Check What PTA's 2026 DDoS Rules Require From Your Internet Provider in Pakistan

Short answer: PTA's 2026 DDoS guidelines tell every telecom licensee, including internet providers, to detect an attack within 60 seconds, start blocking within 120 seconds and report to the national telecom CERT within 24 hours. They also push providers to secure the routers they give you. The text sets no refund for subscribers.

A DDoS attack floods a website or network with fake traffic until real users cannot get in. When it hits a provider, your internet slows down or drops for everyone on that network. PTA's Cyber Security Directorate has now written down what providers must do about it.

We downloaded the 15 page PDF from PTA's guidelines page on 14 October 2026 and read it from the first page to the last. PTA lists it with the date 27 February 2026.

PTA sets fixed time targets for every provider

The guidelines give one table of targets: detect an attack in 60 seconds, activate blocking in 120 seconds, reach full mitigation in 30 minutes where technically feasible, and report to the national telecom CERT within 24 hours. Latency may rise by no more than 150 ms on average.

nTCERT is the National Telecom Computer Emergency Response Team, a sector team that PTA says watches telecom networks for cyber threats. Its 24 hour operations arm is called nTSOC.

These are targets for the provider, not promises to you. We found no clause that gives a subscriber money back or a right to complain about a missed target.

The guidelines apply to licensees, not to home users

The text covers licensees, internet gateways and internet exchange points. Mobile operators and internet providers must run detection and blocking for incoming and outgoing traffic, either in house or through an upstream provider, and cover business and data centre traffic as well as home lines.

PTA also asks providers to share summary traffic data with nTCERT in near real time and to keep a 24 hour monitoring desk with named contact points. They must join national drills.

The document says many major operators already run anti-DDoS tools, but that many of these use older technology that may miss new attack types. It also says Pakistan depends on a small number of undersea cable landing stations and exchange points, which raises the risk of a large outage. We cover one real outage in our report on the fibre cut that hit Islamabad and Rawalpindi, which had a different cause.

Providers must stop their own customers' devices from joining attacks

PTA says outbound attacks are to be cut mainly by anti-spoofing filters, safe routing practice and secure customer routers. It asks providers to require security standards from router makers, naming the ioXt Alliance guidelines or an equivalent, so that weak devices do not become part of a botnet.

A botnet is a group of hacked devices, such as routers and cameras, that an attacker controls. The guidelines list the common tricks: spoofed source addresses, and open servers that bounce and multiply traffic.

This is the part that touches your home. A router with a default password can be taken over without you noticing. Our guide on securing your home Wi-Fi router shows the admin password, firmware and encryption steps in order.

Providers get 6, 12 and 18 months to finish the work

The roadmap has four phases counted from the date of issue: basic hardening within 6 months, joint operation with nTCERT within 12 months, planning for a national scrubbing service within 18 months, and yearly audits after that. PTA calls the first three timelines the latest allowed dates.

1. Phase 1, within 6 months: detection and blocking in place, anti-spoofing filters, 24 hour contacts, written escalation steps.
2. Phase 2, within 12 months: alerts shared with nTCERT, joint drills, route origin validation known as RPKI.
3. Phase 3, within 18 months: plan a national clearing house for attack traffic, widen traffic monitoring at exchange points.
4. Phase 4, continuous: annual audits, live drills and reviews after each incident.

If we count from 27 February 2026, the six month mark fell in late August 2026, the twelve month mark falls in late February 2027 and the eighteen month mark in late August 2027. That is our arithmetic, and PTA's page does not state a start date inside the PDF. We found no public report that says which providers have met phase 1.

What you can do as a subscriber

You cannot audit a provider's DDoS defences, but you can lock your own router, measure your own speed and complain through the proper route when the line drops. Keep records of when the problem began, because a complaint with times and speed readings is easier to act on.

• Change the router admin password and turn off remote administration if you do not use it.
• Run a speed test during the slowdown and again later. PTA's own speed test method gives numbers the regulator recognises.
• Check that your provider holds a licence in PTA's list of licensed internet providers.
• File the problem through PTA's slow internet complaint route after you have tried the provider's own helpline.

The guidelines also back local peering, which keeps traffic between Pakistani networks inside the country. We explain the rule in PTA's local peering rules.

Common questions

What is a DDoS attack in simple words?

It is a flood of fake requests sent from many hacked devices at once. The target cannot answer real users, so the service slows or stops.

Does PTA promise compensation if a DDoS attack cuts my internet?

No. We read the full text and found no refund or compensation clause. The guidelines place duties on providers and give PTA audit powers.

Who must follow these guidelines?

PTA's licensees, which include mobile operators and internet providers, plus internet gateways and exchange points. Individual subscribers have no duties under the text.

How fast must a provider block an attack?

PTA's target is detection in 60 seconds and blocking activation in 120 seconds. Full mitigation is to come within 30 minutes where technically feasible.

Can my own router be used in an attack?

Yes, if it has a default password or old firmware. PTA wants providers to require security standards from router makers because such devices feed botnets.

Where do I report a cyber problem?

See our guide on reporting a cyber problem to PKCERT or NCCIA for the right office.

How we verified this

What we checked, where we read it, and what we could not confirm.

Last checked on 14 October 2026. Source: PTA, Guidelines for Mitigation of Distributed Denial of Service (DDoS) Attacks, Cyber Security Directorate, 15 pages, listed on pta.gov.pk under Consumer Facilitation guidelines with the date 27 February 2026. We did not test any provider, and we could not confirm whether the guidelines have been formally notified as binding regulations beyond PTA's description of them as mandatory for licensees.