Pakistan Blocks Restoration of Hacked Govt Networks Without Approval

The National Cybersecurity Handbook 2026-27 in Pakistan mandates that government departments cannot restore services or reconnect network segments compromised by cyberattacks until they obtain formal security clearance from the National Cyber Emergency Response Team (PKCERT). This requirement is stipulated in the handbook, which outlines how federal and provincial governments, as well as public-sector organizations, must respond to cybersecurity incidents.

Under the handbook, all cybersecurity incidents must be reported to PKCERT through approved channels, as well as to regional Computer Emergency Response Teams (CERTs) operating under the CERT Rules 2023. PKCERT teams are tasked with investigating critical cyber incidents, performing digital forensic analysis to ascertain how an attack occurred, evaluating its impact, and containing the threat.

Upon conducting an investigation, government departments are obligated to provide investigators with immediate physical and administrative access to all affected systems, infrastructure, system logs, and other pertinent records.

The handbook also mandates that government organizations preserve digital evidence post-attack. This includes maintaining a strict chain of custody for compromised devices and storage media to ensure the integrity of the evidence throughout the investigation. Officials are barred from altering audit logs, firewall records, or memory dumps, and must prevent unauthorized vendors or personnel lacking the requisite clearance from accessing or interfering with systems placed under quarantine.

Compliance with PKCERT's directives is crucial; government organizations are required to implement emergency measures and remediation instructions outlined by PKCERT investigators. The handbook warns that if systems are restored prematurely or an incomplete forensic investigation is conducted, hidden threats may remain within government networks, service disruptions could persist, and it would become more challenging for authorities to determine how the attack transpired, its origin, and the affected systems or information.

Consequently, before restoring services or reconnecting quarantined network segments, government organizations must adhere to PKCERT's clearance requirements, preserving affected systems, cooperating with PKCERT investigations, and fulfilling the necessary containment and remediation measures.