Govt Makes Cybersecurity Standards Mandatory for Public and Private Sector

The government has made it mandatory for both public and private sector to adopt cyber security standards to protect critical digital infrastructure. The instruction was issued by the National Computer Emergency Response Team (National CERT) in a new advisory. Vendors, developers and technology partners have been urged to begin compliance immediately. The PSS framework is aligned with global benchmarks such as the U.S. Federal Information Processing Standards (FIPS 140) and the Common Criteria (ISO 15408). The goal is to ensure secure communication, safeguard commerce and public data systems, and reduce the growing risks of cyberattacks and unauthorized access. A statutory notification issued by the Pakistan Standards and Quality Control Authority (PSQCA) in June 2023 already made PSS adoption mandatory across all cryptographic and ICT security functions. Full enforcement across public and private organizations is set for June 1, 2028. However, the directive places a tighter deadline on the defense sector. The National Telecom and Information Security Board (NTISB) has ordered that defense-linked entities implement the standards by December 2025. Systems, devices, and software claiming cybersecurity or encryption functions will not be allowed to be manufactured, sold, or deployed without PSS certification. Vendors and developers have been advised to begin certification processes through accredited security testing laboratories. Government procurement bodies have also been directed to block the purchase of non-compliant products to ensure supply chain security. The advisory calls for coordinated awareness campaigns across industry stakeholders and asks critical sector organizations to alert their suppliers and map out early adoption plans to avoid operational disruption. The government has stressed that standardization is essential to building a resilient national cyber-defense ecosystem.