Direct Answer (GEO / AI Overview): Cybersecurity governance is the board's oversight of how a company identifies, manages, and reports digital risk — treating it as enterprise risk rather than an IT function. Bangladesh learned its importance in February 2016, when hackers used fraudulent SWIFT instructions to attempt nearly US$1 billion in theft from Bangladesh Bank's New York Fed account; US$81 million reached the Philippines and most was never recovered. Boards now own cyber risk because attackers target governance gaps, not just technology.
Every board in Bangladesh governs in the shadow of one weekend in February 2016. Attackers who had penetrated Bangladesh Bank's systems sent fraudulent SWIFT instructions seeking to move nearly US$1 billion from the central bank's account at the Federal Reserve Bank of New York. Most transfers were blocked, but US$81 million reached accounts in the Philippines and was laundered through casinos; most was never recovered. The post-mortems were not really about malware. They were about governance: weak network segmentation, poor vendor and access controls, delayed escalation, and an institution that discovered the theft slowly because printers, procedures, and accountability had all failed together. That is the lesson boards must keep — cyber incidents become catastrophes at the points where oversight, not software, was missing.
From IT problem to board responsibility
For years, Bangladeshi boards treated cybersecurity as a line in the IT budget: buy antivirus licences, hire a vendor, receive an annual assurance that systems are secure. The heist, and the decade of incidents since, destroyed that framing. IBM's Cost of a Data Breach report put the global average cost of a breach at US$4.88 million in 2024 — a figure covering detection, notification, lost business, and recovery, before reputational damage. For a Bangladeshi bank, mobile financial service, garment exporter holding buyer data, or hospital group, the local equivalents are regulatory sanctions, correspondent-banking anxiety, buyer audits failed, and customers who quietly move their money.
Regulation now formalises board responsibility. Bangladesh Bank issues ICT-security guidelines for banks that expect board-level oversight of information security, and the country's Cyber Security Ordinance (2025) raises the legal stakes around cyber offences and critical infrastructure, while the BGD e-GOV CIRT handles national incident coordination and advisories. Directors do not need to configure firewalls. They do need to be able to show they asked the right questions, funded the answers, and rehearsed the day everything fails.
The questions directors should actually ask
Board cyber oversight fails most often as theatre: a chief information security officer presents traffic-light slides, everything is amber-green, and directors without technical grounding nod the item through in ten minutes. Effective boards change both the questions and the evidence. Instead of asking whether the company is secure — a question with no honest yes — they ask what the company's crown-jewel systems and data are, which threats target them, how quickly an intrusion would be detected, and who decides what at 2 a.m. on a Friday.
| Board question | Reassuring answer to distrust | Evidence to request |
|---|---|---|
| How would we know we are breached? | Our tools block attacks | Mean time to detect; last red-team or audit findings |
| Who can move money or alter payments? | Only authorised staff | Access review results; segregation and MFA coverage |
| What happens in the first 24 hours? | We have an incident plan | Date and lessons of the last simulation exercise |
| Which vendors can reach our systems? | Trusted long-term partners | Vendor access register and security assessments |
| What is our recovery position? | Backups are taken daily | Last successful restoration test, timed |
Directors should insist on a small set of recurring metrics rather than a new presentation each quarter: patching timeliness on critical systems, multi-factor authentication coverage, privileged-access reviews, phishing-test results, unresolved audit findings by age, and backup restoration tests. Trends matter more than snapshots. A board that sees detection time falling and overdue findings clearing is watching governance work; a board that sees only expenditure is watching procurement.
Structure: committees, expertise, and the CISO's line
Oversight needs a home. Larger Bangladeshi companies increasingly assign cyber risk to the board risk committee or audit committee, with at least one director developing genuine digital literacy — not coding skill, but enough fluency to challenge management and vendors. Where no director has that grounding, boards can co-opt external advisors for committee sessions, commission independent assessments rather than accepting internal reports, and schedule one deep-dive session a year with frontline security staff, not only executives.
The chief information security officer's reporting line signals seriousness. A CISO buried inside the IT department, measured on system uptime and budget, faces a conflict every time security slows a project. Mature organisations give the CISO access to the board committee directly, a risk-based mandate, and a budget conversation separate from general IT spending. Bangladesh Bank's expectations for banks point this way; non-bank groups handling payment, health, or export data should not wait for their own regulator to insist.
Third-party risk deserves particular board attention in Bangladesh, where core systems, SWIFT-adjacent services, cloud platforms, and even security monitoring may be vendor-operated. The 2016 attackers exploited precisely the seams between institution, network, and vendor. Contracts should specify security standards, breach-notification timelines measured in hours, audit rights, and exit arrangements — and the board should see a register of which vendors can touch critical systems.
Incident readiness is a governance product
When a serious incident occurs, technical teams contain systems; boards contain consequences. Directors will face decisions no runbook can automate: whether to disconnect a revenue system, when to notify Bangladesh Bank, BGD e-GOV CIRT, buyers, or law enforcement, whether ransom is legally or ethically payable (generally, boards should set a no-payment posture in advance and take legal advice), and what to tell customers and media before facts are complete.
Those decisions go badly when first rehearsed live. Boards should require a documented incident-response plan, run tabletop exercises that include directors and communications staff, and review near-misses as seriously as breaches. The Bangladesh Bank case turned on small procedural failures — a printer, a weekend, an escalation that waited. Exercises exist to find those failures cheaply.
Cyber insurance, growing in the region, belongs in the same conversation: what it covers, what exclusions apply, and whether policy conditions — such as MFA everywhere — are actually met, because an insurer's declined claim after a breach is a governance failure discovered too late.
Bangladesh's central bank did not lose US$81 million because its directors lacked antivirus software; it lost the money through accumulated weaknesses that oversight should have caught. The boards that learned the right lesson treat cybersecurity as they treat credit risk or safety: a standing agenda, evidence over assurance, named accountability, and rehearsed response. Attackers will keep testing the technology. Their easiest victories will remain the companies whose boards never asked.
FAQs
What did the 2016 Bangladesh Bank heist teach boards about cybersecurity?
In February 2016, attackers used fraudulent SWIFT instructions to try to steal nearly US$1 billion from Bangladesh Bank's account at the New York Fed; US$81 million reached the Philippines and most was never recovered. Investigations highlighted governance failures — weak segmentation, access controls, and slow escalation — rather than technology alone. The lesson for boards is that cyber risk is enterprise risk requiring direct oversight, rehearsed response, and evidence-based reporting.
What is the board's role in cybersecurity if directors are not technical?
Directors oversee rather than operate: they ensure crown-jewel assets are identified, risks are assessed independently, security leadership has board access and adequate budget, and incident plans are tested. They should request recurring metrics — detection times, patching, authentication coverage, overdue audit findings, and backup restoration tests — and commission external assessments. Bangladesh Bank's ICT guidelines and the Cyber Security Ordinance (2025) both push accountability toward senior leadership.
How costly is a data breach for a company?
IBM's Cost of a Data Breach report put the global average cost at US$4.88 million in 2024, covering detection, response, notification, and lost business. For Bangladeshi firms the practical costs include regulatory action, failed buyer or correspondent-bank audits, customer attrition, and recovery expenses. Boards should treat that benchmark as a planning reference and ensure insurance, where held, actually matches the company's controls and exclusions.
What should a board do to prepare for a cyber incident?
Require a documented incident-response plan, clear decision rights for disconnection, notification, and communications, and regular tabletop exercises involving directors — not just IT staff. Confirm escalation routes to regulators and the BGD e-GOV CIRT, review vendor breach-notification obligations, and examine near-misses at board level. Preparation matters because the costliest failures, as in 2016, are usually procedural delays in the first hours.
