SECP Cybersecurity Guidelines for Listed Companies and NBFCs

Typical Guideline Themes

• Board and senior management accountability for cyber risk
• Policies, asset management, and access control
• Monitoring, incident response, and reporting readiness
• Third-party and technology outsourcing oversight

Listed Companies vs NBFCs

Both need demonstrable programmes; intensity scales with size, customer impact, and technology dependence. Align market-disclosure and material-incident processes with legal counsel.

Overlap with PISF and PKCERT

Use one control library where possible. Add SECP-specific board packs and filings. If National CERT’s six-month SOC direction applies, treat it as a hard operational dependency.

How CyberSilo Helps

• Control evidence mapping in CSA for PISF 2026
• Detection and case workflows with ThreatHawk SIEM
• Advisory scoping — contact CyberSilo

Frequently Asked Questions

Who should read SECP cyber guidance?

Listed companies, NBFCs, and other entities SECP supervises should track current circulars and guidelines — confirm exact applicability with compliance counsel.

Does SECP replace PISF?

No. SECP guidance is sectoral/supervisory. Map overlapping controls with PISF 2026 while keeping SECP-specific artefacts clear.

What is a practical first step?

Board-approved cyber policy, asset inventory, monitoring path, and incident reporting contacts — then gap against the latest SECP text.

Related Resources

SBP ETGRM · CSA for PISF · PISF blogs