Pakistan’s National Cyber Emergency Response Team (National CERT) instructed government organisations to protect digital evidence while conducting cybersecurity investigations. Modifying system records during an incident could damage the forensic analysis of a cyberattack, the team warned.
Under the National Cybersecurity Handbook 2026–27, state entities must provide National CERT with administrative access and technical records for affected infrastructure. Staff members are required to keep a strict chain of custody for all storage media and devices involved in a breach.
Employees must refrain from overwriting disk memory dumps, firewall logs, or system audit records until investigators can collect them. National CERT cautioned agencies against letting unauthorised personnel or unverified third-party vendors touch systems that have been isolated for investigation.
Disconnected network segments and affected services must remain offline until formal security clearance is issued. The CERT Rules 2023 mandate that all cybersecurity incidents be reported through official channels, including provincial or sectoral CERTs.
