The government has directed public sector organizations to preserve digital evidence during cybersecurity investigations, warning against altering system logs, firewall records and other technical data needed for forensic analysis.

According to Pakistan’s National Cybersecurity Handbook (2026-27), government entities must provide timely physical and administrative access to affected infrastructure and relevant system records to support investigations led by the National Cyber Emergency Response Team (National CERT).

The handbook states that detailed investigations and digital forensics help identify the causes of security breaches, assess their impact and support efforts to contain cyber threats.

Government personnel have been instructed to maintain a proper chain of custody for affected devices and storage media. They must not alter or overwrite system audit logs, firewall records or disk memory dumps before investigation teams collect the evidence, as changes could compromise forensic analysis.

The guidelines also require relevant officials to provide investigators with operational details, network diagrams and incident timelines. Unverified third-party vendors and unauthorized personnel must not be allowed to tamper with quarantined systems during an active investigation.

Government entities must also implement emergency containment measures and remediation guidelines issued by National CERT investigation teams. Affected services must not be restored, and disconnected network segments must not be reconnected, until formal security clearance is granted.

The handbook further refers to the CERT Rules 2023, under which cybersecurity incidents must be reported through approved channels, including organizational, provincial or sectoral CERTs.