(Web Desk) – Amid rising digital and cyber threats, the government has decided to set up a federal-level National Cybersecurity Authority. The new authority will recommend security measures for the country’s critical digital infrastructure and oversee the implementation of cybersecurity initiatives nationwide. The Ministry of IT has already drafted the Cybersecurity Act and shared it with relevant stakeholders for feedback.

Meanwhile, work on the National Cybersecurity Policy, part of the Digital Economy Enhancement Programme, is progressing. The decision comes after the Ministry of Information Technology admitted in September that Pakistan has suffered several major cyberattacks and data breaches in recent years. In a report to the National Assembly, the ministry noted that full details could not be publicly disclosed due to the sensitivity of the matter but could be provided in a closed-door briefing. The report highlighted key challenges, including a shortage of skilled personnel, weak monitoring systems, and inadequate institutional reporting — factors that allow many cyber incidents to go undetected.

One major breach involved the Oil and Gas Development Company Limited (OGDCL), where hackers accessed the core data centre and deleted 21 virtual servers. The company recovered operations after three days using its disaster recovery setup. The ministry identified several root causes behind such attacks: insufficient funding, lack of dedicated cybersecurity staff, weak oversight from senior management, and the absence of a robust governance framework. At the same time, documents from the Ministry of IT show progress on the Secure Data Exchange Layer and digital identity projects.

Data of key organisations such as Nadra, FBR, and telecom operators has been designated as critical digital infrastructure, making its protection a top government priority. Immigration and Passport systems are also being considered for the same status. Until the Cybersecurity Authority becomes fully operational, the CERT Council — consisting of 14 public and private institutions — continues to coordinate cyberattack response efforts.