Header

• Suggested slug: national-cert-hacked-systems-restore-warning
• Category: Technology
• Focus keyphrase: National CERT hacked systems warning
• SEO title: National CERT Warns Against Restoring Hacked Systems (51 chars)
• Meta description: Pakistan’s National CERT has ordered government bodies to preserve digital evidence and avoid restoring hacked systems until security clearance. (144 chars)
• Tags: National CERT Pakistan, cybersecurity, hacked systems, digital evidence, CERT Rules 2023, cyber incident response, Pakistan cybersecurity
• Original element: Our own data point (prior FP coverage) + explainer context — references Feature Pakistan’s existing reporting on the Federal CERT and the NCERT-HEC cybersecurity partnership, plus a plain-language explainer of why premature restoration destroys forensic evidence
• Source: ProPakistani, https://propakistani.pk/2026/10/20/govt-warns-against-restoring-hacked-systems/, 2026-10-20
• Story date: Tuesday, 20 October 2026

National CERT Warns Against Restoring Hacked Systems Before Clearance

Pakistan’s National CERT has directed government organisations to preserve digital evidence after cyberattacks and warned them not to restore or reconnect compromised systems until formal security clearance is granted.

The directive comes under the National Cybersecurity Handbook 2026–27. It applies to all government entities dealing with a hacking incident, and it sets out strict rules for how evidence must be handled while investigators work.

The order follows a pattern seen in several recent incidents where affected offices rushed to get services running again. National CERT says that instinct can destroy the very evidence needed to find how attackers got in.

What government bodies must do

Affected organisations must cooperate fully with National CERT-led investigations and give timely physical and administrative access to affected infrastructure and technical records.

They must maintain a proper chain of custody for affected devices and storage media: a record of who handled each item, when, and why, so the evidence stands up in court.

Officials must not modify or overwrite system audit logs, firewall records or disk memory dumps before investigators collect them. These records show what the attacker did, and losing them can make an attack impossible to trace.

Organisations must hand over operational details, network diagrams and incident timelines, so investigators can map how the breach spread and check whether attackers are still inside.

Outsiders kept away from isolated systems

The directive bars unverified third-party vendors and unauthorised personnel from interfering with systems that have been isolated during an investigation.

Government offices often call outside contractors to fix broken systems, especially in an emergency. National CERT now says such contractors cannot touch isolated machines unless authorised, because well-meaning repairs can overwrite forensic traces.

No restore, no reconnect

The core of the order is simple: affected services must not be restored, and disconnected network segments must not be reconnected, until investigators give formal security clearance.

If a system is restored from a backup before the breach is understood, the attacker may simply return through the same route, and the restored copy can hide the original point of entry forever.

Under the CERT Rules 2023, incidents must also be reported through approved channels, including organisational, provincial or sectoral CERTs. The new directive reinforces that reporting chain, so incidents reach National CERT through the right route rather than through informal contacts.

Why this matters

Feature Pakistan has previously reported on the Federal CERT in Pakistan, which handles cyber threats at the federal level, and on the NCERT-HEC partnership on university cybersecurity, which brings the National CERT into academic institutions.

This directive is the next step: it moves from building institutions to setting operational rules. The emphasis on preserving audit logs and memory dumps shows investigators want forensic-quality evidence, not just an incident report. That is the same discipline that matters at a personal level, as our guide on what to do if your phone is hacked explains for individual users.

The directive also reflects a global lesson. Security teams around the world have found that rushing to restore services after a breach often leads to repeat attacks. Keeping systems offline until the root cause is found is standard practice in mature response programmes, and Pakistan’s rules are now catching up with it.

Readers interested in cyber defence can also read our explainer on what a firewall is and our coverage of WhatsApp hacking alerts in Pakistan for practical context on how attacks unfold.

FAQ

What is the National CERT?

The National Computer Emergency Response Team (CERT) is Pakistan’s national body for handling cybersecurity incidents. It coordinates investigations, issues directives and works with sectoral and provincial CERTs across the country.

What does “chain of custody” mean?

It is a documented record of who handled a piece of evidence, when, and why. For digital evidence, it covers devices, storage media and the logs taken from them. A broken chain can make evidence unreliable in court.

What are the CERT Rules 2023?

They are the legal rules that require organisations to report cyber incidents through approved channels, including organisational, provincial or sectoral CERTs, rather than through informal routes.

Can a hacked government system be turned back on?

Not until National CERT gives formal security clearance. The directive states that affected services must not be restored and disconnected network segments must not be reconnected before that point.

What should an organisation do first after discovering a hack?

Isolate the affected systems, preserve logs and records without modifying them, report the incident through approved CERT channels, and cooperate with the National CERT-led investigation.