Security Compliance · Bangladesh

Security and Compliance for Your Bangladesh Operations

Pass client security audits, prepare for ISO 27001 or SOC 2, and meet Bangladesh’s cyber security and data protection laws, with written policies, working controls and the evidence auditors ask for.

Get a Security Gap Review
Call +880 1711-990020
SECURITY POSTUREILLUSTRATIVE
PoliciesAccessDataVendorsIncidentsPeople
BeforeAfter the programme

Definition

What Is Security and Compliance?

Security and compliance is the work of protecting your company’s systems and data with written policies and working controls, and proving it against the standards and laws that apply to you, such as ISO 27001, SOC 2, the Bangladesh Bank ICT Security Guideline, the Personal Data Protection Act 2026 and Bangladesh’s cyber security law.

Most frameworks ask for the same core controls. Build each control once, map it to every standard you need, and keep the evidence in one place.

Who usually needs it

  • 1Teams in Bangladesh serving foreign clients
  • 2Companies handling customer or payment data
  • 3Banks, MFS and fintech providers
ONE CONTROL, MANY FRAMEWORKS
ISO 27001
SOC 2
PDPA 2026
BB ICT
Access control
Encryption
Logging and monitoring
Incident response
Vendor management
Staff training
Privacy notices
ExpectedIf privacy is in scopeNot a core focus

Pick the right standard

Which Security Standard Does Your Business Need?

Find your situation on the board. Many companies need two or three at once, which is why mapping controls matters.

IF THIS IS YOUYOU NEEDNOTES
IFClients in the EU, UK or Asia ask for certification
ISO 27001
Certified by an accredited body
IFUS SaaS or tech clients send security reviews
SOC 2
Type I or Type II report by a CPA firm
IFYou store, process or transmit card data
PCI DSS
Version 4.0.1 requirements
IFYou are a bank, MFS or payment provider in Bangladesh
BB ICT GUIDELINE
Bangladesh Bank, version 4.0
IFYou handle personal data of people in Bangladesh
PDPA 2026
Personal Data Protection Act

Handling personal data? Read our guide to PDPO and data protection compliance. Need the employment side covered too? See labour law compliance in Bangladesh.

How controls work

Why One Control Is Never Enough

No single policy, tool or training session stops every incident. Good security programmes stack layers so that a gap in one is caught by the next, then keep records that prove each layer works.

That is also how auditors think. They test each layer and ask for evidence that it ran every month, not just on the day of the audit.

What we build into the layers

  • 1Policies people can follow
  • 2Training that changes behaviour
  • 3Technical controls with logs and alerts
THE SWISS CHEESE MODELPoliciesPeopleTechnologyMonitoringTHREATSTOPPED

Every layer has gaps. Enough layers, lined up well, stop the threat. Illustrative.

The route to audit

How We Get You Audit-Ready

Six camps from first review to a passed audit. We walk the whole route with you.

123456
  • 1
    Gap assessmentWhere you stand against the standard
  • 2
    PoliciesWritten rules people sign
  • 3
    ControlsAccess, backups, encryption, logging
  • 4
    EvidenceRecords that each control runs
  • 5
    Internal auditA dry run before the real one
  • 6
    AuditCertification or attestation

Illustrative path. The time between camps depends on your size and how much is already in place.

FAQs

Security and Compliance: FAQs

It means protecting your systems and data with written policies and working controls, then proving it against the standards and laws that apply to you, such as ISO 27001, SOC 2, the Bangladesh Bank ICT Security Guideline and the Personal Data Protection Act 2026.

No general law makes ISO 27001 certification mandatory. Foreign clients, tenders and partners often require it, and regulated sectors such as banking follow their own rules, like the Bangladesh Bank ICT Security Guideline.

ISO 27001 is an international standard for an information security management system, certified by an accredited body. SOC 2 is a US attestation report by a CPA firm against the AICPA Trust Services Criteria: security, availability, processing integrity, confidentiality and privacy.

The main ones are the cyber security law, which began as the Cyber Security Ordinance 2025 replacing the Cyber Security Act 2023, the Personal Data Protection Act 2026 for personal data, and the Bangladesh Bank ICT Security Guideline for banks and financial service providers.

It depends on your size and what is already in place. A SOC 2 Type II report also needs an observation period, often between three and twelve months, during which your controls must run and be evidenced.

The 2022 version reorganised Annex A into 93 controls under four themes and added 11 new controls, including threat intelligence, cloud services security and data leakage prevention. The transition period for certificates under the 2013 version ended on 31 October 2025.

No Bangladesh law requires a security officer for most companies, but every standard expects a named owner. Under the Personal Data Protection Act 2026, significant data fiduciaries will also need a Chief Data Officer.

We collect your existing policies and evidence, answer each question accurately, flag the gaps a client is likely to challenge, and build a reusable answer library so the next questionnaire takes hours rather than weeks.

  • Policies reviewed
  • Access controls mapped
  • Vendors listed
  • Evidence gaps found

Know Your Security Gaps Before Your Client Does

Send us the standard or questionnaire your client is asking for. We will review your current policies and controls, show the gaps by risk and quote a fixed fee to get you audit-ready.

Get a Security Gap Review
Email [email protected]