Cybersecurity is no longer only an IT department responsibility. For boards and senior leadership teams in Pakistan, cyber risk is increasingly a business governance issue involving operational continuity, regulatory compliance, customer trust, data protection, and organizational resilience.
Pakistan’s cybersecurity landscape now includes the National Cyber Emergency Response Team (National CERT), sectoral CERTs, the Computer Emergency Response Team (CERT) Rules 2023, and the Pakistan Information Security Framework (PISF).
The latest National CERT material lists the Pakistan Information Security Framework 2026, covering areas such as governance, asset and risk management, security training, identity and access management, data protection, incident response, physical security, secure software development, supply chain management, audits, and Critical Information Infrastructure (CII) protection.
For boards, the important question is not simply “Are we compliant?”
The better question is:
“Can the organization demonstrate that cyber risk is identified, governed, monitored, and managed at the leadership level?”
What Is Pakistan’s National CERT Framework?
The term “National CERT Framework” can refer to several connected elements of Pakistan’s cybersecurity governance structure rather than one single document.
At the center is the National Cyber Emergency Response Team, which coordinates cybersecurity activities at the national level.
The CERT Rules 2023 provide the legal framework for establishing and operating National, Sectoral, and Organizational CERTs. The Ministry of IT and Telecommunication lists the CERT Rules 2023 among Pakistan’s approved legislation.
The National CERT is intended to coordinate responses to major cyber threats and attacks affecting critical infrastructure and information systems. The rules also describe responsibilities around incident reporting and national coordination.
Alongside this structure, the Pakistan Information Security Framework provides security controls and governance requirements that organizations can use to strengthen information security.
The current National CERT website lists PISF 2026 and organizes its controls across multiple security and governance domains.
The framework can therefore be understood as three connected layers:
- National coordination through National CERT
- Sector-specific coordination through Sectoral CERTs
- Organizational cybersecurity governance and controls within individual organizations
For a board, this structure matters because cybersecurity responsibility does not stop with the IT department.
Why Should Boards Care About CERT Requirements?
A cyber incident can affect much more than technology.
Consider what happens when a company experiences a ransomware attack:
- Critical systems become unavailable
- Employees cannot perform their jobs
- Customers may lose access to services
- Sensitive information may be exposed
- Revenue can be interrupted
- Regulatory obligations may be triggered
- Recovery costs can increase
- Management must make decisions under pressure
This is why cybersecurity should be treated as an enterprise risk management issue.
National CERT’s own cybersecurity material emphasizes areas such as governance, risk management, incident response, business continuity, disaster recovery, and security awareness.
Boards do not need to become cybersecurity engineers.
They do, however, need enough visibility to ask whether the organization has appropriate controls, ownership, testing, reporting, and incident readiness.
What Does the National CERT Actually Do?
Under the CERT Rules 2023, National CERT serves as a national coordination body and can provide cybersecurity services to various stakeholders.
Its responsibilities include developing national capability to coordinate responses to threats and attacks against critical infrastructure and information systems, as well as supporting incident reporting across different sectors.
National CERT also provides services including:
- Security audits
- Policy and regulation formulation
- Capacity building
- Incident management
- Forensic and malware analysis
- Security screening and product evaluation
These services are listed on the official National CERT website.
For boards, this means cybersecurity should not be viewed purely as buying security products.
The broader question is whether the organization has a structured security governance and response capability.
What Is PISF 2026?
The Pakistan Information Security Framework (PISF) provides a structured set of information security controls.
The National CERT website currently identifies the revised framework as PISF 2026 and lists controls covering several important areas.
These include:
1. Governance Controls
Cybersecurity needs clear ownership.
Boards should understand:
- Who is accountable for cybersecurity?
- Who approves security policies?
- How is cyber risk reported to leadership?
- How frequently does the board receive security updates?
- Are cybersecurity responsibilities formally assigned?
Without governance, technical controls can become disconnected from business priorities.
2. Asset and Risk Management
An organization cannot adequately protect assets it does not know it owns.
Management should maintain visibility over:
- Servers
- Endpoints
- Applications
- Databases
- Cloud resources
- Network infrastructure
- Critical business systems
- Sensitive information
- Third-party connections
Risk assessments should then identify which assets would cause the greatest business impact if compromised or unavailable.
3. Security Training
Employees remain an important part of an organization’s cybersecurity posture.
Security awareness should address risks such as:
- Phishing
- Social engineering
- Password security
- Unauthorized access
- Data handling
- Suspicious attachments
- Business email compromise
National CERT’s framework includes essential security training controls, reinforcing that cybersecurity is not exclusively a technical responsibility.
Organizations can also use structured cybersecurity training programs to improve employee awareness and security practices.
4. Identity and Access Management
One compromised account can become an entry point into critical systems.
Boards should ask management whether the organization has controls for:
- User provisioning
- Access approval
- Privileged accounts
- Multi-factor authentication
- Password management
- Access reviews
- Employee offboarding
- Administrative privileges
A useful board-level question is:
“Who currently has access to our most critical systems, and how often is that access reviewed?”
5. Data Protection and Privacy
Data is one of an organization’s most valuable assets.
The board should understand how the organization protects:
- Customer information
- Employee records
- Financial information
- Intellectual property
- Business documents
- Authentication credentials
- Operational data
Controls should cover how information is stored, transmitted, accessed, backed up, and eventually disposed of.
PISF 2026 specifically includes Data Protection and Privacy Controls among its control domains.
6. Incident Response
No organization can assume that it will never experience a cyber incident.
The more important question is:
What happens when something goes wrong?
An effective incident response capability should define:
- How incidents are detected
- Who reports them
- Who investigates them
- Who makes business decisions
- How systems are contained
- How evidence is preserved
- How affected stakeholders are informed
- How systems are recovered
- How lessons learned are documented
National CERT’s role includes national-level incident coordination and support for incident reporting.
Boards should therefore ensure that incident response is tested before a real crisis occurs.
7. Business Continuity and Disaster Recovery
Cybersecurity and business continuity are closely connected.
Imagine a ransomware attack affecting:
- ERP
- Finance systems
- Production systems
- Customer databases
Even if the company eventually restores everything, prolonged downtime can create significant operational disruption.
Boards should ask:
- Are critical systems backed up?
- Are backups isolated from production?
- Have backups actually been tested?
- How quickly can critical systems be restored?
- Which systems must be restored first?
- Who makes recovery decisions?
A backup that has never been tested is not the same as a proven recovery capability.
8. Secure Software Development
Modern businesses increasingly depend on custom applications, APIs, cloud platforms, mobile applications, and web portals.
That creates another area of cyber risk.
PISF 2026 includes Secure Software Development Life Cycle (SSDLC) controls.
Organizations should consider security throughout development rather than waiting for production.
This can include:
- Secure coding practices
- Code reviews
- Vulnerability testing
- Dependency management
- Authentication testing
- API security
- Application penetration testing
- Secure deployment processes
For organizations developing or operating web applications, Vulnerability Assessment and Penetration Testing (VAPT) can help identify security weaknesses before attackers exploit them.
9. Supply Chain Security
Your organization may have strong internal security while a third-party supplier creates an unexpected risk.
Common examples include:
- Cloud providers
- Software vendors
- Managed service providers
- Payment providers
- IT contractors
- Remote support providers
- SaaS platforms
PISF 2026 includes Supply Chain Management Controls, highlighting the importance of managing security risks beyond the organization’s immediate network.
Boards should therefore ask:
“Which third parties have access to our systems or sensitive data?”
And:
“How do we evaluate their cybersecurity risk?”
What About Critical Information Infrastructure?
Critical Information Infrastructure, or CII, receives particular attention within Pakistan’s cybersecurity framework.
The PISF 2026 control structure includes dedicated CII Protection Controls.
Organizations operating important infrastructure should understand whether their systems, services, or operations fall within applicable critical-sector requirements.
This becomes particularly important for organizations connected to sectors where disruption could have wider consequences.
National CERT’s audit framework distinguishes between critical and non-critical sectors when determining audit categories and requirements.
How Are Cybersecurity Audits Structured?
National CERT has established an Engagement and Oversight Framework for Audit Activities.
The framework describes a structured process that includes:
- Requirement identification
- Selection of an appropriate audit firm
- Notification to National CERT
- Risk-based planning
- Audit execution
- Preliminary findings
- Reporting
- Remediation
- Closure
The framework also classifies organizations and audit requirements into categories based on factors such as criticality, IT/OT/cloud scope, and infrastructure size.
This is important for boards because an audit should not simply produce a document.
The objective is to identify weaknesses, assign corrective actions, track remediation, and improve the organization’s security posture.
What Should a Board Ask the CISO or IT Head?
A board does not need to ask for hundreds of technical metrics.
Instead, focus on questions that connect cybersecurity with business risk.
Governance
- Who owns cybersecurity risk?
- Is cybersecurity regularly reported to the board?
- Are security responsibilities formally documented?
Risk
- What are our five biggest cyber risks?
- Which critical assets are most exposed?
- Which risks remain unresolved?
Compliance
- Which cybersecurity laws, regulations, and frameworks apply to us?
- Are we subject to sector-specific requirements?
- When was our last independent security assessment?
Incident Response
- When was our incident response plan last tested?
- How quickly can we detect and contain a serious incident?
- Who contacts management during a major cyber event?
Recovery
- Can we restore critical systems from backups?
- When was the last recovery exercise?
- What is our expected recovery time for critical systems?
Third Parties
- Which vendors can access our systems?
- Are critical suppliers assessed for cybersecurity risk?
- What happens if a key supplier suffers a cyberattack?
These questions turn cybersecurity from a technical discussion into a business-risk discussion.
What Should Boards Do Now?
Organizations should not wait for a cyber incident before reviewing their security governance.
A practical board-level approach is:
Step 1: Identify Applicable Requirements
Determine which laws, regulations, sectoral requirements, and cybersecurity frameworks apply to the organization.
Start with the official National CERT Policies and Legislation page and the CERT Rules 2023.
Step 2: Map Critical Assets
Identify systems and information that are essential to:
- Revenue
- Operations
- Customers
- Employees
- Regulatory obligations
- Business continuity
Step 3: Conduct a Security Gap Assessment
Compare current controls against applicable requirements.
A gap assessment should identify:
- Existing controls
- Missing controls
- High-risk weaknesses
- Ownership
- Remediation priorities
- Target completion dates
Step 4: Test Technical Controls
Governance documents alone cannot demonstrate that systems are secure.
Organizations should consider appropriate:
- Vulnerability assessments
- Penetration testing
- Configuration reviews
- Access reviews
- Security audits
- Incident response exercises
Step 5: Report Risk to the Board
Cybersecurity reporting should focus on business impact rather than technical jargon.
Instead of:
“We have 143 vulnerabilities.”
A board-level report should explain:
“Three high-risk vulnerabilities affect systems supporting a critical business process. Remediation is scheduled for [date], with interim controls in place.”
That gives directors information they can actually use.
The Board-Level Takeaway
Pakistan’s National CERT structure is part of a broader move toward more organized cybersecurity governance.
The CERT Rules 2023 establish the framework for National, Sectoral, and Organizational CERTs, while the Pakistan Information Security Framework 2026 provides a structured set of information security controls covering governance, risk, access, data, incident response, secure development, supply chains, audits, and CII protection.
For boards, the key issue is not whether directors can understand every firewall rule or vulnerability report.
It is whether the organization can demonstrate:
Clear accountability + identified cyber risk + effective controls + tested response + measurable remediation.
Cybersecurity should therefore have a place in the same governance conversations as financial risk, operational continuity, regulatory compliance, and business resilience.
How Ambsan Can Help
Cybersecurity compliance starts with understanding where your organization stands today.
Ambsan Technologies provides cybersecurity and IT security services including security assessments, IT audits, risk assessment, compliance support, and vulnerability testing.
Our team can help organizations identify security gaps, assess technical risks, strengthen controls, and build a more structured cybersecurity program.
Explore Ambsan’s cybersecurity solutions or speak with our team about your organization’s security and compliance requirements.
Need to understand your current cybersecurity posture? Contact Ambsan Technologies for a security assessment.
Frequently Asked Questions
What is Pakistan’s National CERT?
Pakistan’s National Cyber Emergency Response Team is the national coordination body responsible for supporting cybersecurity response, coordination, incident reporting, and other national cybersecurity functions under the CERT framework.
What are the CERT Rules 2023?
The CERT Rules 2023 establish the framework for Computer Emergency Response Teams in Pakistan, including the National CERT and Sectoral CERT structures. They were approved by the Ministry of IT and Telecommunication in October 2023.
What is PISF 2026?
PISF 2026 is the current Pakistan Information Security Framework listed by National CERT. It provides security controls across areas including governance, risk management, identity and access management, data protection, incident response, secure software development, supply chain management, audits, and CII protection.
Does cybersecurity responsibility belong only to the IT department?
No. Technical teams implement many security controls, but cybersecurity risk involves governance, operations, compliance, business continuity, and organizational decision-making. Boards and senior management therefore have an important oversight role.
Should a company conduct a cybersecurity audit?
The appropriate audit requirements depend on the organization’s sector, risk profile, applicable regulations, and whether it falls within relevant National CERT or sector-specific requirements. National CERT has published an audit engagement and oversight framework that describes category-based audit arrangements.
How can a company prepare for National CERT requirements?
Organizations can begin by identifying applicable requirements, mapping critical assets, conducting a cybersecurity gap assessment, reviewing governance and incident response processes, testing technical controls, and establishing a documented remediation plan.