Pakistan’s National Cyber Emergency Response Team (National CERT) has issued new instructions requiring government organizations to preserve digital evidence during cybersecurity investigations. The National CERT cybersecurity guidelines, outlined in the National Cybersecurity Handbook 2026–27, warn that altering system records could compromise forensic analysis and make it harder to determine how a cyberattack occurred.
The guidance requires government entities to cooperate with investigations led by National CERT by providing timely physical and administrative access to affected infrastructure, systems and relevant technical records. The measures are intended to help investigators establish the causes of security breaches, assess their impact and develop effective responses to cyber threats.
Digital evidence plays a critical role in modern cybersecurity investigations. System logs, network records and stored data can help investigators reconstruct events, identify vulnerabilities and understand whether unauthorized access occurred.
Government Personnel Warned Against Altering System Logs
One of the central requirements in the handbook is the protection of system records before investigators collect and examine them. Government employees have been instructed not to modify or overwrite system audit logs, firewall records or disk memory dumps connected to an incident.
These records can provide important information about suspicious activities, unauthorized access attempts and changes made to affected systems. If they are altered or deleted, investigators may lose valuable information needed to establish the sequence of events.
The National CERT cybersecurity guidelines also emphasize maintaining a proper chain of custody for affected devices and storage media. This means digital evidence must remain intact, traceable and properly handled throughout the investigation.
A documented chain of custody helps establish where evidence came from, who handled it and whether it remained protected from unauthorized changes. This is particularly important when several technical teams or government departments are involved in responding to an incident.
In addition to preserving records, relevant personnel must provide investigators with operational details, network diagrams and incident timelines. These materials can help security teams understand the affected environment and determine how the breach developed.
Unauthorized Access to Affected Systems Restricted
The handbook also addresses the risks associated with unauthorized interference during an active investigation. National CERT has cautioned government organizations against allowing unverified third-party vendors or unauthorized personnel to access systems that have been isolated because of a cybersecurity incident.
Restricting access can help prevent accidental changes, further damage or interference with evidence collection. It also allows authorized investigators to examine affected infrastructure under controlled conditions.
Government entities are expected to implement emergency containment measures and follow remediation instructions issued by National CERT investigation teams. Such measures may include isolating affected systems or network segments to limit the spread of malicious activity.
The handbook further states that affected services must not be restored and disconnected network segments must not be reconnected until formal security clearance has been granted.
This requirement is intended to prevent potentially compromised systems from returning to operation before security teams have assessed the incident and addressed the relevant risks.
Cybersecurity Incidents Must Be Reported
Reporting cyber incidents through approved channels is another important part of the handbook. The guidance refers to the CERT Rules 2023, under which incidents must be reported through the appropriate organizational, provincial or sectoral CERT structures.
Timely reporting can help relevant authorities coordinate their response, identify patterns across affected organizations and determine whether a threat extends beyond a single system or department.
The National CERT cybersecurity guidelines place responsibility on government organizations to report incidents, protect relevant records and cooperate with authorized investigation teams. These obligations support a coordinated approach to managing cyber threats across public-sector infrastructure.
For government departments, this means cybersecurity incident response must involve more than restoring services. Organizations must also ensure that evidence is protected, technical information is available and recovery activities follow the instructions provided by the relevant security authorities.
Why Digital Forensics Matters for Pakistan
Digital forensics helps investigators determine what happened during a cybersecurity incident, how attackers may have gained access and which systems or services were affected. Preserving reliable evidence can also help organizations identify weaknesses and reduce the likelihood of similar incidents in the future.
For public-sector institutions, compromised systems may affect sensitive information, essential services and the continuity of government operations. Proper investigation procedures can therefore support both immediate incident response and longer-term security improvements.
The handbook’s requirements also highlight the importance of clear responsibilities among government employees, IT teams, external service providers and incident investigators.
Organizations that maintain accurate records and follow established procedures are better positioned to support investigations and make informed decisions about system recovery.
Pakistan’s National CERT has emphasized that protecting digital evidence is a key part of responding to cybersecurity incidents. The National Cybersecurity Handbook 2026–27 sets out expectations for preserving system logs, maintaining the chain of custody, restricting unauthorized access and reporting incidents through approved channels.
By following the National CERT cybersecurity guidelines, government organizations can help investigators establish the facts behind security breaches and support safer, more coordinated recovery efforts. The guidance reinforces a fundamental principle of cybersecurity: systems should not be returned to normal operation until the incident has been properly assessed and the required security clearance has been obtained.
