PKCERT’s National Cybersecurity Handbook Sets Baseline Rules for Government Employees

The National Cybersecurity Handbook, published by the National Cyber Emergency Response Team of Pakistan (PKCERT) under the Ministry of Information Technology, is built for federal and provincial staff, officers, and technical personnel who handle government systems day to day. It runs across eight domains, and buried in the middle of email etiquette and password rules is a domain that reads less like traditional IT policy and more like a response to how office work has actually changed.

Eight Domains, One Underlying Message

The handbook organizes its guidance into secure email use, device security, password security, data security, internet security, removable media, secure remote access, and incident response. Each domain follows the same structure: a short explainer of the relevant threat, a list of required practices, a list of prohibited behaviour, and the specific risks of ignoring both.

Most of it reads as standard government IT hygiene. Employees are told to use only official email accounts for official correspondence, to inspect email headers before trusting a sender, to lock devices when stepping away from a desk, and to avoid connecting personal USB drives to official machines. None of that is new territory for a public-sector cybersecurity guide anywhere in the world.

Where It Gets Specific

A few details stand out for being unusually concrete rather than generic. The handbook names Multi-Factor Authentication push spamming, also called MFA fatigue, as a live threat, warning employees not to approve login prompts they didn’t personally trigger. It also flags “Evil Twin” or rogue Wi-Fi networks that mimic official network names and tells staff to disable auto-connect on their phones and laptops to avoid joining one by accident.

On data handling, the guidance is built around Pakistan’s existing regulatory scaffolding rather than invented from scratch. It ties every instruction back to the Pakistan Information Security Framework (PISF) 2026, requiring employees to classify data before storing or sharing it and to apply access, storage, and disposal controls based on that classification level rather than treating all government information the same way.

The AI Section

The most notable domain is the one on artificial intelligence tools, which didn’t exist in earlier iterations of government cybersecurity guidance in Pakistan. Employees are told to use only AI tools officially approved by their department, to strip names and sensitive details out of prompts before using them, and never to input classified documents, source code, or citizens’ personal data into public AI platforms. AI-generated output also isn’t cleared for unsupervised use. Staff are instructed to review it for accuracy before acting on it, rather than treating it as a finished product.

The inclusion says something about how PKCERT is reading the current threat landscape. Government employees experimenting with AI assistants for drafting, summarizing, or coding is treated not as a hypothetical risk to plan for later, but as something already happening inside government offices that needs a rule now.

Remote Work and Incident Response

The remaining two domains address a workforce that no longer operates entirely from a single building. Remote access is restricted to department-approved VPNs, with explicit instructions to end sessions immediately after finishing official tasks and never share VPN credentials. Video conferencing gets its own set of rules too, including password-protecting meetings, using waiting rooms to screen attendees, and keeping screens angled away from windows and household members during calls from home.

The incident response domain is arguably the most operationally important, because it dictates what an employee does in the first minutes after something goes wrong. Staff are told to isolate a compromised device from the network by unplugging Ethernet and disabling Wi-Fi, but explicitly not to power it off or restart it, since that can destroy the evidence needed for PKCERT’s forensic investigation. Reporting is not optional or discretionary. Under CERT Rules 2023, incidents must be escalated through official channels rather than handled quietly at the department level, and the handbook is direct about why: delayed disclosure gives an intrusion more time to spread before anyone outside the affected office even knows it happened.

Why This Document Matters More Than It Looks

A handbook is an easy thing to dismiss as paperwork, and PKCERT itself concedes it isn’t a fix. The document states plainly that following it does not guarantee protection against sophisticated cyber threats and that departmental IT teams still need to monitor, update, and enforce technical controls independently of what any single employee does.

But that caveat is exactly why the document matters. Pakistan’s public sector has spent the last few years digitizing faster than it has been able to secure what it’s building, a gap that turned concrete just days before this handbook’s release, when the National Cyber Crimes Investigation Agency recovered biometric data belonging to 600,000 citizens in a single raid.

Most large-scale government data exposures don’t start with a nation-state hacking team breaching a firewall. They start with an employee reusing a password, plugging in an unverified USB drive, or copying a sensitive file into a public AI tool because it was faster than asking permission. This handbook is PKCERT’s attempt to close exactly those doors, and the AI section in particular suggests the agency is trying to write policy fast enough to keep pace with how government employees are actually working today, rather than catching up to it after the next breach makes the decision for them. Whether that attempt succeeds now depends entirely on enforcement: a rulebook that sits unread in a drawer protects nobody, and Pakistan’s public sector has a mixed record of turning cybersecurity guidance into consequences when it isn’t followed.