Pakistan proposes moving government websites to local data centres
A draft Pakistan Information Security Framework would pull state websites and apps back from foreign hosts and set mandatory security controls for hosting providers.
The government has proposed a framework that would require public bodies to host their websites and digital applications inside Pakistan. ProPakistani reported the plan on 9 July 2026. It is called the Pakistan Information Security Framework, or PISF.
Under the proposal, any government organisation that hosts a site or app abroad must move it to data centres located within Pakistan. ProPakistani said the framework aims to strengthen the security, resilience and oversight of government digital infrastructure.
The draft goes well beyond location. For networks, it calls for next generation firewalls, intrusion detection and prevention, protection against DDoS attacks, secure backups, security operations centres, SIEM systems and regular third party audits. For email and hosting, it asks for protection against phishing, malware and spam, multi factor authentication for admin, remote and webmail access, email archiving, and the SPF, DKIM and DMARC standards.
Developers and providers are covered too. The framework requires vulnerability assessments, penetration testing and code reviews, and it adds contract clauses giving the government the right to audit developers, hosting firms and cloud providers. Government run data centres would need backup power, environmental monitoring, fire suppression and flood protection.
The report gave no costs, deadlines or quantities. Later coverage by Express Tribune said the framework was under cabinet review and had been presented to parliament, and that authorities had given public and private organisations six months to set up security operation centres. Tribune also reported that more than 90 percent of Pakistan's data is hosted overseas, a figure we could not check independently.
For local data centre operators, cloud providers and security vendors, a binding rule on where state workloads live and how they are protected would create steady demand. It would also raise the bar for anyone selling hosting to government.
Reported from ProPakistani, with background from Express Tribune and PhoneWorld.
