Pakistan’s National Cyber Emergency Response Team (National CERT) has directed government organizations to preserve digital evidence during cybersecurity investigations, warning that changes to system records could compromise forensic analysis of cyber incidents.
Under the National Cybersecurity Handbook 2026–27, government entities are required to cooperate with National CERT-led investigations by providing timely physical and administrative access to affected infrastructure and relevant technical records.
The guidelines state that detailed investigations and digital forensics are essential to determine the causes of security breaches, assess their impact and help contain cyber threats.
Don’t Alter System Logs
The handbook instructs government personnel to maintain a proper chain of custody for affected devices and storage media so that digital evidence remains intact and traceable throughout an investigation.
Employees have been advised not to modify or overwrite system audit logs, firewall records or disk memory dumps before investigation teams collect them. Such changes could undermine efforts to reconstruct incidents and establish how a breach occurred.
Relevant personnel must also provide investigators with operational details, network diagrams and timelines of the incident to support the forensic process.
Unauthorized Access Restricted
National CERT has cautioned government entities against allowing unverified third-party vendors or unauthorized personnel to interfere with systems isolated during an active investigation.
Organizations have also been instructed to implement emergency containment measures and remediation guidance issued by National CERT investigation teams.
According to the handbook, affected services must not be restored and disconnected network segments must not be reconnected until formal security clearance has been granted. The requirement is intended to prevent systems from returning to operation before investigators and security teams have addressed the incident.
Cyber Incidents Must Be Reported
The handbook also refers to the CERT Rules 2023, under which cybersecurity incidents must be reported through approved channels, including organizational, provincial or sectoral CERTs.
The reporting and evidence-preservation requirements form part of the procedures intended to help authorities investigate cyber incidents, identify vulnerabilities and coordinate responses across government organizations.
The guidance places responsibility on government entities to protect relevant records, provide investigators with the information they need and follow containment and recovery instructions until clearance is issued.
The post Govt Warns Against Restoring Hacked Systems appeared first on ProPakistani.