Pakistan to establish national Cybersecurity Authority

Pakistan's national Cybersecurity Authority aims to protect critical national systems and citizens’ data
An image of Minister for Information Technology Shaza Fatima Khawaja attending the inauguration ceremony of the 26th ITCN Asia Expo at Expo Centre Karachi, Sindh, September 23, 2025. — X/@MoitOfficial
An image of Minister for Information Technology Shaza Fatima Khawaja attending the inauguration ceremony of the 26th ITCN Asia Expo at Expo Centre Karachi, Sindh, September 23, 2025. — X/@MoitOfficial

Pakistan is preparing to establish a dedicated Cybersecurity Authority to protect critical national systems and citizens’ data.

The authority, while announcing the framework on Thursday, highlighted that this initiative is designed to serve as the central organisation responsible for coordinating national-level cybersecurity efforts.

National Cyber Security Act

In a written reply submitted in the National Assembly, State Minister for IT and Telecom Shaza Fatima Khawaja said the first draft of the National Cyber Security Act has been prepared and shared with relevant public and private stakeholders for review.

The proposed authority is among the significant elements of the 'National Cyber Security Policy-2021', which has formulated a single-point framework to secure digital assets and protect the online data of citizens.

The minister said this initiative is being implemented under the Digital Economy Enhancement Program, which involves large-scale initiatives like the Secure Data Exchange Layer, Digital Identity, and e-Citizen enablement.

The government has already declared the information systems and digital data of the National Database and Registration Authority (NADRA), the Federal Board of Revenue (FBR), and the telecom sector as Critical Information Infrastructure under the Prevention of Electronic Crimes Act (PECA)-2016.

The national guidelines on identifying and protecting Critical Information Infrastructure (CII) have been issued, while the systems of Immigration & Passports are expected to be designated next.

Meanwhile, a Computer Emergency Response Team (CERT) Council is functioning under the CERT Rules 2023 until the Cybersecurity Authority is formed. The council has 14 members from the IT ministry, defence, interior, foreign affairs, telecom operators, academia, civil society, and governmental CERTs. 

To date, the body has several responsibilities concerning handling cyber incidents, improving response mechanisms, and increasing coordination between public and private organisations.