Pakistan’s National Cyber Emergency Response Team (National CERT) has directed government organizations to preserve digital evidence during cybersecurity investigations, warning that restoring compromised systems or altering system records prematurely could undermine forensic analysis.
The guidance, outlined in the National Cybersecurity Handbook 2026–27, emphasizes the importance of protecting technical evidence following cyber incidents. Government entities are required to cooperate with National CERT-led investigations by providing timely physical and administrative access to affected infrastructure and relevant technical records.
The directive highlights a critical aspect of cybersecurity incident response: identifying how an attack occurred is just as important as restoring normal operations. If evidence is lost or modified before investigators can examine it, determining the source, scope, and impact of a cyberattack may become more difficult.
When a government system is compromised, digital evidence can include system logs, network activity records, access histories, security alerts, and information about suspicious files or processes. These records can help investigators reconstruct events and identify potential vulnerabilities.
Premature changes to affected systems may overwrite logs, remove traces of malicious activity, or alter information needed to establish a reliable timeline. As a result, organizations are being reminded to preserve relevant records and follow appropriate forensic procedures during investigations.
The handbook’s requirements also underline the responsibility of government departments to cooperate with the national cybersecurity response framework. Providing access to affected infrastructure and technical documentation can help investigators assess incidents more efficiently and develop an accurate understanding of what happened.
For public-sector organizations, this approach requires coordination between IT teams, cybersecurity personnel, administrators, and incident response authorities. Departments may need to balance the urgency of restoring essential services with the need to preserve evidence that could be important for investigation and remediation.
This does not mean that compromised systems should remain offline indefinitely. Rather, recovery activities should be coordinated with the appropriate incident response team so that necessary evidence is secured before actions are taken that could destroy or modify it.
A structured response can help organizations determine which systems are affected, identify potential routes of unauthorized access, and reduce the risk of further compromise. It can also support better-informed decisions about removing malicious software, closing security gaps, and safely returning services to operation.
The directive is particularly relevant to government infrastructure because digital systems support a wide range of public services and administrative functions. A cybersecurity incident affecting these systems can disrupt operations and potentially expose sensitive information.
Preserving forensic evidence can also help establish whether an incident resulted from compromised credentials, exploited software vulnerabilities, unauthorized access, or another attack method. The actual cause, however, must be determined through technical investigation rather than assumption.
The National Cybersecurity Handbook 2026–27 therefore places emphasis on evidence preservation and institutional cooperation during cybersecurity investigations. Compliance with these procedures can strengthen incident response and help authorities assess cyber threats more effectively.
As cyber risks continue to affect organizations worldwide, maintaining reliable records and following established investigation procedures remain essential components of cybersecurity preparedness. For Pakistan’s government departments, the guidance reinforces the need to treat evidence preservation as a core part of responding to hacked systems, alongside containment, investigation, and secure recovery.
