BangladeshCyber Security Act, Critical Information Infrastructure Designation, Response Team and Audit Duties
Cyber Security Act, 2026 (Act No. 81 of 2026), ss. 9(2), 15 and 16
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived . Publisher's page: http://bdlaws.minlaw.gov.bd/act-details-1710.htmlIn force since .
A sector security regimes rule binding public and private bodies.
- Instrument type
- an act of a legislature
- Obligation class
- Security, Reporting, Governance
As of .
What it requires
- This binds the owner or operator of a computer system, network or information infrastructure that the Government has declared as Critical Information Infrastructure by notification in the official Gazette (reached by declaring that you operate an essential service); the Government updates the list at least once a year (section 15).
- Keep your own Computer Emergency Response Team or Computer Incident Response Team and your own Security Operation Center, and submit the Security Operation Center's report on its activities and performance indicators to the National Cyber Security Operation Center every quarter (section 9(2)).
- Audit your internal and external infrastructure every year in the manner the rules prescribe, submit the audit report to the National Cyber Security Council and inform the Director General of its contents (section 16(2)).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The National Cyber Security Agency, through its Director General, who monitors and inspects declared Critical Information Infrastructure under section 16(1).
Settledness
The Act names no penalty specific to a failure to keep the response team, file the quarterly report or submit the annual audit report.
- As of
- Open questions
- Which computer systems, networks or information infrastructure has the Government declared as Critical Information Infrastructure under section 15, since the Act leaves the declaration to Gazette notification?
- In what manner must a declared Critical Information Infrastructure carry out the annual audit in section 16(2), since the Act leaves the manner to rules?
What this law does
Section 15 of the Cyber Security Act, 2026 lets the Government declare any computer system, network or information infrastructure as Critical Information Infrastructure by notification in the official Gazette and requires it to update the list at least once a year. Section 9(2) of the Act requires each declared Critical Information Infrastructure to have its own Computer Emergency Response Team or Computer Incident Response Team and Security Operation Center.
Section 9(2) also requires every Security Operation Center to submit a report on its activities and performance indicators to the National Cyber Security Operation Center every quarter. Section 16(2) requires each declared Critical Information Infrastructure to audit its internal and external infrastructure every year in the manner the rules prescribe, submit the audit report to the National Cyber Security Council and inform the Director General of its contents.
Section 16(1) has the Director General monitor and inspect Critical Information Infrastructure from time to time to ensure that the Act is complied with. The Act defines Critical Information Infrastructure as physical or virtual information infrastructure declared by the Government that controls, processes, transmits or stores data.
When LexLint raises it
When your app profile says your app runs an essential service.