Bangladesh Bank Cybersecurity Framework 2026: Complete Compliance Guide for Banks, FIs, MFS, PSPs & PSOs

Bangladesh Bank has made its new Cybersecurity Framework, Version 1.0 (2026) mandatory for every bank, finance company, MFS provider, PSP and PSO in the country, and compliance is due by 31 December 2026.

Bangladesh Bank Cybersecurity Framework 2026 at a glance

The framework is not a slogan. It sets hard numbers: critical incidents reported within 72 hours, critical patches within one month, penetration testing at least once a year, and access removed within 24 hours of an employee leaving. With only weeks left before the deadline, this guide explains what the framework requires and how to get ready in time.

What is BRPD Circular No. 02 (2026)?

BRPD Circular No. 02, dated 29 March 2026, is the Bangladesh Bank instruction that issues the Cybersecurity Framework, Version 1.0 (2026) and makes it binding on regulated financial institutions.

The circular's reasoning is simple. Online services, digital platforms, cloud-based services and interconnected networks have made financial services faster and easier. The same shift has sharply increased cyber risk. Bangladesh Bank names cyber attacks, hacking, phishing, malware, ransomware and data theft as threats that can cause financial loss, reputational damage and service disruption.

To protect the confidentiality, integrity and availability of data, and the stability of each institution's technology, Bangladesh Bank says a strong cybersecurity framework is now essential. The framework covers:

• Cybersecurity governance
• Cyber risk management
• Information and data protection
• Network and infrastructure security
• Access control
• Threat monitoring and incident management
• Third-party and outsourcing risk management
• Cybersecurity audit and compliance
• Training and awareness

The framework was prepared by a technical committee chaired by Bangladesh Bank's Executive Director (ICT), with officials from Bangladesh Bank's ICT, Cyber Security Unit, payment systems, regulation, law and risk departments, plus CISOs and technology heads from several commercial banks.

Who must comply?

Every financial or payment service provider regulated by Bangladesh Bank must comply. The framework calls all of them together "The Organization":

• Scheduled banks
• Financial institutions / finance companies
• Mobile Financial Service Providers (MFSPs)
• Payment Service Providers (PSPs)
• Payment System Operators (PSOs)
• Other financial and payment service providers

The framework sets a minimum baseline, not a ceiling. It does not recommend any specific product, vendor, service arrangement or deployment model. Each institution must do its own analysis of how the framework fits its strategy, risks and regulatory duties.

Vendors matter too. Suppliers, cloud providers, outsourcing partners and fintechs that serve these institutions will feel the framework through contracts, audits and assessments, because institutions must hold third parties to the same security outcomes.

Deadline, legal basis and standards

Compliance with the framework must be ensured by 31 December 2026.

Bangladesh Bank issued the circular under three laws:

• Section 45 of the Bank Company Act, 1991 (amended up to 2023)
• Section 41(2)(gha) of the Finance Company Act, 2023
• Section 18(4) of the Payment and Settlement Systems Act, 2024

The framework follows the structure of the NIST Cybersecurity Framework. Its controls are mostly drawn from ISO 27001, Bangladesh's national ICT security policies, Bangladesh Bank's ICT Security Guideline and other international standards such as PCI DSS.

Two rules settle conflicts. If a framework control conflicts with a Government Act, law or policy, the Government instrument prevails. If it conflicts with an existing Bangladesh Bank circular or guideline, the institution can ask Bangladesh Bank to resolve it.

Bangladesh Bank calls the framework a living document and says it will review it from time to time.

The 7 core functions of the framework

The framework organises every requirement under seven functions: the NIST functions plus a dedicated Reporting function.

Govern frames the whole programme; the other six functions run as a cycle, with lessons from Reporting feeding back into Identify.

Key requirements, function by function

1. Preparation & Govern: CISO, CIRT and board ownership

Cybersecurity is now a board and top-management responsibility, with a named CISO and a formal incident team.

• CISO: the institution must recruit a qualified Chief Information Security Officer, with approved staff and a sufficient budget. The CISO should hold industry-accepted academic and professional certifications.
• Top management must make sure controls are in place, fund qualified technical staff, and review controls periodically. ICT security management also covers audits, training and insurance or a risk coverage fund.
• Cyber Incident Response Team (CIRT):
  • Cyber Incident Management Leader: the MD or a delegate; makes critical business decisions and is the only one (or their designee) who speaks to the media.
  • Cyber Incident Management Coordinator: Head of ICT / CITO; coordinates divisions and leads recovery.
  • Cyber Incident Response Team Leader: Head of Information Security / CISO; single point of contact for all cyber incidents.
  • Team members: supervisors of divisions and units, with emergency contacts for the team, vendors and service providers.
• Policies, procedures and processes must be documented and kept consistent even when key people leave.
• Training: periodic security training for all staff, role-based training for privileged users and executives, awareness for vendors, and professional certifications (for example CISSP, CISM, CISA, CEH, OSCP, CRISC, CCSP) for the security team.
• Self-assessment against the framework can be done internally or by a third party.

Escalation runs top-down from the MD, while every user reports cyber incidents to the CISO first.

2. Identify: assets, risks, suppliers, cloud and people

• Keep an inventory of all information assets with model, location, serial number, classification and purpose, reviewed regularly.
• Classify data under the institution's ICT Risk Management Framework.
• Define the three lines of defence: business/IT management, risk management and internal audit.
• Run regular, comprehensive cyber risk assessments covering people, processes, data and technology, and periodic configuration assessments of hardware, software, network and cloud.
• Collect cyber threat intelligence from information-sharing forums.
• Supplier risk: contract security obligations, assess suppliers through audits and test results, and test response and recovery plans with them.
• Cloud risk: have a cloud strategy, audit the cloud provider, sign a security SLA, and follow Bangladesh Bank's Guideline on Cloud Computing.
• Insider risk: screen staff at hiring (identity, qualifications, past employment, civil or criminal proceedings, conflicts of interest, credit) and re-screen periodically; monitor employee behaviour.
• Logs: log user activity, exceptions and security events; review privileged-user activity independently; synchronise clocks; protect logs from tampering; and make sure administrators cannot erase or disable logs of their own activity.

3. Protect: access, infrastructure, software and data

• Formal user registration, de-registration and access provisioning; a centralised AAA mechanism; least privilege and separation of duties.
• Multi-factor authentication for all non-console administrative access and all remote access.
• Account lockout after failed logins, strong password management and regular access reviews.
• Network segmentation, a senior-management-approved network design, baseline standards for network devices, and backup and review of security-device rules.
• SSH for device administration; Telnet and other unencrypted logins disabled.
• DNS protection, plus SPF, DKIM and DMARC for email.
• Automatic detection and blocking of unauthorised network access, and fast isolation of compromised devices.
• USB mass-storage read/write disabled on end-user laptops and desktops, except short, approved exceptions.
• Application whitelisting, licensed software only, controlled installation and restricted source-code access.
• A separate test environment, a secure development lifecycle, and real-time backup for critical and core applications.
• Critical security patches installed within one month of release, after testing.
• Data classified as Public, Internal, Confidential or Restricted; sensitive data encrypted at rest and in transit, including end-to-end encryption; laptops and desktops with sensitive data encrypted.
• Secure key management, with no single person knowing a full key.
• Data Leak Prevention (DLP), a data retention and disposal policy, and the 3-2-1 backup rule (three copies, two media, one off-site) with a dedicated backup owner.
• Regular vulnerability assessments, penetration tests and compromise assessments (see the VAPT section below).
• 24/7 monitoring of the data centre and Disaster Recovery Site.

4. Detect: monitoring and anomaly detection

• Define normal baselines, aggregate and correlate events from many sources, and set incident alert thresholds.
• Centralise audit logs, including DNS query, URL request and command-line (PowerShell, Bash) logs where supported.
• Detailed logging on assets that hold sensitive data, with enough detail for forensics.
• Host-based and network intrusion detection, EDR, approved anti-virus and behaviour-based anti-malware, and automatic scanning of removable media.
• A centralised security alerting system and a log analytics platform with correlation rules.
• Monitoring of personnel, the physical environment, external service providers and unauthorised devices or software, including deep and dark web monitoring of service providers.
• Regular protection of public-facing web applications against new threats.

5. Respond: SOC, CIRT and incident handling

• Documented response plans, severity levels and regular incident response drills with internal and external teams.
• An Information Security Operation Center (ISOC) with 24/7 identification and response capability.
• A Cybersecurity Incident Reporting (CSIR) system, a CIRT with written terms of reference, and an incident investigation team.
• Internal and external communication plans, including pre-scripted messages for customers, critical service providers, BGD e-GOV CIRT and Bangladesh Bank.
• Firewall and router standards: approved changes, current network and data-flow diagrams, a firewall at every internet connection and DMZ, and east-west as well as north-south traffic inspection.
• Daily review of security events and of logs for critical systems, security devices and anything that handles cardholder or sensitive authentication data.
• Alignment of SOC, incident response and digital forensics to reduce downtime.

6. Recover: resilience and continuity

• Tested recovery processes, BCP/DRP capabilities and recovery time objectives that also cover vendors and partners.
• Insurance coverage or a risk coverage fund for losses from cyber attacks.
• A documented strategy for ransomware and cyber extortion, data destruction and DDoS.
• A clear threshold between a security event and an incident.
• Automated backups, an isolated copy of recovery data, and regular restore tests.
• KPIs for continuous improvement, such as Mean Time to Detect (MTTD), Mean Time to Respond (MTTR), reduction of critical vulnerabilities, and training completion rates.
• Coordinated communication with the regulator for major or critical incidents.

7. Reporting: 72-hour reporting, audits and lessons learned

• Critical cyber incidents must be reported within 72 hours of occurrence to internal stakeholders (business units, senior management, board) and external stakeholders (customers, critical service providers, BGD e-GOV CIRT, Bangladesh Bank).
• A cybersecurity audit at least once a year and after any breach, by an external firm or an internal team. It should cover data, operational, network, system and physical security.
• Post-incident reviews that answer what happened, whether procedures worked, and what would prevent a repeat.
• Lessons the framework spells out: do not leave known risks open because another layer exists, never rely on MFA alone, keep backups, and remember that paying a ransom does not guarantee data will be returned.

Every deadline and frequency in one table

These are the hard timelines auditors will check. Clause numbers refer to the framework.

Passing on 31 December is only the start; these recurring tasks are what keep an institution compliant through 2027.

Required security technologies

The framework lists the security solutions institutions shall implement and monitor through their SOC. Bangladesh Bank says the list is illustrative, not exhaustive.

The framework requires automated updates for these tools. Owning a tool is not enough: it must be monitored, tuned and evidenced.

Is penetration testing mandatory? What the framework says about VAPT

Yes. Vulnerability assessment and penetration testing (VAPT) is mandatory at least once a year and after every significant change. The framework treats testing as continuous evidence of security, not a one-time checkbox.

For most institutions, the in-scope attack surface now includes internet banking, mobile apps, APIs, payment gateways, cloud workloads and internal networks, not just the main website. Our VAPT services in Bangladesh page explains how these engagements are scoped.

When choosing an external auditor, the framework advises finding a capable and affordable firm, setting clear expectations, sharing accurate information, and implementing the recommended fixes.

A 7-week compliance roadmap to 31 December 2026

There are about seven weeks left. An institution that starts now can still reach a defensible position by the deadline if it works in this order:

1. Week 1: Gap assessment. Map current controls against every clause and the framework's own Appendix C checklist. Confirm the CISO, the CIRT and its terms of reference, and board ownership.
2. Week 2: Inventory and risk. Update the asset and software inventory, classify data, and refresh the cyber risk register and risk appetite.
3. Weeks 2–4: Quick wins. Enforce MFA on all admin and remote access, disable Telnet, set SPF/DKIM/DMARC, block USB storage, set account lockout, and clear any critical patches older than one month.
4. Weeks 3–5: Test. Run VAPT on internet banking, mobile apps, APIs, payment interfaces, cloud and internal networks, plus a compromise assessment and configuration reviews. Fix critical and high findings, then retest.
5. Weeks 4–6: Logging and monitoring. Close SIEM coverage gaps, add DNS, URL and command-line logs, set retention, write the daily review procedure, and make sure admins cannot delete their own logs.
6. Week 6: Response and recovery. Run an incident response tabletop exercise, finalise the 72-hour reporting playbook and message templates, and complete a backup restore test.
7. Week 7: Evidence and sign-off. Get policies approved, assemble the evidence pack (reports, logs, minutes, test results), and present the status to the board before 31 December.

The workstreams overlap on purpose: quick wins, testing and logging run in parallel so the evidence pack is ready in the last week of December.

The framework is a baseline. After the deadline, the recurring cycle of daily log review, quarterly firewall reviews and restore tests, and annual VAPT and audit is what keeps an institution compliant.

Common compliance gaps to avoid

Most failures are not missing tools. They are missing evidence, missing scope, or controls that exist only on paper.

• Policies without proof. A policy says logs are reviewed daily, but there is no record of anyone reviewing them.
• Partial MFA. MFA protects VPN users but not server, database or cloud admin consoles.
• Narrow test scope. Only the public website is tested, while mobile apps, APIs and payment interfaces are skipped.
• Untested backups. Backups run every night but have never been restored.
• Unchecked vendors. Cloud providers, fintech partners and outsourced developers have no security clauses, SLA or assessment.
• Admins who can erase their tracks. System administrators can disable or delete logs of their own actions.
• Slow offboarding. Former staff and vendors keep access for weeks instead of the 24-hour target.
• No 72-hour playbook. Nobody knows who reports to Bangladesh Bank and BGD e-GOV CIRT, or what to say.
• A CISO in title only. The role exists but has no team, budget or authority.

How PentesterSpace helps you comply

PentesterSpace is a Dhaka-based penetration testing and cybersecurity firm. We help banks, finance companies, MFS providers, PSPs and PSOs produce the testing and evidence this framework asks for.

Every engagement ends with a regulator-ready report: findings mapped to framework clauses, risk ratings, clear fixes, and a retest to prove closure. CREST-certified delivery is available through our accredited partner.

Have weeks, not months, before 31 December? Book a free framework readiness call with our team, or share your scope through the Get started form.

• Email: contact@pentesterspace.com
• Phone: +880 1765-323081
• Office: ICT Tower, Agargaon, Dhaka 1207

PentesterSpace is an independent firm. This article is not endorsed by Bangladesh Bank, and the framework itself does not recommend any specific service provider.

Frequently asked questions

What is the Bangladesh Bank Cybersecurity Framework 2026?

It is Bangladesh Bank's Cybersecurity Framework, Version 1.0 (2026), issued through BRPD Circular No. 02 on 29 March 2026. It sets the minimum cybersecurity baseline for regulated financial institutions, organised under seven functions: Preparation & Govern, Identify, Protect, Detect, Respond, Recover and Reporting.

What is the compliance deadline?

Institutions must ensure compliance by 31 December 2026.

Who has to comply?

Scheduled banks, finance companies, Mobile Financial Service Providers, Payment Service Providers, Payment System Operators and other financial service providers regulated by Bangladesh Bank.

Is penetration testing mandatory under the framework?

Yes. Internal and external vulnerability assessment and penetration testing must be done at least once a year and after any significant infrastructure or application change. The framework also calls for compromise assessments.

How quickly must a cyber incident be reported?

Critical cyber incidents must be reported within 72 hours of occurrence, to internal stakeholders and to external ones including Bangladesh Bank and BGD e-GOV CIRT.

Does every institution need a CISO?

Yes. The institution shall recruit a qualified CISO and approve the people and budget the role needs.

Is a Security Operations Center required?

Yes. The framework requires an Information Security Operation Center with 24/7 identification and response capability.

Can the annual cybersecurity audit be done by an outside firm?

Yes. The audit can be done by an external cybersecurity company or an internal team, at least once a year and after any security breach.

How fast must critical patches be installed?

Within one month of release, after testing.

Which standards is the framework based on?

It follows the NIST Cybersecurity Framework structure, with controls mostly drawn from ISO 27001, national ICT security policies and Bangladesh Bank's ICT Security Guideline.

Whom should institutions contact with implementation questions?

The ICT Audit, Inspection & Compliance Wing of Bangladesh Bank's Information and Communication Technology Department.

Conclusion

The Bangladesh Bank Cybersecurity Framework 2026 turns cybersecurity from good practice into a regulatory duty with a fixed date: 31 December 2026.

The institutions that pass will not be the ones with the most tools. They will be the ones that can show a named CISO, a working SOC, tested backups, current VAPT reports, closed findings and a 72-hour reporting plan, with evidence for each. Start with a gap assessment, test what attackers can actually reach, and build the evidence pack while there is still time.

Sources

• Bangladesh Bank, BRPD Circular No. 02 (29 March 2026) and Cybersecurity Framework, Version 1.0 (2026)

This article summarises the framework for general information. It is not legal or regulatory advice. Always refer to the original circular and to Bangladesh Bank for authoritative guidance.

← All articles