Pakistan Orders Provincial and Sectoral CERTs to Activate Security Operations Centers by November 2026

Pakistan’s National Cyber Emergency Response Team has directed provincial and sectoral CERTs to establish and operationalize their Security Operations Centers (SOCs) by November 2026, as part of a broader effort to strengthen nationwide monitoring of cyber threats and attacks.

According to the directives, provincial and sectoral CERTs will also be required to complete their technical connectivity with the National Cyber Security Operations Center (NCSOC), which has begun round-the-clock operations.

The move is aimed at creating a coordinated national cybersecurity monitoring network capable of detecting, analyzing, and responding to cyber incidents in real time. Pakistan’s CERT Rules already place the National CERT at the center of coordination between federal, provincial, and sectoral response teams, with responsibility for dealing with widespread attacks affecting multiple sectors.

Several sectoral Security Operations Centers have already been linked with the national center, according to information shared on the rollout. Remaining provincial and sectoral CERTs have been instructed to complete the required technical integration and nominate a technical focal person or team within seven days.

Under the proposed operating model, cyber incidents, security alerts, and threat intelligence will be shared with the national center without delay. Data relating to medium- and high-severity cyber incidents is expected to be transmitted on a continuous and real-time basis.

National CERT has previously said that functional SOCs are essential for real-time threat monitoring, detection, analysis, and incident response, and has conducted specialized training for officials from provincial and sectoral CERTs on establishing such centers.

Institution-level Security Operations Centers will also be linked with their respective provincial or sectoral CERTs, creating a layered monitoring structure in which cyber threat information can move from individual organizations to sectoral and provincial teams and ultimately to the national center.

The National CERT’s existing mandate includes national-level incident management, rapid response coordination, and the use of threat intelligence and real-time monitoring to address large-scale cyber incidents.

The new arrangement is expected to improve Pakistan’s ability to identify cyberattacks earlier, coordinate responses across institutions, and maintain a centralized view of threats affecting government bodies, critical infrastructure, and other key sectors.

Pakistan has also been expanding its broader cyber resilience framework through initiatives focused on real-time threat intelligence sharing, automated detection, and stronger coordination between government and industry.

Also read:

NCERT Warns of Rising Supply Chain Cyber Threats to Pakistan’s Critical Infrastructure