[BCM] [MBS] [E3] [BCS] [T1] Mitigation Strategies and Justification

[Business Impact Analysis] [Mitigation Strategies and Justification]

Bann_BCM_BCS_Mitigation Strategies and Justification

Part 1: BCS – Mitigation Strategies for MBS

Introduction

[BCM] [GEN] [E3] [BCS] [T1] Mitigation Strategies and Justification

In this chapter, we set out the mitigation strategies for Marina Bay Sands (MBS), focusing on reducing the likelihood and impact of identified threats to its business continuity.

In the Business Continuity Strategy (BCS) phase, the organization should examine risks that remain high despite existing controls, evaluate residual exposure, and propose additional mitigation to bring those risks to an acceptable level.

The table below summarises for each threat: the existing controls in place, a risk rating (pre-treatment), the risk level, the residual risk (i.e., risk treatment), and recommended additional mitigation strategies with justifications.

Mitigation Strategies Table for MBS

Threat	Existing Controls	Risk Rating (Pre-treatment)	Risk Level	Risk Treatment / Residual Risk	Additional Mitigation Strategy	Justification for Selected Mitigation Strategy
Data breach / cyberattack (customer data exposure)	• Cybersecurity perimeter defenses (firewalls, IDS/IPS) • Encryption of data in transit and at rest • Access control and role-based permissions • Incident response plan • Regular security audits / vulnerability scanning	High	Severe	Moderate (residual)	• Zero trust architecture (microsegmentation) • Enhanced monitoring and anomaly detection (SIEM / UEBA) • Cyber insurance to transfer part of residual risk • Penetration testing & red-teaming	Because MBS is a high-profile target (e.g. 665,000 customers affected in 2023) SecurityWeek+1, reducing attack surface via zero trust and detecting early anomalies helps reduce both likelihood and impact. Cyber insurance helps cushion financial loss from residual risk.
Operational disruption (power outage, utility failure)	• Backup generators / UPS systems • Redundant power feeds • Preventive maintenance of electrical infrastructure	Medium	High	Low / Moderate	• Add distributed energy sources (e.g. solar + battery) • Real-time monitoring and predictive maintenance using IoT • Formal contingency agreements with alternate power providers	The addition of distributed energy and predictive maintenance reduces dependency on single utility sources and ensures faster recovery.
Natural disasters / extreme weather (flood, storm, sea-level rise)	• Structural design compliant with codes • Flood barriers, drainage systems • Emergency preparedness procedures	Medium	High	Low / Moderate	• Climate resilience retrofitting (e.g. flood walls, raised electricals) • Scenario-based drills and planning • Insurance and risk transfer	Because Singapore and the bayfront location expose MBS to flood risk, retrofitting and scenario drills increase resilience; insurance covers residual financial risk.
Fire / internal safety incident	• Fire detection and suppression systems • Fire drills and evacuation planning • Safety inspections and compliance • Contractor safety rules (per MBS supplier safety policies) sands.com	Low–Medium	Medium	Low	• Advanced fire modeling and early-warning sensors (smoke, heat maps) • Automated shutdown of critical systems • Increased staff training and safety culture programs	Enhanced detection speeds response; automated shutdown mitigates the spread; training ensures correct behavior under stress.
Reputational / regulatory risk (noncompliance, negative publicity)	• Governance, internal audit, compliance programs • ESG reporting, codes of conduct • Crisis communication plans	Medium	High	Low / Moderate	• Real-time monitoring of media/social channels • External third-party compliance assurance • Stakeholder engagement and proactive transparency	Real-time monitoring allows early detection of issues; third-party assurance raises credibility; engagement builds trust and mitigates reputational shock.
Environmental / sustainability risk (excessive carbon emissions, water shortage)	• Energy efficiency (LED lighting, building management systems) sands.com+2Marina Bay Sands+2 • Water recycling and conservation programs • ESG and sustainability targets (e.g. carbon reduction by 2025) Marina Bay Sands	Medium	Medium	Low	• Deploy further renewable energy (solar panels, storage) • Advanced energy management (AI optimisation) • Water harvesting, greywater reuse • Sustainability certifications & external audits	The incremental improvements push MBS closer to net-zero goals; external audits boost stakeholder confidence; these mitigations reduce both probability and severity of sustainability risk.
Supply chain / vendor failure (e.g. critical services vendor disruption)	• Vendor contracts with SLAs • Vendor risk assessment & due diligence • Alternate vendor arrangements	Medium	High	Low / Moderate	• Vendor continuity planning & joint drills • Multi-sourcing of critical services • Performance bonds / penalty clauses	Having alternate suppliers, tested continuity plans and contractual levers reduce dependence on any single vendor and improve resilience.

Notes on Columns and Ratings

The Risk Rating (Pre-treatment) is the inherent risk before mitigation, combining likelihood and impact.
Risk Level classifies that rating (e.g. Low, Medium, High, Severe).
Risk Treatment /Residual Risk refers to the risk remaining after current controls are implemented
“Additional Mitigation Strategy” is what you propose to reduce residual risk further.
The “Justification” explains why that mitigation is appropriate in the MBS context (cost, feasibility, risk reduction benefits).

Summing Up ...

In this Part 1 chapter, we have articulated a coherent set of mitigation strategies for Marina Bay Sands across its key threat vectors, linking existing controls with proposed additional steps to bring residual risks down to acceptable levels.

The process of mitigation in BCS is not a one-time exercise: periodic review, scenario testing, and adaptation are necessary as threats evolve and as the business changes.

In subsequent chapters, you will build on this foundation by detailing crisis response procedures, recovery strategies, and continuity plans that operationalize the mitigations established here.

The integrity of the BCS rests on the alignment between mitigation, response, and recovery so that MBS can survive — and even thrive — under adverse disruptions.

More Information About Business Continuity Management Courses

To learn more about the course and schedule, click the buttons below for the BCM-300 Business Continuity Management Implementer [BCM-3] and the BCM-5000 Business Continuity Management Expert Implementer [BCM-5].