Pakistan to Move Govt Websites to Local Data Centers
Muhammad Naeem:
Islamabad:The Government of Pakistan has unveiled a proposed cybersecurity framework that would require all government organisations hosting their websites and digital applications overseas to relocate them to data centres within the country.
The requirement is part of the proposed Pakistan Information Security Framework (PISF), which aims to strengthen the security, resilience, and oversight of government digital infrastructure.
Under the proposed framework, government-operated data centres, email services, and web hosting platforms will be required to meet a range of mandatory cybersecurity standards.
Organizations will need to implement network security measures, including next-generation firewalls, intrusion detection and prevention systems, distributed denial-of-service (DDoS) protection, secure backup mechanisms, vulnerability management, continuous monitoring through Security Operations Centres (SOC), Security Information and Event Management (SIEM) systems, and regular third-party security audits.
tronger Protection
The framework also introduces stricter security requirements for government email and hosting services.
Organizations will be required to deploy advanced protection against phishing, malware, and spam, while enabling multi-factor authentication for administrative, remote, and webmail access. The framework also requires email archiving and backup capabilities, advanced persistent threat detection, and domain authentication protocols, including SPF, DKIM, and DMARC, to improve the security and integrity of government communications.
Secure Development Requirements
The proposed PISF requires all internal and public-facing web applications to follow secure design principles and secure software development practices.
Government organizations must carry out regular vulnerability assessments and penetration testing, use supported and securely configured software components, implement strong authentication and session management, and complete code reviews and security testing before applications are deployed.
The framework also makes organizations responsible for ensuring that developers, hosting providers, and cloud service providers comply with contractual security requirements and right-to-audit provisions.
Data Centre Protection Measures
The proposed controls also introduce environmental and operational safeguards for government data centres.
Organizations will be required to maintain resilient power supplies, backup generators, environmental monitoring systems, fire detection and suppression systems, and protection against flooding, water leakage, and other physical hazards.
The framework also requires organisations to document maintenance procedures, conduct regular testing of environmental control systems, and investigate any incidents affecting data centre operations to strengthen risk management and ensure regulatory compliance.
