IT Management Best Practices in Bangladesh (2026 Guide)

Good IT management in Bangladesh in 2026 comes down to five things: tie IT spending to business outcomes, design for power and link failures, run basic ITIL-style service management, meet the new cyber and data protection laws, and write everything down. None of that is exotic. What makes it hard here is the setting: load shedding, uneven ISP quality, a grey market for hardware, a tight talent pool and a legal framework that changed several times between May 2025 and mid-2026.

I'm an IT manager and system analyst based in Dhaka. I work remotely for hospitality businesses and previously ran IT for a Dhaka travel agency. This guide is the checklist I'd hand to anyone taking over an IT department at a mid-sized company here, whether that's a garment exporter, a hotel group or a financial services firm. Legal references were checked on 25 September 2026. Laws here have been moving fast, so treat that date as the limit of what's covered.

Key takeaways

• Speak in business terms. Every IT request should name the business process it protects or speeds up, and what happens if you don't fund it.
• Plan for outages as normal operations. UPS runtime, generator changeover, dual ISPs and offline-capable apps are baseline requirements, not upgrades.
• The legal ground has shifted. The Cyber Security Act 2023 was repealed by the Cyber Security Ordinance 2025, which Parliament turned into a 2026 Act. Personal data protection now has its own law, with localisation rules for critical sectors.
• Financial institutions have a hard deadline. Bangladesh Bank's Cyber Security Framework, Version 1.0 (2026) must be in place by 31 December 2026, including a qualified CISO and 72-hour incident reporting.
• Documentation beats heroics. A single engineer who "just knows" the firewall config is a risk. Runbooks, an asset register and a password manager fix it.

Align IT strategy with what the business actually measures

A common failure is IT being treated as a pure cost centre. When leadership only sees IT as an expense, every budget meeting turns into a defence of last year's spend, and anything strategic gets cut so the old systems can keep limping along.

The fix is to translate. Don't ask for "a new server." Say the current one can't handle order volume during the export peak, and show the queue times from your monitoring. Don't ask for "cybersecurity software." Point to the 2016 Bangladesh Bank heist, where attackers tried to move nearly US$1 billion and got about US$101 million out, through systems that ISACA notes were unmonitored and lacked a firewall. Use your own numbers where you have them. Never invent them for a slide.

Keep a one-page IT strategy that maps each major initiative to a business goal, an owner and a rough cost. Review it every quarter with the people who sign the cheques. It's a small document, but it changes the conversation from "what does IT want now?" to "which of these do we fund first?"

Build for load shedding and connectivity failure

Infrastructure frameworks written for other markets tend to assume stable power and reliable links. You can't assume either here. Design as if the grid and your primary ISP will both fail this week, because at some sites they will.

Power

• Size UPS runtime for your generator changeover time plus a margin, and test the changeover under load, not just once at installation.
• Put the server room, core switches and firewall on the generator circuit. Label it.
• Configure servers and storage to shut down cleanly when UPS battery runs low. A dirty shutdown on a database server costs more than the UPS did.

Connectivity

• Run two ISPs from different upstream providers, ideally on different physical paths into the building, with automatic failover on the firewall.
• Keep a mobile data backup for the critical few: finance, the ERP admin and whoever runs payroll.
• Prefer applications that tolerate short outages. Field teams need offline capture that syncs later.

For hosting choices, a hybrid setup often works best: cloud for email, collaboration and customer-facing sites, with local caching or a local server for anything the factory floor can't stop for. I compared the big providers in modern cloud infrastructure on AWS, Azure and GCP. If you self-host an ERP, the setup in deploying Odoo on a VPS with PostgreSQL shows the pieces you'll need to back up and monitor.

Know the laws and regulators that apply to you

This is the section that has changed most since this post first went up. Here's the current picture as far as I could verify it.

Cyber security law

The Cyber Security Ordinance 2025 (Ordinance No. 25 of 2025) repealed the 2023 Act when it was gazetted on 21 May 2025. According to The Business Standard, it dropped nine sections of the old law and made speech-related offences bailable. The elected Parliament then passed the Cyber Security Bill 2026 in April as one of 91 bills converting interim-government ordinances into law.

It hasn't settled since. An amendment bill placed on 27 June 2026, and passed on 30 June, gives BTRC and authorised agencies power to block content and request user information from platforms, and a separate draft amendment was still with a cabinet committee in July 2026. For an IT manager, the practical point is simple: update any policy that still cites the 2023 Act, and check the current text before relying on a specific section number.

Personal data protection

Bangladesh now has a standalone data protection law. The Personal Data Protection Ordinance 2025 was gazetted on 6 November 2025, and the February 2026 amendment, as TBS described it, eased localisation rules by limiting them to critical sectors such as banking and healthcare. Securiti reports that Parliament passed it as the Personal Data Protection Act, 2026 in April. It also applies to processing outside Bangladesh when it's tied to offering products or services to people here.

What to do now, whatever the final regulations say:

1. Build a data inventory: what personal data you hold, where it lives, who can see it and why you collect it.
2. Check where your cloud data sits. If you're in banking, healthcare or another critical sector, find out whether you need an in-country copy.
3. Write a breach response procedure that names who decides, who notifies the regulator and who talks to affected people.
4. Review HR and payroll systems first. They usually hold the most sensitive data. My HRIS implementation guide for Bangladesh covers access controls for those systems.

Bangladesh Bank rules for the financial sector

If you're in a bank, finance company, MFS provider or payment operator, the new Cyber Security Framework, Version 1.0 (2026) is your priority for the rest of this year. UNB reports that it requires a qualified CISO with industry-accepted certifications, and that critical incidents be reported to Bangladesh Bank and BGD e-GOV CIRT within 72 hours. The Financial Express notes it's organised around the NIST Cybersecurity Framework and calls for multi-factor authentication and real-time monitoring. The deadline is 31 December 2026, so a gap assessment should already be done.

Where to report incidents

BGD e-GOV CIRT, run under the Bangladesh Computer Council, is the national incident response team. It publishes advisories and has an incident reporting channel. Save its contact details in your incident runbook now, not during an incident.

Cybersecurity controls that give the most protection per taka

Most attacks on local organisations aren't sophisticated. They're phishing, reused passwords, exposed remote desktop and ransomware that lands on a machine with no backups. The controls below are roughly in the order I'd fund them:

1. Multi-factor authentication on email, VPN, cloud admin consoles and every administrator account.
2. Offline or immutable backups, with a restore test every month. An untested backup is only a hope.
3. Phishing awareness training with short, regular simulations rather than one annual lecture.
4. Patch and remove exposed services. Nothing like RDP or a database port should face the internet directly.
5. Endpoint detection and response on laptops and servers, with someone who actually reads the alerts.
6. Network segmentation so a compromised reception PC can't reach the finance server.

Run ITIL-style service management, scaled to your size

You don't need a full ITIL programme to get most of the benefit. Two practices do most of the work.

Incident management

Define what P1 to P4 mean in your business. A P1 might be "ERP down for everyone," and a P4 "one user's printer." Set response and resolution targets for each and track them, even in a spreadsheet. After three months you'll see patterns, and patterns point to the problems worth fixing for good.

Change management

Unplanned or untested changes are a frequent cause of outages, often more so than hardware failure. A lightweight change review that meets for 30 minutes each week, with a rollback plan required for every production change, is enough to start.

If your team wants formal training, note that ITIL Foundation (Version 5) is now available from PeopleCert: 40 multiple-choice questions, 60 minutes, 65% to pass. For gathering requirements before a change, the methods in system analysis techniques for modern IT professionals fit well alongside it.

Treat talent development as retention strategy

Skilled engineers here get approached by other companies and by overseas remote employers all the time. You won't always win on salary. You can win on growth, and on not being the only person who can fix the firewall at 2 a.m.

A plan that works without a big budget:

• One relevant certification per person per year, funded by the company, tied to the systems you actually run.
• A monthly internal session where someone presents a system they own or an incident they handled.
• Rotation of on-call and core duties so knowledge isn't locked in one head.

Useful certifications for a typical Bangladeshi mid-size IT team include Microsoft's Azure Fundamentals and Azure Administrator, AWS Solutions Architect, ITIL Foundation and CompTIA Security+. Timing matters for Security+: CompTIA says V7 is available now and V8 is expected on or around 17 November 2026, so decide which version your people will sit before buying study material. AI skills belong on the list too. I covered practical options in AI tools for IT managers in 2026.

Buy from authorised channels and budget for total cost

Procurement here mixes authorised distributors, grey imports and resellers with very different levels of skill. The lowest bid is rarely the cheapest over three years, especially when a grey-market switch turns out to have no local warranty or a firewall licence can't be renewed.

• Ask for proof of authorised distribution for hardware and software.
• Get local support terms in writing, with response times, before you sign.
• Budget for implementation, training and renewals, not just the first licence.
• Negotiate multi-year terms where it makes sense. Vendors often trade price for certainty.
• If you're a regulated entity, check where a cloud vendor stores data before signing, given the localisation rules above.

Document so nobody is a single point of failure

Plenty of IT departments run on tribal knowledge: configs, passwords and procedures that live in one person's head. When that person is sick, on leave or gone, work stops.

Start with the five things that would cause a crisis if the person who knows them left tomorrow. Usually that's the firewall and VPN, the ERP or accounting system, backups, email and domain admin, and the payroll run. Then build out:

• Network diagrams, reviewed quarterly.
• Runbooks for routine and emergency procedures, including incident reporting contacts.
• A password manager with role-based access and a break-glass account.
• An IT asset register covering hardware, licences, renewal dates and owners.
• A record of which systems hold personal data, which doubles as your data inventory.

FAQ

Is the Cyber Security Act 2023 still in force in Bangladesh?

No. The Cyber Security Ordinance 2025 repealed it on 21 May 2025, and Parliament passed the Cyber Security Bill 2026 in April 2026 to make that framework permanent. Amendments followed in mid-2026, so check the current text before citing sections.

Does Bangladesh have a data protection law now?

Yes. The Personal Data Protection Ordinance 2025 was gazetted on 6 November 2025 and amended on 5 February 2026, and Parliament passed it as the Personal Data Protection Act, 2026 in April 2026. It covers organisations processing personal data in Bangladesh and, in some cases, abroad.

What does Bangladesh Bank's 2026 Cyber Security Framework require?

Among other things, a qualified CISO, controls aligned with the NIST Cybersecurity Framework and reporting of critical incidents to Bangladesh Bank and BGD e-GOV CIRT within 72 hours. Scheduled banks, finance companies, MFS providers, PSPs and PSOs must comply by 31 December 2026.

Which certification should a Bangladeshi IT team start with?

Match it to what you run. Azure Fundamentals suits teams moving to Microsoft 365 and Azure, ITIL Foundation helps with service desk discipline, and Security+ is a solid general security baseline. Check exam versions first, since Security+ V8 is due in November 2026.

If you're working through any of this for your organisation and want a practitioner's view, get in touch here.