| Framework | Scope | Requirements | Implemented | Coverage | Next assessment | Status |
|---|---|---|---|---|---|---|
| NIST CSF 2.0 | Whole programme | 106 subcategories | 88 | 83% | Self-assessment · Dec 2026 | On track |
| ISO/IEC 27001:2022 | Annex A | 93 controls | 86 | 92% | Surveillance audit · Mar 2027 | On track |
| Bangladesh Bank ICT security guideline | Banks and FIs | Guideline sections | — | 91% | Internal audit · Jan 2027 | On track |
| SWIFT CSCF | SWIFT secure zone | Mandatory and advisory controls | — | 94% | Attestation · Dec 2026 | At risk |
| CIS Controls v8.1 | Implementation group 2 | 130 safeguards | 112 | 86% | Quarterly | On track |
| NIST AI RMF · ISO/IEC 42001 | AI systems | — | — | 64% | Readiness review · Feb 2027 | Gap |
| dooit capability | CSF 2.0 | ISO 27001:2022 | SWIFT CSCF | Evidence |
|---|---|---|---|---|
| Phishing-resistant MFA | PR.AA-03 | A.5.17 · A.8.5 | 4.2 | Sign-in method reports |
| Default-deny application control | PR.PS-05 | A.8.7 · A.8.19 | 2.2 | Allowlist and block logs |
| Field-level encryption with HSM keys | PR.DS-01 | A.8.24 | 2.1 | Key inventory and decrypt log |
| Hash-chained audit log | DE.CM-01 | A.8.15 · A.8.16 | 6.4 | Chain verification |
| Incident lifecycle and playbooks | RS.MA-01 | A.5.24 · A.5.26 | 7.1 | Incident records |
| Vulnerability priority with SLAs | ID.RA-01 | A.8.8 | 2.2 | Priority and SLA reports |