Pakistan has stepped up efforts to connect provincial and sectoral cyber response teams with its national cyber monitoring system.
The National Computer Emergency Response Team (NCERT) has directed all provincial and sectoral Computer Emergency Response Teams (CERTs) to accelerate the establishment of dedicated Security Operations Centres (SOCs).
The teams must also connect their SOCs with the National Security Operations Centre (NSOC). The move aims to strengthen coordination and improve the flow of cyber threat information across different levels.
CERTs Face November Deadline
CERTs that have not established their SOCs must now complete the process on priority. The same applies to teams that have established SOCs but have not connected them with the NSOC.
The official directive follows earlier instructions requiring provincial and sectoral CERTs to establish their SOCs within six months. These centres are expected to become operational by November 2026.
The process falls under the CERT Rules, 2023 and the National Cyber Security Policy, 2021. Pakistan’s cyber-security framework uses national, sectoral and organisational levels for coordination and protection.
NSOC to Provide National Cyber Threat Visibility
NCERT has established the NSOC as the first tier of Pakistan’s national cyber monitoring structure.
The centre is operating around the clock to monitor, correlate and coordinate information about cyber threats. Meanwhile, several sectoral CERTs have already connected their SOCs with the national centre.
These centres are sharing telemetry, cyber incident feeds and threat intelligence with the NSOC in near real time.
As a result, the system is designed to improve coordination between different cyber-security teams. It can also help provide a broader picture of threats affecting Pakistan’s digital infrastructure.
Dedicated Teams Ordered for Integration
CERTs that have yet to establish or connect their SOCs have been told to complete the process on priority.
They must additionally nominate dedicated technical focal persons or teams for the integration process. Their details must reach NCERT within seven working days of the directive’s issuance.
The CERTs must also maintain continuous, real-time sharing of high- and medium-severity incident logs. They are required to share alerts and relevant threat intelligence with the NSOC as well.
This information-sharing mechanism is intended to help national authorities monitor cyber incidents across different sectors more effectively.
Pakistan’s Three-Tier Cybersecurity Structure
NCERT has further directed organisational SOCs operating at Tier 3 to connect with their respective provincial or sectoral SOCs at Tier 2.
The structure places the national centre at Tier 1. Provincial and sectoral SOCs operate at Tier 2, while organisational SOCs form the third tier.
This arrangement is designed to create an end-to-end system for monitoring cyber threats. Therefore, information can move from individual organisations through provincial or sectoral teams to the national level.
Pakistan’s National Cyber Security Policy already envisions a coordinated structure involving the national CERT and security operations centre at the national level. It also provides for sectoral CERTs and organisational-level cybersecurity arrangements.
What the New Directive Means for Pakistan’s Cybersecurity
The latest instructions place greater emphasis on connecting Pakistan’s existing cyber-response infrastructure.
While several sectoral CERTs have already integrated their SOCs, others now face a November deadline to complete the process.
The focus remains on real-time information sharing, dedicated technical teams and stronger coordination between the three levels. Consequently, the planned structure could give national authorities greater visibility across Pakistan’s digital environment.
For now, the immediate priority is clear: CERTs without operational SOCs or national connectivity must accelerate their integration before the November deadline.
For the latest updates, visit and follow The Truth International website (www.thetruthinternational.com) and subscribe to the YouTube Channel.
