Cybersecurity Compliance Guide — P@SHA Policy Portal

1. Why Cybersecurity Compliance Matters

Pakistani IT companies face a unique challenge: growing client expectations for security while operating under evolving local regulations. Whether you serve government tenders, international clients, or domestic businesses, cybersecurity compliance is no longer optional.

73%

of Pakistani orgs experienced cyber incidents in 2024

PKR 2.5B+

estimated losses from cybercrime in Pakistan (2024)

3 years

max imprisonment under PECA for unauthorized access

Regulatory Bodies

Body	Role	Website
FIA Cyber Crime Wing	Investigation & prosecution	cybercrime.gov.pk
NCERT (PakCERT)	National incident response	cert.org.pk
NTISB (MoITT)	Policy & strategy	moitt.gov.pk
PTA	Telecom sector security	pta.gov.pk
SBP	Financial sector cybersecurity	sbp.org.pk

2. PECA 2016 — Prevention of Electronic Crimes Act

The primary cybercrime law in Pakistan. Key sections relevant to IT companies:

Section	Offense	Penalty	Relevance to IT Company
§3	Unauthorized access to information system	Up to 3 years, fine up to PKR 1M	If your systems are breached or you breach client systems
§4	Unauthorized copying of data	Up to 3 years, fine	Code/data theft, IP violations
§5	Interference with information system	Up to 3 years, fine up to PKR 1M	DDoS, hacking attacks
§6	Glitch terrorism	Up to 14 years, fine	Critical infrastructure attacks
§7	Electronic fraud	Up to 7 years, fine up to PKR 5M	Payment fraud, phishing
§10	Cyber terrorism	Up to 14 years, fine	Severe cases
§16	Spamming	Up to 1 month, fine PKR 50K	Email marketing compliance
§21	Unauthorized use of identity	Up to 3 years, fine up to PKR 500K	Identity theft, impersonation
§34	Access to critical infrastructure	Up to 3 years, fine	If working on govt/telecom systems

⚠️ 2025 Amendments: PECA was amended in 2025 to strengthen penalties for data breaches and introduce mandatory breach notification requirements for organizations handling sensitive data. Verify current text with FIA.

3. PTA Cybersecurity Guidelines

For IT Service Providers

Licensee Security: All telecom/ISP licensees must maintain security policies
Incident Reporting: Security incidents must be reported within 72 hours
Data Retention: Traffic data retention for 1 year (under telecom regulations)
Audit Requirements: Annual security audits for licensees
VAPT: Vulnerability assessment and penetration testing mandatory

For Government IT Vendors

VAPT clearance from Category 1/2 firm before deployment
Data classification and handling procedures
Secure coding practices
Background verification of development staff
Source code escrow for critical systems

4. NCERT / PakCERT

National Computer Emergency Response Team

Pakistan's national CERT under NTISB (National Telecom & Information Security Board). Provides:

Incident Response: 24/7 support for cyber incidents
Advisories: Vulnerability alerts and threat intelligence
Coordination: International CERT coordination
Training: Cybersecurity awareness programs

When to Contact PakCERT

Your systems are compromised
You discover a vulnerability in systems you manage
You receive threat intelligence about attacks on Pakistani targets
You need guidance on incident response

Contact PakCERT

Website: cert.org.pk

Email: cert@cert.org.pk

Hotline: Available via MoITT

5. ISO 27001 — Information Security Management

Why Get ISO 27001?

Required for many government tenders (PPRA, PTA)
International client requirement
Competitive advantage
Demonstrates security maturity

Implementation Steps

Step 1: Gap Assessment (2-4 weeks)

Step 2: ISMS Framework Design (4-6 weeks)

Step 3: Risk Assessment (3-4 weeks)

Step 4: Policy & Control Implementation (8-12 weeks)

Step 5: Internal Audit (2 weeks)

Step 6: Certification Audit by accredited body (2-4 weeks)

Estimated Costs

Company Size	Consultant	Certification	Total (PKR)
Small (5-20 staff)	500K-1M	300K-500K	800K-1.5M
Medium (20-100 staff)	1M-3M	500K-1M	1.5M-4M
Large (100+ staff)	3M-8M	1M-2M	4M-10M

* One-time costs. Annual surveillance audit: 30-50% of initial certification cost. Timeline: 6-12 months.

6. Data Protection in Pakistan

Current Legal Framework

Law	Status	Key Provisions
PECA 2016	✅ Enacted	Unauthorized access, data interference, spam
Personal Data Protection Bill (PDPB)	🔄 Draft (2024-25)	Consent, data minimization, cross-border transfer restrictions
PTA Consumer Protection Regulations	✅ Active	Telecom subscriber data protection
SBP AML/KYC Guidelines	✅ Active	Financial data handling
Cross-Border Data Transfer Rules	⚠️ Limited	Some sector-specific restrictions (banking, telecom)

Best Practices (Until PDPB is Enacted)

Appoint a Data Protection Officer (even if not legally required)
Maintain data processing records
Implement consent mechanisms for user data collection
Ensure data encryption (at rest and in transit)
Conduct privacy impact assessments for new projects
Define data retention policies
Include data protection clauses in client contracts
Train staff on data handling procedures

7. Cybersecurity Compliance Checklist

Immediate (This Month)

Enable 2FA on all critical accounts (hosting, email, banking)

Review and update server firewall rules

Install SSL/TLS certificates on all web properties

Implement backup policy (daily automated, off-site)

Update all software (CMS, plugins, frameworks)

Short-term (1-3 Months)

Conduct basic VAPT scan (use free tools: OpenVAS, Nikto)

Draft incident response plan

Implement DMARC, SPF, DKIM for email

Staff cybersecurity awareness training

Implement endpoint protection on all company devices

Medium-term (3-12 Months)

Start ISO 27001 implementation

Conduct third-party VAPT (Category 1/2 firm)

Implement SIEM or log management

Register with PakCERT for alerts

Implement Zero Trust architecture for sensitive systems

8. Security Tools & Costs

Free/Open Source

Tool	Purpose	Cost
OpenVAS / Greenbone	Vulnerability scanning	Free
Suricata / Snort	IDS/IPS	Free
Wazuh	SIEM / XDR	Free (open source)
Let's Encrypt	SSL/TLS certificates	Free
ClamAV	Anti-malware	Free
Fail2Ban	Intrusion prevention	Free
Nessus Essentials	Vulnerability scanning	Free (limited)
OWASP ZAP	Web app security testing	Free

Paid (Recommended for Production)

Tool	Purpose	Monthly Cost (USD)
CrowdStrike Falcon	EDR/XDR	$15-25/endpoint
SentinelOne	EDR	$10-20/endpoint
Cloudflare	WAF + CDN + DDoS	$20-200/mo
Acunetix	Web vulnerability scanning	$2,000-5,000/yr
Microsoft Defender	Endpoint + Cloud security	$12/user/mo

9. Frequently Asked Questions

Not always mandatory, but increasingly required in PPRA tender evaluation criteria. IT companies with ISO 27001 get preference in technical evaluation. PTA and MoITT tenders often require it or equivalent security certifications.

Under PECA 2016, if a breach affects client data, you may face legal liability. Report to FIA Cyber Crime Wing and PakCERT. Document the incident thoroughly. Engage legal counsel immediately. Notify affected clients per your contractual obligations.

Government projects mandatorily require VAPT from a Category 1/2 certified firm before deployment. For private projects, it depends on the contract. Best practice: conduct VAPT at least annually for all production systems.

GDPR applies if you process data of EU residents, regardless of your location. If you serve European clients, you must comply with GDPR requirements including data protection officer appointment, consent mechanisms, and data transfer safeguards. Pakistani PDPB (when enacted) will have similar requirements.

Cybersecurity Compliance Guide for Pakistani IT Companies