In March 2026, a Pakistani broadcaster, Khyber News, experienced a cyber-attack aimed at disrupting its live transmission. It was not an isolated incident. Several networks reportedly faced similar disruptions around the same period, and PEMRA responded by issuing a nationwide security advisory, directing satellite licence holders to review their uplink facilities, upgrade encryption protocols, and strengthen monitoring and intrusion detection.
That advisory did not appear out of nowhere. It sits inside a broader, pre-existing regulatory structure: PKCERT compliance for TV channels, enforced through the Pakistan Information Security Framework (PISF). If you run or manage a PEMRA-licensed channel, this is the framework that will determine how prepared, and how exposed, your organization is the next time an incident like this happens.
This guide walks through what PISF actually requires, why enforcement is tightening now, and what a broadcaster needs to do in practice, not just on paper.
Why This Is Happening Now
Broadcast infrastructure is an attractive target precisely because disruption is visible and immediate. Unlike a quiet data breach, a live transmission outage is public within minutes. That makes TV channels a high-value target for actors looking to make a statement, and it is part of why PKCERT, Pakistan’s National Cyber Emergency Response Team, treats broadcast media as critical infrastructure rather than an ordinary commercial sector.
PKCERT was formally established in March 2024 under Pakistan’s CERT Rules 2023, as the country’s central authority for coordinating cybersecurity across critical sectors. Broadcast media, regulated day-to-day by PEMRA, is one of roughly 30 industries that fall under PKCERT’s oversight. Rather than leaving cybersecurity to each channel’s discretion, PKCERT enforces a shared baseline through PISF, and PEMRA is the body that carries that enforcement down to individual licensees.
What the Pakistan Information Security Framework (PISF) Actually Requires
PISF is not a single document a channel signs once. It is an ongoing compliance structure built around three pillars, each with its own deliverable and its own operational burden.
Pillar 1: Cybersecurity Gap Assessment
This is the diagnostic stage. A proper gap assessment for a broadcaster typically examines:
- Network architecture and segmentation between broadcast systems, corporate IT, and public-facing systems
- Uplink and satellite transmission security, including encryption standards in use
- Access controls: who can reach playout systems, master control, and content management platforms, and how that access is authenticated
- Patch and vulnerability status across servers, workstations, and broadcast-specific hardware
- Incident response readiness: whether the channel could actually detect and contain an attack in progress, not just recover afterward
The output isn’t just a checklist. It’s a formal gap assessment report, benchmarked against PISF criteria, that a channel needs to be able to produce if PEMRA asks for it.
Pillar 2: Cybersecurity Monitoring
Monitoring is where many organizations underinvest, because it looks similar to a one-time purchase but functions as an ongoing service. A SIEM (Security Information and Event Management) platform aggregates logs from across the network, network devices, servers, and broadcast systems, and correlates them to flag suspicious patterns: an unusual login at 3 a.m., repeated failed authentication attempts on an uplink control system, unexpected outbound traffic.
The distinction that matters here: a SIEM tool sitting on a server generating alerts nobody reads provides essentially no protection. PISF’s monitoring requirement is really a requirement for a monitored capability, meaning trained people watching, triaging, and responding to what the tooling surfaces, ideally around the clock, since attacks aimed at live broadcast disruption are not going to wait for business hours.
Pillar 3: A Dedicated Security Team
PISF requires broadcasters to have named accountability for security: a Chief Information Security Officer (CISO) setting strategy and owning risk decisions, and Information Security Officers (ISOs) handling day-to-day security operations, monitoring response, and coordination with PKCERT or PEMRA when needed.
For a large network, this might be a full in-house department. For a mid-sized or regional channel, hiring a full-time CISO and a supporting ISO team is often not realistic financially, and PISF explicitly allows this requirement to be met through outsourced or virtual arrangements instead. This is a genuine operational decision, not a shortcut: a shared virtual CISO with cross-industry experience often brings more relevant incident exposure than a first-time, in-house hire would.
What “Interim Controls” Actually Means
Full PISF compliance, gap assessment, live monitoring, and a functioning security team, takes real time to stand up properly. In the meantime, PKCERT and PEMRA have indicated that channels should not simply wait; they should implement whatever quick, practical controls are already available. In practice, that usually means:
- Enforcing multi-factor authentication on any remote access to broadcast or network systems
- Reviewing and revoking unused or excessive user access to playout and master control systems
- Applying outstanding security patches to internet-facing systems
- Confirming encrypted, redundant backups exist for critical broadcast configuration and content systems
- Reviewing uplink encryption settings against current standards, rather than assuming legacy configurations are still adequate
None of these replace a full gap assessment or SIEM deployment, but they measurably reduce risk while the larger program is being built, and they demonstrate good faith if PEMRA reviews a channel’s compliance progress.
How Catalyic Security Helps Broadcasters Meet PISF Requirements
Meeting all three PISF pillars in-house, on top of running a broadcast operation, is a significant lift for most channels. Catalyic Security is built to take that burden on directly:
- We run the PISF gap assessment against your network, uplink, and broadcast infrastructure, and deliver a report ready for PEMRA submission
- We implement and operate SIEM-based monitoring as a managed service, so detection and response are continuous, not a dashboard nobody watches
- We provide a virtual CISO and outsourced Information Security Officers, so channels without an in-house security function can still meet the security-team requirement
- We help identify and implement interim controls immediately, closing the most urgent gaps while the full program is being built
With over 20 years of cybersecurity experience, 500+ organizations supported across Pakistan and globally, and certified experts holding CISSP, OSCP, CEH, and CISA credentials, Catalyic Security is positioned to carry PISF compliance end to end, so your team can stay focused on broadcast operations rather than building a security department from scratch.
Next Steps for TV Channels
If your channel has not yet started on PISF compliance, follow these steps in order:
- Confirm your current compliance status. Check whether a gap assessment has already been requested or scheduled for your channel by PEMRA or PKCERT.
- Put interim controls in place now. Apply the quick fixes above immediately rather than waiting for the full framework rollout.
- Commission a formal PISF gap assessment. Have your systems, network, and broadcast infrastructure assessed against PISF criteria, and prepare the resulting report for PEMRA.
- Stand up cybersecurity monitoring. Deploy a SIEM solution and ensure it is actively monitored, not just installed.
- Assign accountability for security. Designate a CISO and ISOs, in-house or through a virtual or outsourced arrangement, to own PISF compliance on an ongoing basis.
- Keep documentation audit-ready. Maintain records of your assessment, monitoring setup, and security team structure so you can respond quickly if PEMRA requests evidence.
Catalyic Security can take on any or all of these steps for your channel. Get in touch to request a PISF gap assessment.
FAQ
Does PISF apply to radio and digital-only outlets, or just TV channels?
PKCERT’s mandate covers roughly 30 industries broadly, and broadcast media as a sector is in scope. TV channels are the primary focus of current PEMRA enforcement activity, but radio and digital broadcast operations sitting under PEMRA licensing should not assume they are exempt.
Is there a hard deadline for compliance?
PEMRA’s advisories to date have framed this as an active, ongoing requirement rather than a single filing deadline, with channels expected to submit gap assessment reports and show progress on monitoring. Channels should treat this as urgent rather than wait for a fixed date, since enforcement actions can follow an incident, not just a missed deadline.
Can one gap assessment satisfy PISF permanently?
No. Threats, systems, and infrastructure all change. A gap assessment reflects a point in time, and PISF’s intent is an ongoing security posture, which is why monitoring and a standing security team are separate, continuous requirements rather than one-time deliverables.
What’s the actual risk of not complying?
Beyond the operational risk of an undetected or unmitigated cyber-attack disrupting live broadcast, non-compliant channels risk regulatory action from PEMRA, since PISF compliance is tied to the licensing relationship between broadcasters and the regulator.