SECP opens a 24 hour security operations centre and eyes a CERT role for capital markets
The corporate regulator inaugurated the centre on 20 October with UK funded support, and plans a shared cybersecurity framework for market institutions.
The Securities and Exchange Commission of Pakistan has set up a Security Operations Center to detect digital threats and respond to attacks on its information systems. NADRA Chairman Lieutenant General Muhammad Munir Afsar inaugurated it on 20 October.
SECP said the centre will continuously monitor its networks, endpoints, servers and private cloud environments, so that key information assets are safeguarded, threats are spotted early and incidents get a fast response. The centre will operate in line with recognised international standards and best practices.
Who built it
Karandaaz Pakistan, the implementing agency for the UK's Foreign, Commonwealth and Development Office (FCDO), funded the project. Inara Technologies, a Pakistani firm, enabled it, and REWTERZ supports the centre under a Managed Security Services Provider agreement. SECP Chairman Dr Kabir Ahmed Sidhu attended with commissioners Imtiaz Haider, Muzaffar Ahmed Mirza and Zeeshan Khattak and other senior officials.
In a separate meeting, Sidhu briefed the NADRA chairman on SECP's IT reforms, infrastructure modernisation and use of artificial intelligence to improve the ease of doing business.
The centre arrives as Pakistan tightens incident reporting. The federal cabinet approved the Pakistan Information Security Framework 2026 in August. Developed by the National CERT under the CERT Rules 2023, it requires verified incidents at critical infrastructure to be reported to the sectoral regulator or CERT and to the national CERT, with a detailed report due within 72 hours. Critical infrastructure operators must also keep incident response plans and test backup restoration.
A shared framework for the market
SECP said it plans to bring capital market institutions into a shared cybersecurity framework, to improve coordination and the sector's ability to respond to digital threats, and to take a more active role as the sectoral Computer Emergency Response Team for Pakistan's capital markets.
The plan fits the national structure the government has been building. On 29 September the National CERT told provincial and sector teams to link their security centres to the National Security Operations Centre, under earlier instructions that set November 2026 for them to be operating. The structure has three tiers: organisational centres connect to provincial or sectoral ones, which in turn share incident data and threat intelligence with the national centre. SECP's own centre is an organisational one, and the sectoral role it seeks would sit a tier above it.
