Md Sabbir Hossain

Services / GRC, audit & privacy

ISO 27001 Lead Auditor & GRC Consultant

Readiness and audit work from an ISO/IEC 27001 Senior Lead Auditor who has audited critical infrastructure and Tier-IV data centres. The aim is controls that produce evidence on their own, so certification holds no surprises.

Discuss your needs

What's included

  • ISO/IEC 27001 and 27701 gap assessment and readiness roadmap
  • Scope, Statement of Applicability and risk treatment plan
  • Policy set and control design that fits how you actually work
  • Internal audit and management review before certification
  • Mapping to NIST CSF 2.0, ITSG-33, SOC 2 and PCI DSS

The outcome

Evidence-ready controls, and no surprises at certification.

Relevant experience

All projects

Feb 2020 – Jul 2020

Critical infrastructure & Tier-IV data centre audit

Bangladesh National CERT · Digital Security Agency

Led audit and risk assessment of 23 critical information infrastructures, including the national Tier-IV data centre.

  • 23 critical infrastructures hardened
  • ~65% better compliance posture
  • Audit & risk

2019 – 2020

National VAPT, IT audit & risk programme

BGD e-GOV CIRT

Ran national VAPT, IT audit and risk programmes that uncovered nation-state campaigns against banks.

  • 500+ critical vulnerabilities found
  • Nation-state campaigns against banks identified
  • Offensive security
  • Audit & risk

2015 – 2020

Bangladesh's first government CIRT

BGD e-GOV CIRT · Norway Registers Development / NRD Bangladesh

Built the country's national government CIRT after the 2016 Bangladesh Bank SWIFT heist.

  • ~95% drop in nationwide cyberattacks
  • Repeat attacks on banks and government blocked
  • Incident response
  • Strategy & policy

Related insights

All articles

· 6 min read

Japan Just Showed Us Why KYC Needs an Upgrade

Japan's first cyberspace state of emergency leaked millions of ID images. What that means for photo-and-selfie KYC, the stronger methods replacing it, and the policy changes that matter more.

  • Identity & Fraud
  • Governance & Risk

Other services