Many owners of mid-size businesses still think of cybersecurity as a concern for banks and large corporations. Yet the incidents that hurt ordinary companies are rarely sophisticated. A finance officer replies to an email that appears to come from a supplier with new bank details. A shared password for the accounts system is used by someone who left last year. A laptop with the only copy of the costing files stops working, or a server is locked by ransomware and there is no recent backup.
None of these require an expensive security programme to prevent. They require a handful of basic controls, applied consistently. This article sets out ten of them, explains where the legal landscape in Bangladesh stands, and gives you a short checklist to review with your IT team.
The legal picture: changing, and worth watching
Bangladesh's cyber and data laws have changed significantly in a short period, and some details are still being settled. At the time of writing, based on the sources listed at the end:
- Cyber security. The Cyber Security Ordinance, 2025 was gazetted on 21 May 2025 and took effect immediately, cancelling the Cyber Security Act, 2023. In June 2026, Parliament passed a Cyber Security (Amendment) Bill, 2026, focused mainly on the removal of harmful AI-generated content from social media platforms.
- Personal data protection. A Personal Data Protection Ordinance was issued in late 2025. In April 2026, Parliament passed the Personal Data Protection Bill, 2026 as part of its review of ordinances made by the interim government. Summaries of the resulting Act describe obligations to protect personal data, to notify the authority of serious breaches within a timeframe to be set by regulations, and administrative fines for failing to provide required protection and security.
Regulations, guidance and enforcement practice are still developing, so treat this as a current snapshot rather than settled law, and take legal advice on your specific obligations. The practical message, though, is already clear: holding personal data about employees, customers and suppliers now comes with explicit responsibility for keeping it secure.
Most businesses are not breached by brilliant attackers. They are breached through a reused password, a convincing email or a backup nobody tested.
Ten controls that cover most of the risk
1. Know what you have
Keep a simple register of your systems, devices and where important data lives: accounting, payroll, email, file shares, cloud services, and the laptops and phones that access them. You cannot protect what you have not listed.
2. Turn on multi-factor authentication
Enable a second factor, such as an authenticator app, for email, accounting, banking, cloud storage and remote access. This one step defeats most attacks that rely on stolen passwords. Start with directors, finance and IT administrators.
3. One person, one account
Stop sharing logins. Every user gets their own account with only the access their role needs. Shared accounts make it impossible to know who did what, and impossible to remove one person's access cleanly.
4. Joiners, movers and leavers
Have a written process, owned jointly by HR and IT, for creating accounts when someone joins, changing access when they move roles, and disabling everything on their last day. Review the list of active accounts every quarter.
5. Back up, keep a copy offline, and test restores
Back up critical systems automatically, keep at least one copy that ransomware on your network cannot reach (offline or in a separate, protected account), and test a restore regularly. A backup that has never been restored is a hope, not a plan.
6. Keep systems updated
Apply security updates to operating systems, browsers, servers and business software promptly. Replace software and devices that no longer receive updates. Unsupported systems are among the easiest ways in.
7. Verify payment changes by phone
Any request to change a supplier's bank details, or to make an urgent, unusual payment, must be confirmed by calling a known number, not the one in the email. Make this a written rule for the finance team and support them when they follow it, even with senior managers.
8. Train people with real examples
Short, regular sessions using realistic examples (fake invoices, suspicious login pages, messages pretending to be the MD) work better than an annual lecture. Make it easy and blame-free to report a suspicious email or a mistake quickly.
9. Protect devices and networks
Use reputable endpoint protection, encrypt laptops, set screen locks, and separate guest Wi-Fi from the network your business systems use. Change default passwords on routers, cameras and other network equipment.
10. Plan for a bad day
Write a one-page incident plan: who to call, how to isolate affected machines, who decides on communication with customers or the authority, and where the backups and contact numbers are kept. Rehearse it once with the people involved.
Where to start if you have done none of this
- This week: turn on multi-factor authentication for email and banking, and introduce the phone-verification rule for payment changes.
- This month: list your systems and data, remove shared and former-employee accounts, and confirm that backups exist and can be restored.
- This quarter: set an update routine, run a first training session, and write the incident plan.
Assign each item to a named person with a date. Security work that belongs to "IT" in general tends not to happen.
Questions to ask your IT team or provider
- Which of our systems do not yet have multi-factor authentication, and why?
- When did we last restore a backup successfully, and of which system?
- How many active accounts belong to people who have left?
- Which devices or servers are running unsupported software?
- Where is personal data about employees and customers stored, and who can access it?
- If we were locked out of our main system tomorrow, how long would recovery take?
Honest answers to these questions are worth more than any security product. They tell you where the real gaps are.
Where RAED fits
We build security into the systems we deliver, with individual accounts, role-based access, audit logs and tested backups as standard, and we can review the basics across your existing setup. For legal interpretation of your obligations, we recommend working alongside a qualified lawyer.
Sources
- Prothom Alo, "Govt issues gazette of Cyber Security Ordinance", 22 May 2025. en.prothomalo.com
- Dhaka Tribune, "Cyber security amendment bill, 2026 passes in parliament", 30 June 2026. dhakatribune.com
- The Daily Star, "Bangladesh's Personal Data Protection Ordinance 2025: key takeaways", Md. Zahidur Rabbi, 21 October 2025. thedailystar.net
- Dhaka Tribune, "Parliament passes 31 bills related to IG-era ordinances", 9 April 2026. dhakatribune.com
- Securiti, overview of Bangladesh's Personal Data Protection Act, 2026, 29 June 2026. securiti.ai
