National CERT issues advisory to protect personal information

ISLAMABAD: The National Cyber Emergency Response Team (National CERT) has issued instructions to all government and private institutions and individuals across Pakistan to take immediate and effective measures to protect the Personal Identifiable Information (PII) of Pakistani citizens.

In this regard, the National Cyber Emergency Response Team (CERT) has issued an advisory to institutions and citizens to protect personal information.

These instructions from the National CERT have come at a time when the country is witnessing an alarming increase in incidents of data theft, identity fraud, and privacy violations.

According to the National CERT, these instructions will apply to every institution that collects, stores, processes, or transfers the personal data of citizens, including all types of infrastructure, whether on-premises, cloud-based, or hybrid.

The Cyber Security Policy 2021 has declared the protection of citizens’ data as a matter of national security and public trust.

It has been observed that due to weak internal controls, outdated and insecure systems, unencrypted data transmission, installation of suspicious applications, and poor cyber habits, organizations are facing risks of financial fraud, operational disruption, reputational damage, and legal action.

In particular, incidents of leakage of identity card numbers, medical records, and financial information are severely affecting the trust of citizens and putting them at risk of exploitation by criminal and hostile elements.

Organizations have been directed to immediately classify data according to sensitivity, implement strict access controls, encrypt data during storage and transit, and keep all software and systems updated.

Furthermore, they have been urged to adopt a secure development lifecycle, create clear breach response protocols to retain data only following legal requirements, and ensure audits of third-party vendors.

The long-term strategy includes implementing Zero Trust principles, preparing for disaster recovery, and regular employee training and testing.

The National CERT has also advised citizens to be vigilant about protecting their personal information.

Citizens should only provide their identity cards or other personal documents when necessary and clearly state the nature of use on their copies, for example, “For SIM registration only.”

It has been made mandatory to use strong and unique passwords for all important accounts, as well as to enable multi-factor authentication.

Citizens have also been asked to avoid sharing personal information with unverified service providers or informal sources and not download suspicious or unofficial applications.

The National CERT has emphasized that the protection of personal data is not just a legal requirement but a strategic necessity.

Institutions and individuals should take urgent and serious steps to secure citizens’ data, defend the national digital infrastructure, and restore public trust in Pakistan’s cyber ecosystem.