The Information and Communication Technology (ICT) Division under the Ministry of Posts, Telecommunications and Information Technology has designated the Chattogram Port Authority (CPA) as 'Critical Information Infrastructure (CII)'.

This declaration was made under Section 15 of the Cyber Protection (Amendment) Act, 2026, through a notice released on Tuesday, bringing the country's major economic lifeline under state cyber security coverage.

To date, a total of 36 organizations in the country have been recognized as CII.

The CPA sources said the port's entire digital infrastructure underwent a rigorous assessment process. Following the successful completion of the evaluation, it received CII designation.

CPA secretary Refayet Hamim said the CPA is responsible for the majority of the country's import-export activities. The management of containers, shipping, customs, revenue processing, and digital systems related to the supply chain are critical to the national economy and security.

"Any cyberattack or disruption to this information infrastructure could have a direct impact on the nation's trade, industry, and public life. The government arrived at this decision with this fact in mind," he added.

With the designation of CII, the port is now subject to enhanced cyber security protection, enabling the prioritization of safeguarding its comprehensive information infrastructure. This protection will extend beyond cyber security to encompass the entire IT infrastructure, including data centers, communication systems, databases, application-phase communication, and communication hub APIs.

Consequently, elevated cyber security standards will be obligatory for the port. In particular, the management of its own Security Operations Center (SOC) and Cyber Incident Response Team (CIRT), along with a 24/7 monitoring system, the execution and reporting of annual security audits for both internal and external information infrastructure, the submission of regular reports and incident reports to the National Cyber Security Agency (SCSA) and the National Cyber Security Operation Center, ongoing risk assessments, vulnerability assessments (VA) and penetration testing (PT), the encrypted and offline backup of critical information, as well as the establishment of Business Continuity Planning (BCP) and Disaster Recovery (DR) systems with regular testing, inspections and audits by relevant government authorities will be ensured, according to port sources.

On the other hand, any breach of CII security regulations or unauthorized access will be deemed a criminal offense under the law.

The CPA has already undertaken essential preparatory measures in accordance with the directives from the Information and Communication Technology Division and the National Cyber Security Agency. These include the establishment of a specialized cybersecurity team, the preparation of a comprehensive inventory of information infrastructure, the updating of security policies and the ongoing provision of regular awareness training for officers and employees, according to CPA sources.

CPA Chairman Rear Admiral SM Moniruzzaman said, "With the increasing digital transformation of the port, the associated cyber risks are also on the rise. To safeguard the vital information infrastructure and digital services of the port, we will adhere to international standards, conduct regular risk assessments and enhance our capacity to address cyber threats."

For this initiative, the Information and Communication Technology Division, the National Cyber Security Agency and pertinent stakeholders will collaborate. Our goal is to develop a digital port system that is secure, resilient and ready for the future, which will play a vital role in safeguarding the nation's foreign trade, promoting economic growth and protecting national interests. Port users, including importers, exporters, shipping agents, C&F agents and all related parties, will benefit from a more secure and trustworthy digital service, he added.