Pakistan is taking a major step toward strengthening its digital security landscape, with the federal government completing the first draft of the National Cyber Security Act and sharing it with key stakeholders. The legislation sets the stage for establishing Pakistan’s first dedicated Cybersecurity Authority—an institution designed to act as the central coordinator for safeguarding the country’s Critical Information Infrastructure (CII).
In a written statement submitted to the National Assembly, the Federal Minister for IT and Telecom confirmed that the new authority will oversee cybersecurity standards, response mechanisms, and risk mitigation across all CII sectors and operators. He emphasized that this initiative is a core component of the National Cyber Security Policy (NCSP-2021), which outlines Pakistan’s national vision for digital asset protection and citizen data security
The policy is being implemented under the Digital Economy Enhancement Program (DEEP), which includes the Secure Data Exchange Layer, Digital Identity systems, and e-Citizen platforms aimed at enabling trust-based digital governance.
Several national systems have already been designated as Critical Information Infrastructure under PECA-2016, including those operated by NADRA, FBR, and the telecom sector. National guidelines for identifying and securing CIIs have been issued, and the designation process for Immigration & Passports systems is currently underway.
While the new authority is being formalized, a 14-member CERT Council—established under the CERT Rules 2023—is functioning as the interim body responsible for cyber incident coordination. The council includes representatives from the Ministries of IT, Defence, Interior and Foreign Affairs, alongside academia, civil society, telecom operators, and governmental CERTs. Its mandate is to strengthen national cyber incident response and improve coordination between public and private stakeholders.
