At a time when cyber threats are growing in scale and sophistication, Pakistan has taken an important step by releasing the draft Pakistan Information Security Framework (PISF) 2025. The National Cyber Emergency Response Team (PKCERT) has played a key role in safeguarding Pakistan’s digital landscape, supporting national efforts to prevent, detect, and respond to cyber threats since its establishment. The PISF, developed by PKCERT, was opened for public review and consultation in late November and early December 2025. While it has not yet been formally launched as a finalized national policy, the consultation period concluded on December 4, 2025. Even in its draft form, PISF 2025 represents a major milestone, offering a clear and structured roadmap to strengthen information security across government organizations and critical national infrastructure.
What is PISF 2025?
PISF 2025 sets basic rules for keeping information safe in federal and provincial government offices, departments, independent groups, companies, CERTs, and key systems called CIIs. The goal is to make sure everyone follows the cybersecurity rules from places like the National Telecommunication and Information Technology Board (NTISB) and the National CERT (nCERT). It builds on the National Cyber Security Policy from 2021 and the CERT Rules from 2023.
The Building Blocks: 13 Essential Policy Documents
PISF 2025 is structured around 13 key policy documents, each focusing on a critical aspect of cybersecurity:
- Essential Governance Controls: Establishing policies, responsibilities, and oversight.
- Essential Asset & Risk Management Controls: Identifying and protecting critical assets.
- Essential Security Training Controls: Building employee awareness and skills.
- Essential System and Communication Protection Controls: Securing networks and data transmission.
- Essential Identity and Access Management Controls: Managing user access securely.
- Essential Data Protection and Privacy Controls: Safeguarding sensitive information.
- Essential Incident Response Controls: Preparing for and responding to breaches.
- Essential Physical Security Controls: Protecting physical assets.
- Essential Data Centre and Web Hosting Services Controls: For organizations handling data centers or hosting.
- Essential Secure Software Development Life Cycle Controls: Ensuring secure software practices.
- Essential Supply Chain Management Controls: Mitigating third-party risks.
- Essential Audit Controls: Verifying compliance and improvement.
- Essential CII Protection Controls: Specialized for critical infrastructure.
These components form a holistic approach, addressing everything from governance to specialized protections.
Applicability and Implementation Ecosystem
The framework applies to a wide range of public sector entities, ensuring a unified cybersecurity standard across Pakistan. To support rollout, PKCERT has outlined an “Implementation Echo System” (likely a typo for “Eco System”) that includes:
- Financial Planning: Allocating dedicated budgets for cybersecurity solutions, training, and audits.
- Human Resource Development: Repurposing positions for dedicated cybersecurity roles.
- External Expertise: Outsourcing to nCERT-registered firms via compliant bidding processes.
- Oversight and Compliance: Audits by nCERT/NTISB to assess adherence.
This ecosystem recognizes that not every organization has in-house expertise, promoting collaboration and resource optimization.
The Phased Implementation Roadmap
One of the standout features of PISF 2025 is its phased approach, making the framework actionable rather than overwhelming. The roadmap includes:
- Phase 1: Essential Governance Controls: Laying the policy foundation.
- Phase 2: Essential Asset & Risk Management Controls: Evaluating and protecting assets.
- Phase 3: Essential Core Controls: Implementing foundational protections like system security, access management, incident response, and more. Additional controls for data centers, secure software development, and CII apply where relevant.
- Phase 4: Audit Controls: Validating effectiveness and driving improvements.
Security training is integrated into every phase, ensuring ongoing education and capability building. This structured path helps organizations progressively build a robust security posture.
Why This is a Great Achievement for PKCERT
PKCERT’s launch of PISF 2025 is a testament to Pakistan’s proactive stance in cybersecurity. By providing a unified blueprint, it addresses the growing threats to government and critical systems, fostering resilience in an increasingly digital landscape. The framework’s emphasis on compliance, training, and phased implementation makes it accessible, while its ties to national policies ensure alignment with broader goals. This initiative not only safeguards Pakistan’s cyberspace but also positions the country as a regional leader in infosec standards.
In conclusion, PISF 2025 is more than a framework, it’s a milestone that empowers Pakistan to navigate the cyber challenges of tomorrow with confidence. Kudos to PKCERT for this visionary step!