Pakistan's cybersecurity rules in 2026, in plain language
In short: Pakistan is moving from "security is optional" to "security is expected". National CERT has said organisations must adopt the Pakistan Security Standards (PSS), the Pakistan Information Security Framework (PISF) 2026 is going through government approval, the State Bank's Cyber Shield strategy applies to regulated financial entities, and PTA's telecom security regulations require a CISO and fast incident reporting. Exact deadlines differ and some are not final, but the same handful of controls (an owner for security, asset and risk lists, MFA, backups, logging, incident response and supplier checks) cover most of what every framework asks for.
This guide summarises public reporting as of November 2026. It is not legal advice. Always check the regulator's own circular or notification for the exact text and dates that apply to you.
The main frameworks at a glance
- Pakistan Security Standards (PSS), National CERT: reported in the press as mandatory for public and private sector entities, with compliance expected by 2028. Defence-sector entities were given earlier timelines.
- Pakistan Information Security Framework (PISF) 2026: reported as approved for or under government review. Once notified, it is expected to become the baseline for public sector organisations, with timelines issued after approval. Whether and how it applies to private companies should be confirmed from the final text.
- SBP Cyber Shield: the State Bank's strategy for banks and other regulated entities, to be implemented in phases up to 2030. Payment institutions also have SBP circulars with their own compliance dates.
- PTA CTDISR (telecom): PTA's revised Critical Telecom Data and Infrastructure Security Regulations align with ISO/IEC 27001 and NIST CSF, require licensees to appoint a Chief Information Security Officer and to report incidents to PTA within 24 hours, and include rules on local data hosting.
- SOC push: in 2026 the head of PKCERT publicly urged public and private organisations to set up Security Operation Centres within six months. Treat this as a strong signal of where audits are heading, and confirm any formal requirement with your regulator.
Does this apply to my company?
- Banks, microfinance, EMIs, payment and fintech firms: yes, SBP rules apply directly, and auditors will map your controls to them.
- Telecom operators and their key vendors: PTA's regulations apply to licensees, and their requirements flow down to suppliers through contracts.
- Government departments and their IT suppliers: expect PSS and PISF requirements in tenders and contracts.
- Everyone else (manufacturing, retail, healthcare, education, software houses): you may not be directly regulated yet, but your banks, large customers and foreign clients increasingly ask the same questions in vendor security questionnaires. Being ready is a sales advantage.
The controls that cover most frameworks
Almost every framework above, like ISO 27001 and NIST CSF, asks for the same foundations. Doing these well puts you ahead whichever rule applies first:
- A named owner for security (a CISO or security lead, even part-time) with authority and a budget.
- An asset list and a risk register: what systems and data you have, and what could go wrong.
- Access control: multi-factor authentication for email, VPN and admin accounts, and regular access reviews.
- Patching and vulnerability management: a monthly patch routine and periodic vulnerability assessment or penetration testing.
- Logging and monitoring: keep logs from key systems and have someone, in-house or a managed SOC, look at alerts.
- Backups you have tested: including an offline or locked copy.
- An incident response plan that includes who reports to the regulator, and how fast.
- Supplier security: basic checks and contract clauses for vendors that touch your data or systems.
- Email protection: SPF, DKIM and DMARC at enforcement, since email fraud is the most common attack on Pakistani businesses.
- Staff awareness: short, regular phishing training.
A practical 90-day start
- Weeks 1-2: name a security owner, list your systems and data, and confirm which regulator's rules apply to you.
- Weeks 3-6: run a gap assessment against the most relevant framework (SBP, PTA, PSS or ISO 27001), and fix the quick wins: MFA, backups, email protection.
- Weeks 7-12: write the incident response plan, start central logging, test a backup restore, and plan the larger gaps with owners and dates.
Related guides: SOC readiness, ISO 27001 certification, Managed SOC, DMARC and email fraud and backups.
Free check for Pakistani businesses
Send your domain to [email protected] and we will reply with a free one-page check of your email protection (SPF, DKIM, DMARC) and website basics. We use public information only; nothing is tested without your written permission. If you need a gap assessment against SBP, PTA, PSS or ISO 27001 requirements, ask in the same email.
Want a second pair of eyes? FarSec checks businesses in Pakistan for exactly these gaps and helps fix them. Email [email protected] and tell us what worries you.