On 9 October 2026, The Business Standard reported that The Premier Bank PLC, a private commercial bank in Bangladesh, had been awarded ISO 27001:2022 certification for its Information Security Management System (ISMS). The certificate was handed to Managing Director Md Monzur Mofiz at the bank's head office at Shanta Pinnacle, in front of senior executives, a Bureau Veritas representative, and the bank's consultant, EIC Limited.
Most coverage of certifications stops at "the bank got certified." The more useful question for any business owner or quality manager is different: what exactly was certified, and what does that scope tell us about how a serious organization approaches information security? In Premier Bank's case, the answer sits in the list of departments and sites that the certificate covers.
This article reads the news through that lens, then explains what ISO 27001:2022 requires and how organizations across Asia-Pacific can use the same thinking, whether they run a bank, a fintech, a hospital, or a logistics company.
📌 Case Study: The Premier Bank PLC (Bangladesh), ISO 27001:2022, October 2026
According to The Business Standard (9 October 2026), the certification covers the bank's Information Technology Division, IT Security and Governance Division, Human Resources Division, its data centre, and its disaster recovery site.
The bank said the certification recognises its capability to ensure the confidentiality, integrity and availability of information, and reflects its commitment to protecting customer information and managing cyber risks effectively. EIC Limited supported the bank throughout the process, and its CEO, Moshiul Islam, attended the ceremony. Executives present included the deputy managing director and chief operating officer, the acting chief risk officer, the chief information technology officer, and the chief information security officer.
Key facts: ISO/IEC 27001:2022; scope = IT, IT security and governance, HR, data centre, disaster recovery site. Source: The Business Standard, 9 October 2026.
Reading the Scope: Why It Matters More Than the Logo
An ISO 27001 certificate is only as meaningful as its scope statement. Two banks can both display the same logo while one has certified a single IT team and the other has certified the people, facilities, and recovery arrangements that keep customer data safe. Premier Bank's published scope includes five elements, and each carries a lesson.
| Scope Element | What It Signals | Typical Audit Evidence |
|---|---|---|
| IT Division | Core systems, networks, and operations are under controlled processes | Access control records, change management, backup and logging |
| IT Security and Governance | A dedicated function owns risk, policy, and monitoring | Risk register, security policies, incident procedures |
| Human Resources | People risk is managed from hiring to exit | Screening, confidentiality agreements, awareness training, offboarding checklists |
| Data centre | Physical protection of infrastructure is audited | Entry controls, environmental protection, equipment maintenance |
| Disaster recovery site | Continuity of service is tested, not assumed | Recovery plans, test results, evidence of improvements |
Take-away: when you evaluate a partner's ISO 27001 certificate, ask for the scope. Certified sites, departments, and systems determine how much assurance the certificate actually gives you.
What ISO 27001:2022 Requires
ISO/IEC 27001:2022 specifies requirements for establishing, implementing, maintaining, and continually improving an ISMS. It protects three properties of information: confidentiality (only authorised parties can access it), integrity (it stays accurate and unaltered), and availability (it can be used when needed).
The standard follows the same High Level Structure as ISO 9001 and ISO 14001, so Clauses 4 to 10 will feel familiar: context, leadership, planning, support, operation, performance evaluation, and improvement. The risk-based core sits in Clause 6, where the organization assesses information security risks, selects treatments, and records its choices in a Statement of Applicability. Annex A lists 93 controls in four themes: organizational (37), people (8), physical (14), and technological (34). The 2022 revision replaced the 114 controls of the 2013 edition and introduced 11 new ones, including threat intelligence, cloud services security, ICT readiness for business continuity, data masking, data leakage prevention, and secure coding.
Deadline already passed: the IAF transition period for ISO 27001:2013 certificates ended on 31 October 2025. Any organization seeking certification today is assessed against the 2022 edition, as Premier Bank was.
Five Lessons for Any Organization Handling Sensitive Data
Scope by risk, not by convenience
A narrow scope is faster to certify, but customers and partners care about where their data actually travels. Start by mapping where critical information is created, stored, processed, and accessed, then draw the scope around those places. Premier Bank included support functions and facilities, not only the IT team.
Treat HR as a security function
Including the Human Resources Division reflects a basic truth: people are both the strongest control and the most common point of failure. Pre-employment screening, confidentiality commitments, security awareness training, and prompt removal of access when roles change are all ISMS controls, and HR must own them.
Put leadership and a named security owner in the room
The ceremony brought together the managing director, the deputy MD and COO, risk, technology, and the chief information security officer. Clause 5 requires top management to demonstrate commitment and assign responsibilities. A designated security lead with real authority makes decisions faster and keeps security in budget discussions.
Prove resilience, not just prevention
Including the data centre and the disaster recovery site means auditors can ask to see evidence that recovery works. Backup restoration tests, failover exercises, and documented improvements after each test matter more than a beautifully written plan. The new Annex A control on ICT readiness for business continuity reinforces this.
Combine expert support with independent verification
Premier Bank worked with a consultant, EIC Limited, while a Bureau Veritas representative attended the handover. The model is common and sensible: advisers help design and implement the system, and an accredited certification body independently audits it. The independence is what gives the certificate its market value.
Common Mistakes When Pursuing ISO 27001
- Copying a template risk register. Auditors expect risks that reflect your actual assets, threats, and business processes.
- Writing policies nobody follows. Certification audits test practice, not paperwork. Interviews and records reveal the gap quickly.
- Ignoring suppliers. Cloud providers, outsourced developers, and payment partners process your information. Supplier controls and contract clauses must be defined.
- Treating certification as the finish line. Surveillance audits occur every year and the certificate runs for three years, so the ISMS must keep evolving with new threats and systems.
- Skipping internal audit and management review. These are mandatory, and they are the best chance to find problems before the certification body does.
How to Start: A Practical Roadmap
Run a gap analysis
Compare current practices with Clauses 4 to 10 and the Annex A controls to see what exists and what must be built.
Define scope and inventory assets
Decide which units, locations, systems, and data are in the ISMS and assign an owner to each asset.
Assess and treat risks
Identify threats and vulnerabilities, rate the risks, choose controls, and produce the Statement of Applicability.
Document, train, and operate
Establish policies and procedures for access control, incident management, and continuity, and train everyone from executives to front-line staff.
Audit internally and review
Conduct a full internal audit cycle and a management review, and close nonconformities before the external audit.
Pass the two-stage certification audit
Stage 1 reviews documentation and readiness; Stage 2 verifies implementation. The certificate is valid for three years with annual surveillance audits.
Frequently Asked Questions
What is the difference between ISO 27001:2022 and ISO 27001:2013?
The 2022 edition reorganises Annex A into 93 controls across four themes (organizational, people, physical, technological), replacing the 114 controls in 14 domains of the 2013 edition. It adds 11 new controls, including threat intelligence, cloud services security, ICT readiness for business continuity, data masking, data leakage prevention, and secure coding. The transition period for 2013 certificates ended on 31 October 2025.
Is ISO 27001 certification mandatory for banks?
ISO 27001 is a voluntary standard and does not replace legal or regulatory obligations. Banks must still comply with the rules of their national regulators on IT, risk management, and data protection. Many choose ISO 27001 because its framework supports compliance and gives customers and partners independent assurance.
How long does ISO 27001 certification take?
It depends on current security maturity, the size of the scope, and available resources. A focused scope with existing good practice can take a few months, while a broad scope with many systems takes longer. The steps are gap analysis, risk assessment, documentation, training, internal audit, management review, and a two-stage certification audit.
What should I check on a supplier's ISO 27001 certificate?
Check the issuing certification body and its accreditation, the standard version (ISO/IEC 27001:2022), the validity dates, and above all the scope statement and the Statement of Applicability version. The scope shows which sites, services, and processes are actually covered.
Can small and medium businesses use ISO 27001?
Yes. The standard applies to organizations of any size and sector, and the scope and controls are tailored to the organization's own risks. Many software, healthcare, logistics, and professional-services firms use ISO 27001 to win customer trust and meet contractual security requirements.
Ready to Build an ISO 27001-Standard Security System?
Arafar Nusa supports organizations across sectors in building ISO-standard management systems, from gap analysis to certification audit day. Your first consultation is free.
💬 Free Consultation via WhatsApp