Loading...
SBP Cyber Shield, NCCIA guidelines, ISO 27001 & sector-specific requirements
Navigate Pakistan's cybersecurity legal framework, implement international standards, and protect your business.
Last updated: April 2026 | Source: P@SHA Cloud & Digital Committee
Pakistani IT companies face a unique challenge: growing client expectations for security while operating under evolving local regulations. Whether you serve government tenders, international clients, or domestic businesses, cybersecurity compliance is no longer optional.
of Pakistani orgs experienced cyber incidents in 2024
estimated losses from cybercrime in Pakistan (2024)
max imprisonment under PECA for unauthorized access
The primary cybercrime law in Pakistan. Key sections relevant to IT companies:
| Section | Offense | Penalty | Relevance to IT Company |
|---|---|---|---|
| §3 | Unauthorized access to information system | Up to 3 years, fine up to PKR 1M | If your systems are breached or you breach client systems |
| §4 | Unauthorized copying of data | Up to 3 years, fine | Code/data theft, IP violations |
| §5 | Interference with information system | Up to 3 years, fine up to PKR 1M | DDoS, hacking attacks |
| §6 | Glitch terrorism | Up to 14 years, fine | Critical infrastructure attacks |
| §7 | Electronic fraud | Up to 7 years, fine up to PKR 5M | Payment fraud, phishing |
| §10 | Cyber terrorism | Up to 14 years, fine | Severe cases |
| §16 | Spamming | Up to 1 month, fine PKR 50K | Email marketing compliance |
| §21 | Unauthorized use of identity | Up to 3 years, fine up to PKR 500K | Identity theft, impersonation |
| §34 | Access to critical infrastructure | Up to 3 years, fine | If working on govt/telecom systems |
Pakistan's national CERT under NTISB (National Telecom & Information Security Board). Provides:
| Company Size | Consultant | Certification | Total (PKR) |
|---|---|---|---|
| Small (5-20 staff) | 500K-1M | 300K-500K | 800K-1.5M |
| Medium (20-100 staff) | 1M-3M | 500K-1M | 1.5M-4M |
| Large (100+ staff) | 3M-8M | 1M-2M | 4M-10M |
* One-time costs. Annual surveillance audit: 30-50% of initial certification cost. Timeline: 6-12 months.
| Law | Status | Key Provisions |
|---|---|---|
| PECA 2016 | ✓ Enacted | Unauthorized access, data interference, spam |
| Personal Data Protection Bill (PDPB) | ✓ Draft (2024-25) | Consent, data minimization, cross-border transfer restrictions |
| PTA Consumer Protection Regulations | ✓ Active | Telecom subscriber data protection |
| SBP AML/KYC Guidelines | ✓ Active | Financial data handling |
| Cross-Border Data Transfer Rules | ✓ Limited | Some sector-specific restrictions (banking, telecom) |
Per CRMD CL01/2026, SBP has launched Cyber Shield, the first-ever cyber resilience strategy for all SBP-regulated entities. Key requirements:
Per PSD C4/2025, all PSOs/PSPs and EMIs must comply with the Technology Risk Management (TRM) Framework by March 31, 2026. Key requirements for IT companies:
| Area | Requirement | Impact on IT Companies |
|---|---|---|
| Board Oversight | BoD must have members with technology expertise; Head of IT and Head of InfoSec required | IT governance must be board-level; staffing mandates |
| Cyber Risk Management | Technology risk policy updated every 3 years; vulnerability management; penetration testing | Annual VAPT required; patch management SLAs enforceable |
| Digital Fraud Prevention | NADRA biometric at signup; device fingerprinting/binding; OTP auto-fetch with sender binding; cool-off period 2+ hours on device switch; default transaction limits | Fintech apps must implement device binding, OTP controls, biometric verification |
| Fraud Liability | PI liable for customer losses if dispute not lodged within 30 min; PI liable if complaint channel unavailable; PI liable for delayed transaction alerts | 30-minute dispute response SLA — major operational requirement |
| Outsourcing | 7-day advance notice to SBP for material outsourcing; SBP approval for offshore; cloud per BPRD C1/2023 | IT vendors must comply with SBP cloud outsourcing framework |
| DR & BCP | Recovery Time Objective (RTO) and Recovery Point Objective (RPO) defined; annual BCP testing | Disaster recovery capabilities mandatory with defined RTO/RPO |
Per PSD C1/2023, regulated entities must:
Per PSD C2/2023: Banks/EMIs must not provide digital payment services to unauthorized/unlicensed digital lending apps. This includes: deposit products, mobile app integration, payment gateway services, credit scoring, and fund transfers. IT companies building fintech products must verify licensing status from SBP/SECP before integration.
Per PSD CL6/2022: Banks/EMIs/PSOs must implement secure coding practices, VAPT before app launch, certificate pinning, and runtime integrity checks for all mobile applications.
| Tool | Purpose | Cost |
|---|---|---|
| OpenVAS / Greenbone | Vulnerability scanning | Free |
| Suricata / Snort | IDS/IPS | Free |
| Wazuh | SIEM / XDR | Free (open source) |
| Let's Encrypt | SSL/TLS certificates | Free |
| ClamAV | Anti-malware | Free |
| Fail2Ban | Intrusion prevention | Free |
| Nessus Essentials | Vulnerability scanning | Free (limited) |
| OWASP ZAP | Web app security testing | Free |
| Tool | Purpose | Monthly Cost (USD) |
|---|---|---|
| CrowdStrike Falcon | EDR/XDR | $15-25/endpoint |
| SentinelOne | EDR | $10-20/endpoint |
| Cloudflare | WAF + CDN + DDoS | $20-200/mo |
| Acunetix | Web vulnerability scanning | $2,000-5,000/yr |
| Microsoft Defender | Endpoint + Cloud security | $12/user/mo |