Bangladesh Cybersecurity Frameworks: Critical Information Infrastructure and Compliance

As Bangladesh accelerates its digital economic transformation—spanning digitized government services, nationwide optical fiber backbones, rapid financial technology (Fintech) adoption, and centralized banking platforms—the protection of electronic systems has become a national security imperative [1, 2].

In response to sophisticated global cyber threats targeting critical infrastructure, the Government of Bangladesh established statutory frameworks and institutional oversight bodies—led by the ICT Division and BGD e-GOV CIRT (Bangladesh Computer Council)—to mandate rigorous security baselines across designated Critical Information Infrastructure (CII) [1, 2]. In this technical analysis, we dissect the statutory criteria defining Critical Information Infrastructure, examine BGD e-GOV CIRT operational directives, review mandatory technical controls, and provide compliance guidelines for enterprises [1, 2, 3].

1. What Is Critical Information Infrastructure (CII)?

Under statutory definitions established by the Government of Bangladesh and the ICT Division, Critical Information Infrastructure refers to [1, 2]:

Any physical or virtual information system, network, or electronic database whose disruption, incapacitation, or destruction would have a debilitating impact on national security, the economy, public health, or sovereignty.

The government officially designated 29 key institutions across banking, telecommunications, energy, civil aviation, law enforcement, and national revenue as statutory CII entities [1, 2].

+-------------------------------------------------------------+
|               Designated CII Sectors in Bangladesh          |
+-------------------------------------------------------------+
   1. Central Banking & Commercial Financial Networks
   2. Telecommunication Service Providers & Submarine Cable Landings
   3. Electrical Power Grid, Generation & SCADA Distribution
   4. Civil Aviation, Port Authorities & Transport Logistics
   5. National Identity (NID), Revenue & Citizen Databases

2. Institutional Architecture: The Role of BGD e-GOV CIRT

The central operational entity coordinating national cyber defense is the Bangladesh Computer Emergency Response Team (BGD e-GOV CIRT), housed within the Bangladesh Computer Council under the ICT Division [1, 2]:

• Incident Response & Triage: CIRT serves as the national focal point for receiving, analyzing, and coordinating responses to high-severity cybersecurity incidents impacting public and private infrastructure [1].
• Threat Intelligence & Early Warning: Continuously monitors national IP space, publishing threat advisories regarding active ransomware variants, banking Trojan campaigns, and critical zero-day vulnerabilities [1].
• National Vulnerability Assessment: Conducts systematic vulnerability assessments and penetration testing (VAPT) across government digital services and CII installations [1].

3. Mandatory Technical Controls for CII Compliance

Organizations operating within or providing digital services to designated CII sectors must implement standardized technical controls aligned with BGD e-GOV CIRT directives and ITU recommendations [1, 3]:

1. Network Boundary Isolation and Micro-Segmentation

• Complete OT/IT Separation: Industrial SCADA and control networks governing power stations, water distribution, and telecommunications switching fabrics must be physically and logically separated from corporate business networks using industrial firewalls [1, 3].
• Default-Deny Ingress/Egress: Strict perimeter firewalls dropping unsolicited inbound connections and blocking unauthorized outbound data exfiltration ports [1].

2. Security Operations Center (SOC) & Telemetry Logging

• Mandatory 24/7 Security Monitoring: CII entities must operate or engage a 24/7 Security Operations Center monitoring centralized Security Information and Event Management (SIEM) telemetry [1].
• Immutable Log Retention: System access logs, authentication attempts, database queries, and firewall telemetry must be retained in secure, tamper-evident storage for a minimum of 12 months to facilitate forensic investigations [1].

3. Phishing-Resistant Identity and Access Controls

• Mandatory Multi-Factor Authentication: All remote administrative access, webmail systems, and database portals must enforce multi-factor authentication (MFA), prioritizing phishing-resistant hardware tokens [1].
• Privileged Access Management (PAM): Standing root and domain administrator privileges are prohibited; administrative sessions must be granted just-in-time with full keystroke session recording [1].

4. Vulnerability Management & Incident Reporting SLAs

• Periodic VAPT Audits: Annual third-party vulnerability assessments and penetration tests conducted by accredited cybersecurity auditors [1].
• Mandatory Incident Notification: Critical security incidents (data breaches, active ransomware detonations, or unauthorized system access) must be formally reported to BGD e-GOV CIRT within statutory reporting windows (typically within 24 hours of discovery) [1].

Bangladesh Cybersecurity Compliance Matrix

Practical Implementation Steps for Enterprises

For commercial organizations operating in Bangladesh seeking to align with national cybersecurity standards:

1. Perform a Gap Analysis Against CIRT Guidelines: Audit your internal network architecture, password policies, and log retention against published BGD e-GOV CIRT baseline controls [1].
2. Implement Automated Link & Vulnerability Monitoring: Deploy automated scanning tools to detect exposed ports, expired TLS certificates, and unpatched web application dependencies [1, 2].
3. Establish Incident Response Playbooks: Document and simulate technical escalation procedures: who authorizes taking a compromised server offline, who communicates with CIRT, and how backups are restored securely [1, 3].

To design compliant network defense architectures, conduct security audits, and deploy perimeter protection, explore our capabilities on our Cyber Security Solutions page.

Key Takeaways

• Bangladesh has designated 29 key institutional sectors as Critical Information Infrastructure (CII).
• BGD e-GOV CIRT operates as the national focal point for cyber incident response, threat alerts, and VAPT audits.
• CII compliance mandates 24/7 telemetry monitoring, 12-month immutable log retention, and complete OT/IT network isolation.
• Organizations must establish formal incident reporting procedures to report major cybersecurity breaches to CIRT.

Need help with this? Contact us.

Sources

[1] Bangladesh Computer Council (BCC), "BGD e-GOV CIRT National Cybersecurity Guidelines and Directives", 2023. URL: https://www.cirt.gov.bd (Official national computer emergency response team standards, threat alerts, and technical compliance guidelines).

[2] Information and Communication Technology Division, "ICT Division, Government of Bangladesh Official Directives", 2023. URL: https://ictd.gov.bd (Official national policies, institutional frameworks, and digital governance mandates).

[3] International Telecommunication Union (ITU), "ITU National Cybersecurity Strategy Guidelines", 2021. URL: https://www.itu.int (Authoritative international benchmark framework for national critical infrastructure protection and emergency response coordination).

Last reviewed: October 2026