Bangladesh · Certification
ISO/IEC 27001 certification in Bangladesh
Achieve ISO 27001 certification in Bangladesh with Sterling: 8,100+ client engagements in 60+ countries, 20+ years.
- Accredited certification
- Mumbai office team
- Effivity software included
- Academy training included
Who asks for ISO 27001 in Bangladesh
Clients include
ISO 27001 certification in Bangladesh at a glance
Bangladesh Bank Guideline on ICT Security, Version 4.0 (2023) refers to ISO/IEC 27001, yet none of the Bangladeshi instruments checked makes it compulsory. Buyers in Bangladesh ask for it anyway.
For Bangladeshi banks, ISO 27001 is a response to a regulator's expectation; for BPO and software firms it is a response to a client's contract. Bangladesh Bank's ICT security guideline, version 4.0, tells institutions to obtain industry-standard certification in at least a few areas, with information system security first among its examples. April 2026 brought the Personal Data Protection Act, the National Data Management Act and the Cyber Security Act, which set duties on personal data and critical information infrastructure but create no certificate. An accredited certification body issues ISO 27001 against a defined scope, so ask which accreditation your clients accept. Sterling's Mumbai office helps with scoping, risk assessment, the Statement of Applicability, controls and internal audit, with Effivity software and Sterling Academy training included with the engagement.
Who needs ISO 27001 in Bangladesh, and what happens without it
In Bangladesh the question rarely comes from a law. It comes from the buyer, the regulator or the partner that wants proof before it signs. These are the organisations that get asked.
- Banks, non-bank financial institutions and mobile financial servicesBangladesh Bank's ICT security guideline tells institutions to obtain industry-standard certification in information system security and related areas.
- BPO, IT and software firms serving overseas clientsForeign clients commonly ask outsourcing suppliers for an accredited ISO 27001 certificate in the contract.
- Operators of critical information infrastructure and digital servicesThe Cyber Security Act, 2026 has a chapter on critical information infrastructure with security monitoring, inspection and audit.
- Any organisation holding customers' or employees' personal dataThe Personal Data Protection Act, 2026 sets processing and security duties for data-fiduciaries and processors.
Not sure which of these applies to you?Answer a short set of questions and your readiness report arrives by e-mail.
Take the ISO/IEC 27001 readiness checkISO 27001 requirements in Bangladesh
Strip away the vocabulary and ISO/IEC 27001 requires a company to prove six things about how it protects the information it holds.
In Bangladesh these six sit alongside the local laws and regulations listed under drivers below; one system can evidence both. The detail is on the global hub: ISO/IEC 27001 explained →
How to get ISO 27001 certified in Bangladesh
One team from the Mumbai office carries the work from scoping to certificate. Clients across Bangladesh are served from Sterling's Mumbai office, on-site where the work needs it and remotely otherwise.
- Discovery call and scopeEntities, locations, regulators and target date, agreed before any proposal.
- Gap assessment against ISO/IEC 27001 and the Bangladeshi requirements that apply to youControls you already run for your regulators and customers are reused, not rebuilt.
- Your system built with your team in EffivityRisks, controls, evidence, incidents and reviews in one live system the auditor can see.
- Internal audit, management review and corrective actionsYour internal auditors trained by Sterling; the evidence proven before the certification body arrives.
- Certification body stage 1 and stage 2, then surveillanceAn accredited body audits and decides. Sterling supports the audits and the three-year cycle.
- End to end, from one team
- Effivity ISO & GRC software
- Preferential Sterling Academy access, with complimentary awareness training for your people
- Internal auditor training for your audit team, as applicable to your standard
- Vulnerability assessment on ISMS engagements
The Sterling Promise: 100% on-time completion, 100% success, 8,100+ client engagements.Sterling does not certify. Certification decisions stay with independent bodies.
How long does ISO 27001 certification take in Bangladesh?
There is no standard duration: it depends on your scope and on how much of the system already runs. In Bangladesh these are the factors that set the timeline.
- Scope boundary: sites, systems, cloud services and outsourced providers
- Risk assessment and Statement of Applicability maturity
- Evidence from access control, logging and incident handling
- Certification body scheduling and client deadlines
Sterling agrees a dated plan with you on the discovery call, once the scope is known.
How much does ISO 27001 certification cost in Bangladesh?
The cost has two parts: the consulting work to build and prove the system, and the certification body’s audit fees, which are quoted separately. In Bangladesh these factors move both.
- Headcount, sites and number of systems in scope
- Gaps in technical controls such as logging, backup and endpoint protection
- Certification body audit fees quoted separately from consulting
- Penetration testing and awareness training
Sterling gives one customised, all-inclusive proposal after the discovery call, never before the scope is agreed.
ISO 27001 consultants and certification bodies in Bangladesh
Two different organisations are involved. A consultant helps you build the system and prove it works; an accredited certification body then audits or assesses it and decides. Keeping the two separate is what makes the result credible to buyers and regulators.
- Check that the body’s accreditation or approval covers ISO 27001 and your sector, and that its certificates can be verified online.
- Ask the consultant how the local requirements in Bangladesh are mapped into the same system, so nothing runs twice.
- Ask for client references in your sector; Sterling’s client letters are available on request.
- Agree who owns the evidence and the tool after the engagement; with Sterling the system stays yours, in Effivity.
Laws and regulations that drive ISO 27001 in Bangladesh (3)
| Instrument | How it treats the standard |
|---|---|
| Bangladesh Bank Guideline on ICT Security, Version 4.0 (2023) | Refers to / expects The organisation 'shall obtain industry-standard certification in at least a few areas (preferably all)', the first example being information system security; the clause names no standard. |
| Personal Data Protection Act, 2026 (Act No. 63 of 2026) | Context Duties on lawful processing, security and breach handling for data-fiduciaries and processors; it refers to independent data auditors and creates no certificate. |
| Cyber Security Act, 2026 (Act No. 81 of 2026) | Context A chapter on critical information infrastructure with security monitoring, inspection and audit; the Act cites no standard. |
Accreditation, audit language and remote audits in Bangladesh
Choose a certification body whose accreditation covers this standard and your sector: accreditation by the Bangladesh Accreditation Board (BAB) or by an accreditation body within the international mutual recognition arrangements (Global ACI — Global Accreditation Cooperation Incorporated, formerly the IAF MLA). Ask for the accreditation certificate and read its scope. Overseas clients often name the accreditation they accept, so ask them before you choose. Edition and transition details: ISO/IEC 27001 hub →
Audit language
Buyer standards, export documents and most management system records are in English, and Bangla is the state language under the Constitution; interviews with workers and supervisors are normally in Bangla. Agree the audit language, any interpreter and the language of controlled documents with the certification body at application.
Remote and on-site
Certification audits combine remote document and system walkthroughs with on-site visits to offices, data rooms and operations floors.
ISO 27001 in Bangladesh: questions clients ask
Does Bangladesh Bank require ISO 27001?
Not by name. Its ICT security guideline, version 4.0 of 2023, tells banks and financial institutions to obtain industry-standard certification in at least a few areas, preferably all, starting with information system security. Institutions should confirm with their supervisors which certificate satisfies the clause, and read the guideline's audit requirements alongside it.
Does the Personal Data Protection Act, 2026 require ISO 27001 certification?
No. The Act sets duties on lawful processing, security and breach handling and refers to independent data auditors, but it creates no certificate. ISO 27001 is a recognised way to run and evidence security controls. Confirm what the Act and the National Data Management Authority expect of your business with counsel.
What does the Cyber Security Act, 2026 mean for private companies?
It creates offences and a national agency, and it has a chapter on critical information infrastructure covering security monitoring, inspection and audit. Whether your systems fall within that infrastructure is for the Government to determine. Private firms mostly meet the Act through customers, regulators and contracts. Ask counsel whether any designation could apply to you.
Do overseas clients of Bangladeshi BPOs ask for ISO 27001?
Often, yes, as a contract condition for outsourcing suppliers handling their data. The requirement comes from the client, not from Bangladesh law. Ask the client which standard, scope and accreditation it accepts, since some also require evidence such as PCI DSS or SOC 2 on top.
More on ISO 27001 for Bangladeshi organisations
- ISO/IEC 27001: the complete guide
- Watch: How to implement ISO/IEC 27001
- Banking and financial services: ISO/IEC 27001 for the sector
- BPO and shared services: ISO/IEC 27001 for the sector
- Government and public sector: ISO/IEC 27001 for the sector
- Healthcare and health data: ISO/IEC 27001 for the sector
- Professional and legal services: ISO/IEC 27001 for the sector
- Software, SaaS and technology: ISO/IEC 27001 for the sector
- Telecoms and data centres: ISO/IEC 27001 for the sector
- ISO 27001 certification in Bangladesh and every other standard Sterling delivers there
Other standards Bangladeshi businesses ask Sterling for
Organisations in Bangladesh often combine ISO/IEC 27001 with one of these, under one management system where the scopes allow.
Start with a free discovery call from the Mumbai office
A Sterling consultant goes through your entities, your regulators and your target date with you. No proposal until the scope is agreed.
Sources
- Bangladesh Bank Guideline on ICT Security, Version 4.0 (2023) — bb.org.bd (accessed 11 Oct 2026)
- Personal Data Protection Act, 2026 (Act No. 63 of 2026) — bdlaws.minlaw.gov.bd (accessed 11 Oct 2026)
- Cyber Security Act, 2026 (Act No. 81 of 2026) — bdlaws.minlaw.gov.bd (accessed 11 Oct 2026)
- Bangladesh Accreditation Board (BAB) — ilac.org; iaf.nu (accessed 11 Oct 2026)
Talk to a consultant
Plan your certification with the Navi Mumbai team.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
india@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice