Md Sabbir Hossain

Services / IT, third-party & infrastructure risk

Cyber Risk Assessment & Third-Party Risk Consultant

Risk assessments that leadership can act on. I developed national critical information infrastructure assessment methods and ran IT risk programmes for government agencies.

Discuss your needs

What's included

  • Enterprise IT and cyber risk assessment
  • Third-party and vendor risk reviews, including OSFI B-10 style due diligence
  • Critical infrastructure and OT risk assessment
  • Risk register, appetite statements and treatment plans
  • Board-level risk reporting

The outcome

A risk register and treatment plan tied to business impact.

Relevant experience

All projects

Feb 2020 – Jul 2020

Critical infrastructure & Tier-IV data centre audit

Bangladesh National CERT · Digital Security Agency

Led audit and risk assessment of 23 critical information infrastructures, including the national Tier-IV data centre.

  • 23 critical infrastructures hardened
  • ~65% better compliance posture
  • Audit & risk

Jun 2018 – Jun 2019

National cybersecurity strategy & risk framework

Government of Bangladesh · with University of Oxford GCSCC

Led Bangladesh's national cybersecurity strategy with Oxford's Global Cyber Security Capacity Centre.

  • National strategy and risk framework
  • Covered in national press
  • Strategy & policy

2019 – 2020

National VAPT, IT audit & risk programme

BGD e-GOV CIRT

Ran national VAPT, IT audit and risk programmes that uncovered nation-state campaigns against banks.

  • 500+ critical vulnerabilities found
  • Nation-state campaigns against banks identified
  • Offensive security
  • Audit & risk

Related insights

All articles

· 6 min read

Japan Just Showed Us Why KYC Needs an Upgrade

Japan's first cyberspace state of emergency leaked millions of ID images. What that means for photo-and-selfie KYC, the stronger methods replacing it, and the policy changes that matter more.

  • Identity & Fraud
  • Governance & Risk

Other services