Mandatory cyber security posture roadmap for all scheduled commercial banks, financial institutions (FIs), and MFS operators in Bangladesh. Comply before the strict 31 December 2026 enforcement deadline.
All scheduled commercial banks, financial institutions (FIs), and MFS providers must achieve full alignment before this regulatory cutoff.
The 8 Mandatory Framework Domains
Every scheduled institution must demonstrate documented, validated controls across all 8 dimensions.
Governance & Board Oversight
Establishes institutional accountability. Requires formal Board Cyber Risk Committee charters, direct reporting authority for the Chief Information Security Officer (CISO), an approved enterprise cyber risk appetite, and annual third-party independent posture audits.
Asset Identification & Classification
Comprehensive inventorying of all Critical Information Infrastructure (CII) nodes, core banking application switches, and SWIFT enclaves. Enforces strict cryptographic protection for customer NID, biometric records, and cardholder data both at rest and in transit.
Privileged Access Management (PAM)
Strict eradication of standing root and domain administrator privileges. Enforces centralized PAM vaults, dual-authorization (maker-checker) for core database modifications, session keystroke recording, and mandatory phishing-resistant MFA.
Network Defense & Micro-Segmentation
Micro-segmentation between corporate user VLANs and core banking / payment switch infrastructure. Deploys line-rate Network Detection and Response (NDR) to detect and isolate lateral worm propagation in sub-second timelines.
Continuous 24/7 SOC & Threat Hunting
Mandates uninterrupted 24/7 security operations monitoring with automated alert correlation across endpoints, servers, and perimeter firewalls. Integrates threat intelligence on South Asian financial threat actors with hypothesis-driven threat hunting.
Bi-Annual VAPT & Adversary Simulation
Scheduled comprehensive Vulnerability Assessment & Penetration Testing (VAPT) across all web applications, mobile banking apps, APIs, and network enclaves at least every six months. Includes realistic adversary simulation mapped to MITRE ATT&CK.
Cyber Resilience & Immutable Backups
Guarantees ransomware survival through offline, air-gapped immutable backup repositories. Requires pre-contracted emergency incident response retainers with guaranteed 1-hour remote response SLAs and annual tabletop crisis rehearsals.
Third-Party & Vendor Risk Governance
Rigorous vetting of third-party software vendors, payment gateway aggregators, and core banking integrators. Mandates contractual liability clauses, API security audits, and continuous supply-chain vulnerability monitoring.
Bangladesh Bank Cybersecurity Readiness Diagnostic
Evaluate your institution against the 8 core regulatory domains of the Bangladesh Bank Cybersecurity Framework v1.0. Answer each domain below to generate your executive gap analysis.
Does your institution maintain a dedicated Board Cyber Risk Committee and conduct independent annual third-party security audits?
Mandates board-level oversight, designated CISO reporting line, and formal cyber risk appetite statement.
Are all critical information infrastructure (CII) assets, core banking subnets, and customer PII fully inventoried and encrypted?
Requires cryptographic isolation of cardholder data, NID records, and SWIFT message store.
Is PAM deployed with mandatory multi-factor authentication (MFA) and dual-authorization for database & switch access?
Zero standing domain admin privileges. Session recording and just-in-time credential checkout required.
Is core banking traffic cryptographically micro-segmented from general corporate IT with line-rate packet inspection?
Precludes lateral attacker traversal from compromised staff workstations to payment switches.
Is your telemetry monitored 24/7/365 by an active SOC with proactive threat hunting and sub-15 minute triage?
Requires continuous SIEM/XDR correlation and direct escalation protocols to on-call responders.
Do you execute comprehensive Penetration Testing (VAPT) across web, mobile, network, and APIs at least twice a year?
Must include grey-box API switch testing, privilege escalation, and red-team adversary emulation.
Are off-site immutable air-gapped backups maintained alongside a pre-contracted emergency incident response retainer?
Ransomware protection requires write-once-read-many (WORM) storage and guaranteed 1h remote response SLAs.
Are all third-party software vendors, MFS aggregators, and cloud providers audited against strict supply-chain criteria?
Enforces vendor background screening, API security benchmarks, and contractual liability clauses.
Our 4-Step Framework Alignment Roadmap
From initial baseline gap analysis to official regulatory filing, we walk alongside your security and IT teams.
Baseline Gap Assessment
On-site and remote diagnostic audit comparing current bank controls against all 8 regulatory domains. Delivers executive risk scorecard and gap roadmap.
Technical Hardening & VAPT
Full-scope penetration testing of core banking, payment switches, and mobile apps. Micro-segmentation and PAM access policy rule tuning.
24/7 SOC Telemetry & IR Retainer
Integration with customer SIEM / Wazuh sensors. 24/7 continuous threat monitoring and binding sub-15 minute P1 emergency response SLA activation.
Dossier & Central Bank Filing
Delivery of board-ready compliance dossiers, independent audit verification certificates, and continuous readiness tracking ahead of the Dec 31, 2026 cutoff.
Whether you're hardening defenses, preparing for an incident, or in the middle of one, the first call is the same.