PISF 2026 Compliance Guide — 238 Controls Across 13 Documents
PISF 2026 — the Pakistan Information Security Framework — is Cabinet-approved and the single largest compliance surface identified across Pakistan's entire regulatory landscape: 238 mandatory controls spread across 13 separate documents, covering governance, risk assessment, incident response, business continuity, secure software development, and web-application security.
Mutex Systems has an active audit-firm application in progress with nCERT (PKCERT) and supports government bodies and CII-designated entities through PISF gap assessment and remediation.
- Issuing Body
- nCERT (PKCERT) / Federal Cabinet
- Effective
- 2026
- Maturity
- Published & Enforced
- Applies To
- Federal and provincial government ministries, divisions, and departments, autonomous bodies and corporations, all sectoral CERTs, and any entity formally designated as Critical Information Infrastructure (CII).
Key Requirements
A Practical Compliance Path
- 01
CII Designation Check
Confirm whether the organisation is formally designated as Critical Information Infrastructure under CERT Rules 2023 — this determines the full scope of applicable PISF controls.
- 02
Gap Assessment Against 238 Controls
Map existing governance, technical, and process controls against all 13 PISF documents to identify coverage gaps.
- 03
Remediation & Documentation
Close technical and policy gaps, with each of the 238 controls evidenced individually rather than answered in a single narrative.
- 04
Ongoing Compliance Reporting
Maintain live evidence and reporting as PISF rolls out further across government and CII entities, rather than reconstructing evidence before each review.
How grComply Automates PISF 2026
PISF's 238 controls across 13 documents are imported into grComply as a ControlNode tree, mapped 1:1 to ISO 27001, NIST CSF, and SOC 2 equivalents — so one piece of evidence satisfies PISF and an international standard at once.
- Custom fields capture PISF-specific data — CII designation, SOC readiness — without a code change, via the Dynamic Schema Engine
- Cross-framework mapping means evidence collected once satisfies PISF and an equivalent international control simultaneously
- Private/on-prem deployment model matches the data-locality intent government and CII tenants require
Related Compliance Pages
Common Questions About PISF 2026
What is PISF 2026?
PISF 2026 is a Cabinet-approved cybersecurity framework issued by nCERT (PKCERT), comprising 238 mandatory controls across 13 documents. It sets the security baseline for federal and provincial government bodies, sectoral CERTs, and any entity formally designated as Critical Information Infrastructure.
How many documents and controls make up PISF 2026?
PISF 2026 spans 13 separate documents comprising 238 mandatory controls in total, covering governance, risk assessment, incident response, business continuity and disaster recovery, secure software development lifecycle, and web-application security.
Who is required to comply with PISF 2026?
Federal and provincial government ministries, divisions, and departments, autonomous bodies and corporations, all sectoral CERTs, and any entity formally designated as Critical Information Infrastructure under CERT Rules 2023.
What is the legal basis behind PISF 2026?
CERT Rules 2023, issued by MoITT and nCERT, establish the legal foundation empowering nCERT and PISF, including the formal authority to designate an entity as Critical Information Infrastructure — which determines whether the full PISF control baseline applies.
Where can PISF 2026's full document set be found?
The complete 13-document PISF set is published on nCERT's GRC Policies portal at pkcert.gov.pk/grc-policies.asp.
Can Mutex Systems run a PISF 2026 gap assessment?
Yes. Mutex Systems supports government bodies and CII-designated entities with PISF 2026 gap assessment against the 238-control baseline, with an active nCERT audit-firm application in progress.
Ready for a PISF 2026 Gap Assessment?
Send us your current posture and any inspection or audit deadline. Within two working days you will receive a written response and a proposed scoping call.