Loading...
Loading...
Independent, examiner-grade Threat & Vulnerability Risk Assessment for Malaysian licensed financial institutions. Methodology aligned to BNM RMiT, written for the Board Risk Committee and the BNM examiner in the same document.
A Threat & Vulnerability Risk Assessment is the BNM-aligned annual exercise Malaysian financial institutions use to evidence that their cyber-risk programme remains effective against current threats. Where a pentest exercises specific technical assets, a TVRA is a methodology-driven institutional review that names threat actors, models attack paths against critical systems, enumerates vulnerabilities across people-process-technology, and quantifies residual risk after controls.
The deliverable is a board-grade risk register with treatment plans, mapped clause-by-clause to the BNM RMiT Policy Document. Most FIs run TVRA annually, with a delta review on any material change — new core system, new outsourcing arrangement, post-incident, post-merger.
Authoritative list of in-scope systems (core banking, payment gateway, customer channels, regulatory reporting), with criticality classification and dependencies.
Named threat-actor library relevant to Malaysian FSI — financially-motivated, state-aligned, insider, hacktivist. Modelled using STRIDE and MITRE ATT&CK against each critical system.
Technical (configuration, patching, architecture) and non-technical (process gaps, training deficits, third-party exposure). Pentest output where relevant feeds this section.
Quantified using the FI's own risk methodology so it lands cleanly in the existing enterprise risk register. Heat-map view for the Board Risk Committee.
RMiT 10.62 series — material outsourcing arrangements, cloud providers, fourth-party concentration risk.
12-month remediation roadmap with owner, effort estimate, target risk reduction — designed to map cleanly into the FI's existing portfolio governance.
Joint scoping with the CISO, CRO and Head of Technology Risk. Document review: prior TVRA, prior audit findings, RMiT self-assessment, risk appetite statement, outsourcing register, incident log.
Critical-systems inventory validated through interviews. Classification against the FI's own criticality scheme. Dependency mapping into supporting infrastructure and outsourcing arrangements.
Named threat-actor library. STRIDE modelling per critical system. MITRE ATT&CK technique mapping. Threat-intelligence feed cross-reference for sector-relevant TTPs.
Technical and non-technical vulnerability discovery. Existing pentest, BAS and audit evidence consolidated. Controls mapped to RMiT clauses with gaps surfaced.
Executive summary, methodology, asset inventory, threats, vulnerabilities, findings, treatment plan. Examiner-ready clause-mapped appendix. Board readout with Q&A pack pre-built.
Question: what cyber threats matter to this institution and how exposed are we?
Scope: institution-wide — people, process, technology, all critical systems.
Output: board-grade risk register, treatment plan, RMiT clause map.
Question: is this specific data-centre facility resilient to physical, environmental, operational and cyber risk?
Scope: a single facility — physical, electrical, mechanical, fire, environmental, BCP.
Output: facility risk register, tier mapping, remediation roadmap.
Most BNM-regulated institutions need both — TVRA at the institution level annually, plus a DCRA at each in-scope data centre roughly biennially.
Scoping calls take 30 minutes. A typical TVRA runs 4-8 weeks from kickoff to board readout.