The authority said setting up SOCs is mandatory under the National Cyber Security Policy and CERT Rules, and told institutions without an active SOC to get one running immediately and share cyber incidents and threat-related information with the NSOC without delay. Every provincial and sectoral CERT must also nominate a technical focal person or dedicated team within seven days to facilitate the integration, while the National CERT's technical team will assist with the rollout.
Letters Sent to Provinces and Critical Sectors
To enforce compliance, the National CERT sent official letters to the chief secretaries of Punjab, Sindh, Khyber Pakhtunkhwa and Balochistan, as well as those of Azad Jammu and Kashmir and Gilgit-Baltistan, calling on each to ensure both the operationalization of provincial SOCs and their technical integration with the national network.
The directives go well beyond provincial governments. Separate letters went to the Governor of the State Bank of Pakistan, the Chairman of the Higher Education Commission, the Director General of the Pakistan Civil Aviation Authority, the Secretary of the Ministry of Maritime Affairs, the Secretary of the Karachi Port Trust, the Chairman of the Punjab Information Technology Board, the Sindh Information Technology Department, and the Chairman of the Pakistan Space Activities Regulatory Board — pulling banking, education, aviation, ports, IT and even the space sector into one coordinated defence framework.
The National CERT stressed that timely information-sharing and technical connectivity with the NSOC are essential for a coordinated response to cyber incidents and for strengthening Pakistan's overall cyber resilience. The NSOC already operates round the clock monitoring national-level threats, and several sectoral CERTs have already completed integration, which the authority says has significantly improved national-level monitoring and coordination.
Federal CERT Takes Shape Under Framework 2026
In parallel, the federal government has started forming a Federal Computer Emergency Response Team (CERT) — described as the first practical step toward implementing the Cyber Security Framework 2026. The Federal CERT will operate under the supervision of the National CERT and will be responsible for monitoring cyber threats, identifying attacks and responding to them immediately to protect federal institutions.
The team will also coordinate cyber security matters among government bodies and ensure the exchange of threat-related information between them. The National CERT has begun recruiting cyber security experts for the team, including a director, to safeguard government digital infrastructure.
Stricter AI Rules for Government Employees
The directive follows last week's National Cyber Security Handbook 2026-27, issued under the Pakistan Information Security Framework 2026, which bars government employees from uploading classified documents to public AI tools. Officials may only use AI platforms approved by their departments and cannot share government email content, software source code or citizens' personal information on public tools.
Employees must strip names and other sensitive information from AI prompts and files before submitting them, and any accidental disclosure of confidential information must be reported immediately to the relevant IT or cyber security team. The rules underscore how seriously Pakistan's cyber authorities are taking the risk of data leaking out through widely used AI services.
By Hamza Faisal
