BangladeshCyber Security Act, Computer Emergency Response Team, Duty to Report a Cyber Incident
Cyber Security Act, 2026 (Act No. 81 of 2026), s. 9
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived . Publisher's page: http://bdlaws.minlaw.gov.bd/act-details-1710.htmlIn force since .
A vulnerability and incident reporting rule binding public and private bodies.
- Obligation class
- Reporting
What it requires
- This binds a government, private, or autonomous organization or institution in Bangladesh, the Act's own general categories for essentially any actor rather than a licensed or sector-specific status, so an ordinary software distributor or app operator falls within it without needing a critical-infrastructure designation.
- Without delay after a cyber incident occurs, inform the National Computer Emergency Response Team the National Cyber Security Agency maintains; the Act names no fixed number of hours or days for this notification.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST CSF 2.0
- RS.CO-02Internal and external stakeholders are notified of incidents
- CIS Controls
- 17.2A maintained list of who to contact about a security incident, inside and outside the enterprise.
- FINOS AIGF
- AIR-DET-004AI System Observability
- AIR-DET-021Agent Decision Audit and Explainability
- ENISA NIS2 guidance
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.
Who enforces it
Enforcement body
The National Cyber Security Agency, through the National Computer Emergency Response Team it maintains under section 9(1)
Settledness
No implementing rules under section 49 had been made as of ; the Agency's own responsibilities and functions are also left to rules under section 5(4).
- As of
- Open questions
- Does the duty to inform the National Computer Emergency Response Team without delay under section 9(4) carry a penalty of its own, where no other offence provision in the Act names the same failure?
- Does "without delay" in section 9(4) resolve to a fixed reporting window once the Government makes rules under section 49, and on what clock?
What this law does
The Agency maintains a National Computer Emergency Response Team and a National Security Operation Center, and every entity the Government designates as Critical Information Infrastructure must maintain its own Computer Emergency Response Team or Computer Incident Response Team and Security Operation Center.
Any government, private, or autonomous organization or institution that experiences a cyber incident must, without delay, inform the National Computer Emergency Response Team under the Agency. The Act names no fixed number of hours or days for that notification. No provision of the Act states a penalty specific to a failure to give this notification.
The Act's own offences for unauthorized access to a computer system or to Critical Information Infrastructure bind the person, software developer, or artificial intelligence tool user who intrudes, and are recorded on this jurisdiction's scraping row.
When LexLint raises it
When your app profile says your app crawls the web, trains models, deploys a chatbot, sends automated outreach, makes high-risk automated decisions, processes voice recordings, processes biometric data, processes personal data, serves under-18s, operates a social platform, ships a mobile app, distributes a software product, runs an essential service, provides financial services, handles health records, provides telecom services, provides cloud services, provides a general-purpose AI model, is a frontier developer, is a listed company, generates content with AI, publishes adult content, operates an app store, reuses other publishers' content, records calls, records text chat or tracks devices.
Back to the example · Lint your app
Page updated .