Pakistan now has a national baseline for information security, and for the first time it comes with reporting clocks, a hosting requirement and a push towards independent audit. If your organisation holds government data, runs critical infrastructure, or sells to anyone who does, PISF 2026 is going to reach you. This guide covers what is actually confirmed, what is still only being reported, and what to do about it.
What is PISF 2026?
PISF 2026 is the Pakistan Information Security Framework, approved by the federal cabinet and formulated by the Ministry of Information Technology and Telecommunication. It sets a standardised national baseline of information security controls, measured through a maturity-based compliance mechanism rather than a simple pass or fail.
It is a baseline standard, not a licence. Think of it the way you would think of ISO 27001: a defined set of controls you are expected to implement and be able to evidence.
Its stated policy basis is the National Cyber Security Policy 2021, the CERT Rules 2023 and the CERT Council.
What is confirmed, and what is still only reported
This section exists because most of what is currently published about PISF 2026 does not distinguish between the two, and some of it is vendor marketing presented as regulation. Getting this wrong is expensive, so here is the honest split.
Confirmed by mainstream Pakistani reporting: cabinet approval, the ministry that produced it, the categories of organisation it covers, the nine areas of control, the 72 hour and 120 hour incident reporting clocks, the requirement to plan migration of overseas hosting into Pakistan, the requirement that government entities cover security in contracts and SLAs, and the cabinet's direction that the framework specify clear implementation timelines and include a provision for independent third-party audit.
Widely repeated but not confirmed from a primary source: the frequently quoted figure of 13 control documents containing 238 controls. That number circulates widely and may well be right. We have not seen it in a government publication, so we are not going to state it as settled.
Actively contradictory: the scope of the PKCERT directive on Security Operations Centres. One national business paper reported it as applying to all public and private sector organisations. Another outlet reported the same six month deadline as applying to 14 key institutions. Those are very different obligations and the difference matters to your budget.
Before you commit spending, get the position that applies to you from your own sectoral regulator or from PKCERT directly. A consultant quoting a deadline without naming its source is quoting a news article.
Who does PISF 2026 apply to?
The framework covers federal and provincial ministries, divisions and departments, autonomous and semi-autonomous bodies, corporations, CERTs, and designated Critical Information Infrastructure.
The Ministry of IT has also proposed that PISF be notified as the national baseline information security standard for public and private sector entities. That proposal is the part private companies need to watch, because it is what would turn a public sector framework into a national one.
Does PISF apply to private companies?
Three ways it reaches a private company, in order of how soon you are likely to feel it.
You are designated as Critical Information Infrastructure. Then it applies directly. Banking, telecom, energy, health and major digital platforms are the usual candidates.
You supply a government entity. Public bodies are required to cover security requirements through contracts and service level agreements with developers, hosting providers and cloud providers. That obligation arrives at your door as a clause in a contract, which is how most private companies will first meet PISF.
It gets notified as the national baseline. If the ministry's proposal is adopted, it applies to you the way ISO 27001 applies to companies whose customers demand it.
Is PISF 2026 mandatory?
For the public sector bodies and designated critical infrastructure named in it, yes. For everyone else, not yet, and anybody telling you otherwise should be asked to produce the notification.
That said, "not yet mandatory" is a poor reason to do nothing. Supplier contracts move faster than regulation, and the controls PISF asks for are the ones your enterprise customers are already asking for.
What does PISF 2026 actually require?
The framework's requirements span nine areas:
- Governance. Named ownership of information security, with authority that actually exists.
- Risk management. A documented process for identifying and treating risk, not an annual spreadsheet.
- Incident response. A formal mechanism, which is a specific obligation rather than general advice.
- Physical security. Controls over the buildings and rooms your systems live in.
- Supply chain security. The security of the vendors who hold your data or connect to your systems.
- Information security audits. Regular assessment, with the cabinet pressing for an independent third-party audit provision.
- Data centres and web hosting. Covered in its own section below, because it has teeth.
- Secure software development. Security built into how software is written, not added at the end.
- Critical Information Infrastructure protection. Additional obligations for designated entities.
Compliance is measured on maturity. That is good news for anyone starting from a low base, because it means progress counts and you are not graded as a failure until the day you are perfect.
The reporting clocks: 72 hours and 120 hours
This is the most concrete obligation in the framework and the easiest one to fail by accident.
A verified incident involving critical infrastructure must be reported to the relevant sectoral regulator or CERT and to the national CERT, with a detailed report to follow within 72 hours.
A verified incident involving non-critical infrastructure must be reported within 120 hours.
Note the word "verified". The clock is tied to verification, which puts the pressure somewhere most organisations are weak: the ability to confirm quickly whether something is a real incident. If it takes you four days to work out whether an alert is genuine, a 72 hour reporting window is already lost.
That is a detection and triage problem long before it is a paperwork problem.
The hosting requirement: moving into Pakistan
Organisations hosting websites and applications outside Pakistan are required to plan migration to data centres inside the country.
Alongside this, the Ministry of Planning, Development and Special Initiatives was directed to ensure that no new or independent data centre proposals are approved or included in PC-1s. The intent is consolidation rather than every department building its own.
If you are a Pakistani organisation currently on overseas shared hosting or a foreign cloud region, this is the requirement most likely to cost you real money and real engineering time. Start the assessment early. Migration is never the two week job it looks like on a slide.
The SOC requirement and the six month deadline
PKCERT has directed that Security Operations Centres be stood up within six months. As covered above, reporting conflicts on whether that applies to all public and private sector organisations or to 14 key institutions, so confirm your own position.
Separately, provincial and sectoral CERTs have been reported as required to have SOCs operational by November 2026, with integration into a shared malware information sharing platform.
Six months is not long to build a genuine 24/7 capability. A real rota needs something like eight to twelve analysts, plus tooling, plus the tuning that decides whether the thing is useful or just noisy. Most organisations that meet this deadline will meet it by buying monitoring as a service or by co-managing with a provider, not by hiring.
The independent third-party audit provision
When the cabinet approved the framework it specifically observed that it should include a provision for an independent third-party audit, and that implementation timelines should be clearly specified.
That matters for two reasons. It signals that self-assessment alone is not going to be accepted, and it means assessment work will have to come from somewhere other than the team that built the systems.
If you are planning for PISF, plan for someone outside your organisation to check the result.
PISF 2026 versus ISO 27001, SOC 2 and NIST CSF
If you already hold ISO 27001, you are in a strong position. The control families overlap heavily: governance, risk management, incident response, supplier security, physical security and audit are common to both. Your existing risk register, policy set and audit evidence carry across with adaptation rather than replacement.
SOC 2 gives you less direct coverage but a lot of the operational evidence, particularly around monitoring, access control and change management.
NIST CSF maps conceptually and is useful for structuring the work, but it is not a certification and no Pakistani regulator is asking for it.
What none of them give you is the Pakistan-specific part: the reporting clocks to the national CERT, the hosting location requirement, and CII designation. Those are new obligations regardless of what certificates you hold.
How PISF sits with your existing SBP, PTA and SECP obligations
This is the question we get asked first by regulated clients, and it is the one most published explanations skip entirely.
PISF does not replace what your sector regulator already requires. Banks, microfinance banks and payment service providers remain under State Bank of Pakistan technology governance and risk management expectations, which already drive periodic vulnerability assessment, penetration testing and incident response readiness. Telecom and cloud providers remain under PTA requirements. Listed and regulated companies remain under SECP obligations.
PISF sits underneath all of that as a national baseline, with sectoral regulators and CERTs treated as the reporting route.
The practical consequence is that you should not run a separate PISF project. If you are already doing SBP-driven testing and reporting, the efficient path is to map PISF onto that programme and close the gaps, which are usually the hosting location, the national CERT reporting path, and formalising incident response.
What will PISF 2026 compliance cost?
No published figure exists, and anybody quoting one is guessing. What can be said honestly is where the money goes, in rough order of size.
Hosting migration is the largest single item if you are currently hosted overseas. It is an engineering project, not a compliance line item.
Monitoring capability is next, if you do not already have it. Buying it as a service is substantially cheaper than building a 24/7 team, which is why most organisations will.
Assessment and audit is the smallest of the three and the most predictable. Our own published figures are USD 399 for a single web application and USD 1,500 for a full manual penetration test, which gives you at least one fixed reference point in a market where almost everything is quoted on request.
Internal time is the cost nobody budgets and everybody pays. Documentation, interviews, evidence gathering and remediation all come out of your own team's hours.
A 90 day plan to get started
You do not need the full framework in hand to make real progress. Four things in the first 90 days will put you ahead of most organisations.
Days 1 to 15. Find out what actually applies to you. Ask your sectoral regulator or PKCERT directly whether you fall inside the CII designation and inside the SOC directive. Write the answer down with the date and who said it. This single step prevents the most expensive mistake available, which is building to an obligation you never had.
Days 15 to 45. Map what you already have. If you hold ISO 27001 or SOC 2, map those controls onto the nine PISF areas and produce a gap list. If you hold neither, run a gap assessment against the framework's areas. The output is a ranked list, not a document set.
Days 30 to 60. Fix the reporting path. Write the incident response procedure, name who decides that an incident is verified, and establish the route to your sectoral CERT and the national CERT. Then test it with a tabletop exercise. The 72 hour clock is unforgiving and this is cheap to get right in advance.
Days 45 to 90. Scope the two expensive items. Get a real assessment of what moving your hosting into Pakistan involves, and decide whether monitoring will be built or bought. Both have long lead times. Starting them in month three of a six month deadline is already late.
Where TechBiz Security fits
We are a Pakistani security firm headquartered in Multan, and the PISF-related work we do is the technical half: gap assessment against the framework's areas, the vulnerability assessment and penetration testing that the audit requirement expects, incident response readiness and tabletop exercises, and managed SOC capability for organisations facing the monitoring requirement without a team to meet it.
What we do not do is issue you a certificate. No consultant can, and the cabinet's push for independent third-party audit makes that separation more important rather than less.
If you want to know where you stand against PISF before you budget for it, tell us what you run and we will scope a gap assessment.
0 comments
Leave a comment