Bangladesh Bank ICT Security Guideline v4.0: What Every Bank Security Manager Must Know

Bangladesh Bank's ICT Security Guideline v4.0 is the most consequential regulatory document for physical security technology in Bangladesh's financial sector. It is not a voluntary best practice framework — it is a mandatory compliance requirement for every scheduled bank, financial institution, and payment service provider operating under Bangladesh Bank's supervision. Non-compliance is identified in periodic inspection reports and can trigger corrective action requirements with defined timelines.

Yet many bank security managers report that they find the guideline complex to navigate. The document spans multiple domains — IT governance, network security, endpoint security, physical security — and the physical security requirements are distributed across several sections rather than consolidated in one place. This article extracts and explains every physical security requirement in the guideline that is directly relevant to surveillance, access control, visitor management, and audit compliance. It is the practical guide that bank security managers need to assess their compliance posture and close gaps.

What the Guideline Covers

Bangladesh Bank ICT Security Guideline v4.0 was developed following a series of significant cyber and physical security incidents affecting Bangladesh's banking sector, including the 2016 Bangladesh Bank heist. The guideline draws on international frameworks including ISO 27001, NIST Cybersecurity Framework, and PCI DSS, adapted for Bangladesh's regulatory context.

The guideline covers:

• IT governance and security policy requirements
• Data centre security (physical and logical)
• Network security and architecture
• Endpoint and mobile device security
• Incident response and business continuity
• Physical security requirements for branches, head offices, and data centres
• Vendor and third-party risk management
• Audit and reporting requirements

This article focuses exclusively on the physical security requirements — the areas directly served by CCTV, access control, intrusion alarm, visitor management, and environmental monitoring systems.

CCTV Requirements: All Branches, ATMs, Cash Vaults, and Server Rooms

The guideline establishes specific CCTV coverage requirements across all bank locations. These are minimum requirements — banks may exceed them based on their own risk assessment.

Branch locations: Every bank branch must have CCTV coverage of:

• Main entrance and exit (both internal and external views)
• Customer service area and teller counters
• ATM areas (whether inside or adjacent to the branch)
• Cash vault entrance and vault lobby
• Branch server room or network equipment room

The coverage requirement implies that camera angles and positioning must deliver meaningful visual evidence — camera images must capture faces at normal resolution at entry points, must capture transaction area activities clearly, and must have adequate lighting (natural or supplemental IR illumination) for clear night-time imagery.

ATM locations: Standalone ATM locations (not within a branch) must have CCTV coverage of:

• The ATM machine itself (capturing user facial images)
• The ATM lobby or enclosure (capturing the full user environment and any waiting persons)
• The external approach to the ATM

Cash vault areas: CCTV cameras must be installed inside vault rooms. This is a requirement that many older branches do not meet — vault interiors were not routinely covered by CCTV in earlier security designs. Retro-fitting vault cameras requires attention to cable routing, lighting inside the vault (since external ambient light does not reach vault interiors), and camera selection (low-light capability is essential).

Server rooms and data centres: All IT equipment rooms — including branch network rooms, data centre floors, and UPS rooms — must have CCTV coverage. Coverage should include the room entry point and the equipment area. For large data centres, camera coverage must achieve sight lines to all server aisles.

Footage Retention: 90-Day Minimum

The guideline specifies a minimum footage retention period of 90 days for all bank CCTV systems. This means that footage from any camera at any location must be retrievable for any event in the preceding 90 days.

Meeting this requirement demands careful storage planning. The storage calculation depends on camera resolution, frame rate, compression standard, and number of cameras.

For a typical bank branch with 8 cameras:

• Camera specification: 2 MP, H.265+ compression, 15 fps, 24/7 recording
• Storage per camera per day: approximately 15–25 GB
• 8 cameras × 20 GB/day × 90 days = 14,400 GB = approximately 14.4 TB

An NVR with 16 TB of usable RAID storage (two 8 TB drives in RAID-1, providing 8 TB usable — no, for a 14 TB requirement, specify 2 × 16 TB in RAID-1, providing 16 TB usable) is appropriate. RAID-1 mirroring protects against hard drive failure during the retention period — if one drive fails, footage is not lost.

For networks of branches, consider centralised storage architecture: CCTV footage transmitted over the bank's MPLS network to a central storage array at head office. This approach reduces per-branch hardware requirements and enables central monitoring, but requires adequate network bandwidth (at minimum 5–8 Mbps per branch for continuous recording) and a central NVR platform sized for the entire network.

The 90-day retention requirement also implies that the NVR must not be overwriting footage before 90 days have elapsed. Configure NVR recording policies with explicit 90-day retention and overwrite-prevention settings. Document and verify this configuration during quarterly maintenance visits.

Biometric Access Control: IT Rooms, Treasury, and Data Centres

The guideline requires that access to sensitive areas — specifically IT rooms, treasury areas, and data centres — be controlled by electronic access control with biometric or card-based authentication. The access control system must log all access events electronically.

What "biometric" means in the guideline context: The guideline uses "biometric" to refer to authentication methods that verify physical identity characteristics — fingerprint, iris, face, or vein pattern recognition. Fingerprint biometric is the most commonly deployed method in Bangladesh banking environments due to its cost-effectiveness and familiarity. Face recognition is increasingly viable as a contactless alternative following the post-pandemic preference for touchless access.

Where biometric access control is required:

• Branch server room / network equipment room
• Head office data centre floor entry
• Treasury room entry
• UPS and power room access (where these are separate controlled spaces)
• Security control room access

What the access control must log: Every access event must be electronically logged with: the identity of the person accessing the area (resolved to a named individual — not just a card number), the date and time of access (to the second), the access point (which door was accessed), and whether access was granted or denied.

Access logs must be retained for a period consistent with the bank's audit requirements — typically 12 months for routine logs, indefinitely for logs associated with investigated incidents. Logs must be protected against modification — the access control database should have role-based access controls preventing operators from altering historical log records.

Two-factor authentication for high-security areas: For treasury and primary data centre entry, the guideline's intent supports two-factor authentication — a physical credential (RFID card) plus a biometric (fingerprint or face) for the highest-sensitivity areas. Two-factor access control means that neither a lost card alone nor a compromised biometric template alone provides access — both must be present simultaneously.

Visitor Management Requirements

The guideline requires that visitors to restricted areas be registered, authenticated, and supervised. Visitor management in bank environments must prevent unauthorised individuals from accessing secure areas while allowing necessary access by auditors, regulators, maintenance vendors, and other authorised visitors.

Minimum visitor management requirements:

Pre-authorisation: Visitors must be pre-registered by a named bank staff sponsor who takes responsibility for the visitor's access. Walk-in access to restricted areas without pre-authorisation must not be possible.

Identity verification: Visitors must present a recognised form of identification (National ID, passport, or institutional ID) that is verified against the pre-registration record. The visitor's identity must be recorded in the visitor log.

Visitor badge issuance: Visitors must be issued a temporary access badge identifying them as visitors. Badge colour or format should clearly distinguish visitors from staff. Visitor badges should have a defined validity period (expiry time visible on the badge).

Escort requirement: Visitors in restricted areas (data centres, server rooms, treasury) must be escorted by an authorised staff member at all times. The escort's identity is logged alongside the visitor's identity.

Log retention: Visitor logs must be retained for a minimum of 90 days and must be available for Bangladesh Bank inspection.

Visitor badge return: Visitor badges must be returned at departure. An unreturned badge must be deactivated immediately in the access control system.

Electronic visitor management systems — software platforms with touchscreen kiosk for visitor self-registration, digital ID capture, badge printing, and electronic log maintenance — provide the most effective implementation of these requirements. Systems such as Envoy, Proxyclick, or locally developed equivalents, integrated with the access control platform, create a fully auditable visitor management record.

Audit and Compliance Reporting

Bangladesh Bank inspections of physical security focus on two questions: is the system installed and operational, and is it generating the audit evidence that demonstrates controlled access?

What inspectors typically review:

• CCTV live view: Can footage from all required cameras be accessed? Is the image quality adequate? Do timestamps display correctly?
• CCTV playback: Can footage from any date in the past 90 days be retrieved and played back? Is the footage continuous (no gaps in the recording timeline)?
• Access control logs: Can logs for any date in the past 90 days be retrieved? Do logs record user identity (name, not just card number) for all access events?
• Visitor register: Is the visitor log for restricted areas current and complete? Are all entries signed (in paper systems) or complete (in electronic systems)?
• System maintenance records: Is there evidence of regular maintenance (last service date, AMC contract)? Are fault records and resolution history available?

Preparing for inspection: Bank security managers should conduct a quarterly internal audit of their security systems against the Bangladesh Bank guideline requirements — essentially replicating what an inspector would do. This internal audit identifies gaps before the inspection. Common findings that benefit from proactive attention include:

• Cameras with degraded image quality (dusty lenses, failed IR illuminators)
• NVR storage filling up ahead of 90-day retention (insufficient storage dimensioned initially)
• Access control users not deactivated after staff departures
• Visitor log entries incomplete or unsigned
• Access logs containing card number references rather than resolved user names

SSAL provides pre-inspection compliance audits for banking clients — reviewing installed security systems against Bangladesh Bank ICT Security Guideline requirements and producing a gap analysis report with prioritised remediation recommendations.

Consequences of Non-Compliance

Bangladesh Bank communicates compliance findings through the CAMELS rating system and through specific ICT security assessment scores. Banks with persistently poor ICT security ratings face:

• Increased frequency of Bangladesh Bank inspections
• Requirements to submit corrective action plans with specific timelines
• Potential restrictions on new branch opening or new product launches until compliance is achieved
• In severe cases, increased capital adequacy requirements

Beyond regulatory consequences, non-compliance with physical security requirements creates direct operational risk. A branch with inadequate CCTV coverage that experiences a robbery or fraud incident has limited forensic evidence for investigation and police reporting. A branch with inadequate access control for the server room has no evidence to exonerate staff falsely accused of data breaches. The investment in compliant physical security protects both the bank's assets and its employees.

SSAL's Compliance Assessment Offer

SSAL offers a structured Bangladesh Bank ICT Security Guideline v4.0 Compliance Assessment for bank security teams. The assessment covers all physical security requirements in the guideline and produces:

1. A branch-by-branch compliance status matrix (for branch network assessments)
2. A gap analysis identifying specific non-compliant conditions
3. A technology upgrade programme with phased remediation plan and budget estimate
4. An ongoing AMC proposal to maintain compliance following remediation

The assessment is available as a standalone engagement for banks seeking to understand their compliance posture, or as part of a full security upgrade programme that SSAL designs, implements, and maintains.

Get Free Consultation — Contact SSAL's banking compliance specialists to schedule your Bangladesh Bank ICT Security Guideline compliance assessment. We will review your current security infrastructure, identify gaps, and propose a practical path to full compliance. Talk to our expert team today.