Chain Failure

BDCB's resilience depends partly on organisations outside its direct control.

Potential dependencies may include:

• telecommunications providers;
• technology vendors;
• managed-service providers;
• utilities;
• equipment suppliers;
• maintenance providers;
• specialist consultants;
• logistics providers; and
• other critical service providers.

Threats include:

• supplier operational failure;
• supplier cyberattack;
• supplier financial failure;
• loss of key supplier personnel;
• supply shortages;
• provider data-centre outage; and
• concentration on a common supplier.

The BCM chain is:

Supplier Failure → Critical Resource/Service Unavailable → BDCB Activity Affected → Alternate Supplier or Workaround → Recovery

Supplier contracts alone do not create continuity. Critical dependencies should be assessed and, where necessary, tested.

Concentration and Common-Cause Failure

Redundancy is ineffective if primary and alternate arrangements share the same underlying vulnerability.

Examples include:

• two telecom links using the same physical route;
• primary and alternate systems sharing one identity platform;
• production and recovery environments depending on one provider;
• alternate sites relying on the same utility infrastructure;
• multiple financial institutions and BDCB, depending on one critical supplier.

The problem can be expressed as:

Primary Capability + Backup Capability + Shared Dependency → Shared Dependency Fails → Both Capabilities Unavailable

BCM assessment should therefore identify hidden common dependencies.

Physical Security and Malevolent Threats

Deliberate events can create business interruption through:

• sabotage;
• bomb threats;
• deliberate infrastructure damage;
• hostile intrusion;
• terrorism;
• workplace violence; and
• malicious insider activity.

The immediate response may be led by security or emergency-management arrangements, but BCM becomes relevant when the event causes prolonged loss of:

• premises;
• people;
• technology;
• records;
• equipment; or
• access.

BCM and security should therefore be coordinated but remain distinct capabilities.

Transport and Denial of Access

BDCB should consider the scenario in which its buildings are functional, but employees cannot safely access them.

Potential causes include:

• flooding;
• road closure;
• security cordons;
• public disorder;
• major accidents;
• national emergencies;
• public-health restrictions; and
• transport-system disruption.

The BCM scenario is simply:

Premises Available + Employees Unable to Access Premises = Business Continuity Disruption

Remote-working and alternate-site strategies should be assessed against this scenario.

Financial-Sector Stress as a BCM Threat

Not all continuity threats originate within BDCB.

A major financial-sector event could create an extraordinary workload precisely when BDCB's normal resources are constrained.

Examples include:

• severe stress at a financial institution;
• multiple institutions requiring supervisory attention;
• liquidity stress;
• settlement pressure;
• rapid increases in stakeholder enquiries;
• financial-market disruption; and
• widespread confidence concerns.

The scenario may develop as:

External Financial-Sector Event → Increased Demand on BDCB → Critical Staff/Systems Under Pressure → Capacity Constraints → Continuity Measures Required

BCM should therefore consider surge demand, not merely loss of resources.

National and Regional Emergencies

A national emergency may affect many continuity resources simultaneously.

Examples could include:

• severe natural disaster;
• major public-health emergency;
• prolonged national utility disruption;
• major telecommunications failure;
• significant security event; and
• cross-border disruption affecting essential supplies.

Such scenarios are important because normal assumptions about external assistance, suppliers, and alternative resources may no longer hold.

National Emergency → Multiple Organisations Affected → Shared Resources Constrained → Suppliers and Infrastructure Disrupted → BDCB Continuity Challenge

This reinforces the need to align BDCB arrangements with applicable Brunei government BCM, emergency, and national coordination arrangements.

Where a specific government policy or requirement is internally applicable to BDCB, its requirements should be mapped directly into the BCMS rather than inferred from public material.

Climate-Related Threats

Climate-related considerations should now form part of the BCMS context assessment.

ISO 22301:2019 has a 2024 climate-action amendment, and ISO lists the amended standard among the published business-continuity standards.

For BDCB, relevant continuity considerations may include changing exposure to:

• extreme rainfall;
• flooding;
• heat;
• haze;
• infrastructure disruption;
• supply-chain effects; and
• regional weather events.

The appropriate BCM question is not whether every disruptive event can definitively be attributed to climate change. It is whether climate-related issues are relevant to BDCB's context and could alter continuity risk or recovery assumptions.

Threats Should Be Assessed Through Their Business Impact

A threat list alone is insufficient.

The BCM assessment should determine what resources and activities could be lost.

A useful model is:

Threat → People + Premises + Technology + Information + Suppliers → Critical Business Function → Product/Service → Stakeholders

For example, a flood, cyberattack, and telecommunications outage are different threats, but all three could ultimately prevent a critical activity from being delivered.

This supports a more resilient strategy because continuity arrangements are designed around the effect of disruption, rather than only its cause.

Resource-Based BCM Scenarios

BDCB should therefore complement its threat catalogue with a small number of resource-loss scenarios:

This makes BCM less dependent on predicting the exact initiating threat.

Compound and Cascading Threats

One of the most important lessons for a central bank is that threats should not always be assessed independently.

Consider:

Severe Weather → Power Failure → Telecommunications Disruption → Financial Institution Connectivity Problems → Payment-System Disruption

Or:

Cyberattack → Technology Failure → Payment-System Disruption → Financial Institutions Affected → Stakeholder Concern → Confidence Consequences

Or:

Pandemic → Workforce Shortage → Supplier Constraints → Reduced Technology Support → Critical Activity Degradation

BCM scenarios should therefore include compound, cascading, and common-cause disruptions.

Assessing Threats Systematically

BDCB can apply a structured assessment:

Identify Threat → Identify Vulnerability → Identify Resources Exposed → Determine Critical Activities Affected → Assess Existing Controls → Assess Likelihood → Assess Impact → Determine Risk → Identify Treatment → Determine Continuity Requirement

The purpose is not merely to assign a score.

The assessment should help management determine:

• what must be protected;
• what cannot reasonably be prevented;
• what must be recoverable;
• what alternatives are needed;
• what resources are required;
• how quickly recovery must occur; and
• how capability will be demonstrated.

Connecting Risk Assessment and Business Impact Analysis

Risk Assessment and Business Impact Analysis serve related but different purposes.

Risk Assessment asks:

What could disrupt BDCB, how likely is it, and what controls should reduce the risk?

Business Impact Analysis asks:

If a BDCB activity is disrupted, how serious does the impact become over time, and what recovery is required?

Together:

Risk Assessment → Understand Disruption Risk

Business Impact Analysis → Understand Recovery Priority

The outputs then inform continuity strategies and plans.

From Threat Assessment to Continuity Strategy

The assessment should ultimately drive action.

Threats and Risks → Business Impact Analysis → Recovery Requirements → Continuity Strategies → Business Continuity Plans → Exercises → Improvement

Potential strategies may include:

• alternate workplaces;
• remote working;
• technology redundancy;
• disaster recovery;
• manual workarounds;
• alternative communications;
• alternate suppliers;
• cross-trained personnel;
• data backup and restoration;
• resource stockpiles;
• reciprocal arrangements;
• emergency procurement; and
• predefined recovery priorities.

The selected strategy should correspond to the recovery requirement established through the BIA.

ISO 22301 Alignment

The approach described in this chapter supports ISO 22301's management-system model.

The current published ISO 22301:2019 establishes requirements for organisations to plan, establish, implement, operate, monitor, review, maintain, and continually improve a BCMS that protects against disruption and supports recovery.

For BDCB, threat assessment should therefore not be a one-time exercise. It should operate within a cycle of:

Organisational Context → Risk Assessment → Business Impact Analysis → Continuity Strategies → Plans and Procedures → Exercising → Evaluation → Continual Improvement

The assessment should be reviewed when there are material changes to:

• BDCB activities;
• financial infrastructure;
• technology;
• premises;
• suppliers;
• workforce;
• regulation;
• operating environment;
• threat environment; or
• lessons from incidents and exercises.

Alignment with the Brunei Government BCM Context

Public Brunei government reporting has described BCM as an integrated process for identifying serious organisational risks early, reducing disruption to critical activities, responding appropriately and resuming operations as quickly as possible.

It has also recognised ISO 22301:2019 as a practical framework for effective BCMS implementation.

For this eBook, the appropriate alignment principle is therefore:

Brunei Government BCM Direction + ISO 22301 Requirements + BDCB Mandate and Operating Context → BDCB Business Continuity Management System

Where BDCB is subject to a specific non-public or internal Brunei government BCM policy, its exact mandatory requirements should be incorporated into the BCMS through a formal compliance mapping.

This chapter should not imply specific policy clauses that cannot be verified from publicly available government material.

BDCB's Priority BCM Threat Profile

Based on BDCB's central-bank role and dependencies, particular attention should be given to scenarios capable of affecting:

• People — loss of critical employees or specialist capability.

• Premises — denial of access or loss of critical facilities.

• Technology — failure of applications, infrastructure, or data centres.

• Information — loss of availability or integrity.

• Payment Infrastructure — RTGS, ACH, and CSD disruption.

• Telecommunications — inability to communicate internally or with participants.

• Utilities — prolonged power or supporting infrastructure failure.

• Third Parties — failure of critical providers.

• Cyber Events — technology and information disruption.
• Compound Events — multiple dependencies failing simultaneously.

The emphasis should be on continuity consequence rather than simply threat frequency. A rare scenario may still require substantial preparedness where the potential disruption is unacceptable.

Key Implementation Principle

The central principle for BDCB is:

Business continuity planning should not attempt to predict every possible disaster. It should identify credible threats, understand their potential impact on critical activities and dependencies, and develop recovery capabilities that remain effective across a range of disruptions.

This can be expressed as:

Understand the Threat → Understand the Impact → Determine the Recovery Requirement → Build the Capability → Exercise the Capability → Improve the Capability

The threats to Business Continuity Management at Brunei Darussalam Central Bank extend well beyond conventional natural disasters.

BDCB must consider natural hazards, facilities loss, technology and cyber disruption, telecommunications and utility failure, payment-system outages, workforce shortages, third-party failures, physical-security incidents, information-integrity problems, financial-sector stress, and national or regional emergencies.

Its BCM framework should also recognise compound and cascading scenarios in which several resources or dependencies fail together.

This breadth is necessary because BDCB occupies an important position within Brunei Darussalam's financial system. Its responsibilities include monetary policy, currency issuance, regulation and supervision, financial-system stability, and payment-system responsibilities.

Its operation of RTGS, ACH, and CSD also creates direct operational interdependencies with financial institutions and the wider economy.

The recommended approach is therefore to combine threat-based assessment with resource-loss and impact-based planning. Threat analysis identifies what could happen; the BIA establishes what matters and how quickly recovery is required; continuity strategies establish how the required capability will be maintained or restored.

This supports the intent of ISO 22301:2019, which remains the current published BCMS requirements standard while its next edition is being developed.

It is also consistent with publicly documented Brunei government thinking that BCM should identify serious risks early, reduce disruption to critical activities, and support effective response and timely resumption.

The complete BCM threat-management pathway for BDCB is:

For BDCB, the objective is ultimately not to prevent every disruption. It is to ensure that when disruption occurs, critical central-bank activities can continue or recover within acceptable timeframes while protecting people, information, financial infrastructure, stakeholders and the stability of Brunei Darussalam's financial system.

 

 

eBook 1: Understanding Your Organisation
C1	C2	C3	C4	C5	C5A	C6
C7	C8	C9	C10	C11	C12	C13

 

 

More Information About Crisis Management Blended/ Hybrid Learning Courses

To learn more about the course and schedule, click the buttons below for the  CM-300 Crisis Management Implementer [CM-3] and the CM-5000 Crisis Management Expert Implementer [CM-5].

	Please feel free to send us a note if you have any questions.