Bangladesh

Bangladesh Bank ICT Security Guideline

The Guideline on ICT Security for Banks and Non-Bank Financial Institutions is issued by Bangladesh Bank and binds every bank, non-bank financial institution and, through them, the payment and mobile financial service providers in Bangladesh. It sets requirements for ICT governance, information security management, ICT operations and infrastructure, data centres, business continuity, system acquisition and development, and the security of alternative delivery channels, and Bangladesh Bank inspects compliance.

The inspection asks for evidence that each area is controlled. DECIMA keeps that evidence current every day, not the week before the inspector arrives.

At a glance

Issued by

Bangladesh Bank, the central bank of Bangladesh

Applies to

Scheduled banks and non-bank financial institutions in Bangladesh, and the payment, mobile financial service and outsourcing providers that serve them

In force

Issued 2005 and revised since; institutions comply with the current version

Supervised by

Bangladesh Bank, through scheduled and special ICT inspections

What the mandate requires

The obligations as the regulation states them, in the order a programme meets them.

1. 01

   ICT governance

   Board and management oversight of ICT, an ICT security policy, defined roles including an information security function, risk management and ICT audit.

2. 02

   Information security management

   Access control, user and privileged account management, password and authentication standards, network and endpoint security, malware protection, cryptography and data classification.

3. 03

   ICT operations and infrastructure

   Change and patch management, capacity and performance monitoring, logging and monitoring, physical and environmental security of data centres and disaster-recovery sites.

4. 04

   Business continuity and disaster recovery

   A tested business continuity plan, a disaster-recovery site and recovery objectives for critical systems, with regular drills recorded.

5. 05

   Alternative delivery channels

   Security of internet banking, mobile financial services, ATMs, cards and payment gateways, including fraud monitoring and incident reporting to Bangladesh Bank.

How DECIMA evidences it

Each requirement is answered from live systems with a dated, re-verifiable record, not from a questionnaire completed for the assessment.

• Control areas read continuously

  Access, patching, logging, backup, network and data-centre controls are read from the systems that operate them on a schedule, each read stored with its timestamp and the guideline version applied.

• Inspection pack produced from the record

  The evidence set for a Bangladesh Bank inspection is generated area by area from dated reads, in the order the inspection follows, rather than assembled in the days before the visit.

• Incidents recorded and reported

  Security incidents on delivery channels are classified from the evidence DECIMA holds and the report to Bangladesh Bank is drafted from that record.

• ICT audit trail kept

  Every verdict, exception and remediation is retained with its timestamp, so internal ICT audit and the inspection review the same record.

04

Questions buyers ask

Short answers you can quote.