Cyber warfare alert triggers Pakistan to accelerate security measures

The federal government has approved a 90-day Cyber Security Strategic Action Plan amid what the National Committee for Information and Communications Security (NCICS) described as a growing cyber threat environment, with provinces being directed to accelerate the establishment of Computer Emergency Response Teams (CERTs) and the implementation of the Pakistan Information Security Framework (PISF) 2026.

LAHORE: The federal government has approved a 90-day Cyber Security Strategic Action Plan amid what the National Committee for Information and Communications Security (NCICS) described as a growing cyber threat environment, with provinces being directed to accelerate the establishment of Computer Emergency Response Teams (CERTs) and the implementation of the Pakistan Information Security Framework (PISF) 2026.

According to senior official sources, the decision was taken at the second meeting of the NCICS, held at the Cabinet Division under the chairmanship of the Secretary of the Ministry of Information Technology and Telecommunications and NCICS chairman.

The need for immediate measures was highlighted due to the growing cyber threat environment. The committee was informed that PISF 2026 had already been approved and that its implementation at both the federal and provincial levels needed to be ensured.

The National Computer Emergency Response Team (nCERT), which leads the Cyber Security Working Committee, presented a comprehensive Cyber Security Strategic Action Plan focused primarily on measures to be undertaken within 90 days. The plan covers governance, compliance, resource alignment, incident response and crisis management, cybersecurity assessment and supply chain security. The meeting was also informed that nCERT had prepared a National Cyber Security Handbook primarily for government officials.

The chairman of the Pakistan Telecommunication Authority (PTA) stressed that the operationalisation of the Federal CERT required careful planning, particularly in the absence of sectoral and provincial CERTs, so that relevant ministries and departments could be efficiently integrated. The National Computer Emergency Response Team said that a Managed Security Service Provider (MSSP) approach would be adopted and that provincial and sectoral CERTs would operate under nCERT and remain in direct contact with their respective ministries and departments. Guidelines for the operationalisation of the provincial and sectoral CERTs had already been issued and would continue to be developed.

The senior officer representing Sindh asked whether provinces would have to formulate their own rules and highlighted that funds could be required, particularly if additional data centres were established. He referred to the recent approval by the Sindh government of a data centre for Sindh Intelligence Fusion.

He maintained that PISF 2026 provided the necessary framework for federal and provincial entities and, therefore, there was no requirement for provinces to formulate separate rules.

The Sub-Committee for Cyber Security Aspects of the Ministry of Foreign Affairs (MoFA) Missions informed the committee of the current cybersecurity landscape of diplomatic missions and briefed it on measures recently taken to improve the cybersecurity posture of the missions.

The importance of robust cybersecurity arrangements at MoFA missions was also discussed, as their security was directly linked to national security. The committee tasked the MoFA cybersecurity sub-committee with preparing an action plan based on a comprehensive framework and guidelines.