The government of Pakistan has introduced a proposal under the Pakistan Information Security Framework (PISF) to enforce mandatory deadlines for reporting cybersecurity incidents. The initiative aims to bolster the incident reporting and response mechanisms across ministries, departments, and public sector organizations.
According to the proposed framework, organizations classified as Critical Information Infrastructure (CII) must immediately notify their sectoral regulators, Computer Emergency Response Teams (CERTs), and the National CERT upon verification of a cybersecurity incident. Additionally, a detailed incident report is required within 72 hours of incident verification.
For public sector organizations not designated as CII, the proposal mandates reporting verified cybersecurity incidents to the relevant sectoral regulator or CERT within 120 hours. This tiered approach ensures timely communication and coordination across all government bodies depending on the criticality of their infrastructure.
The framework also obliges organizations to develop comprehensive cybersecurity incident management policies, encompassing preparation, detection, response, mitigation, reporting, recovery, and post-incident review stages. Clear roles and responsibilities are to be defined, and cybersecurity incidents classified based on their severity and impact to streamline the response process.
To further strengthen cyber resilience, the proposal emphasizes the need for adequate staffing, ongoing training, and periodic cybersecurity drills. These exercises are meant to identify operational gaps, refine incident handling procedures, and improve organizational readiness against evolving cyber threats.
Moreover, organizations are encouraged to evaluate the implementation of Security Operations Centres (SOC), Security Information and Event Management (SIEM) platforms, and other surveillance technologies to enhance threat detection and incident response capabilities.
Post-incident, organizations must document lessons learned and execute corrective actions within stipulated timelines to reduce recurrence risks. The framework also integrates cybersecurity response strategies with business continuity and disaster recovery plans, requiring organizations to set recovery objectives, conduct annual continuity exercises, and maintain documented procedures to manage cyber emergencies effectively.
The introduction of PISF is a strategic step towards establishing a standardized cybersecurity governance framework across Pakistan’s public sector. This move is expected to enhance preparedness, improve incident reporting, and fortify the protection of government information systems against increasingly sophisticated cyber threats.
