X-Series: Cross-Cutting & General

DNP-X.001 FWK

Standards and Regulatory Publications

Standards and Regulatory Publications — Nomenclature, Series Structure, and Issuance Framework

Summary

This framework establishes the nomenclature, series structure, document typology, maturity model, lifecycle stages, and issuance procedures for all standards and regulatory publications issued under the Digital Nation Pakistan (DNP) designation.

Foreword

The Pakistan Digital Authority (PDA) is the statutory body established under the Digital Nation Pakistan Act, 2025. Among its core mandates is the authority to issue and enforce standards, guidelines, regulations, and technical publications in support of the National Digital Masterplan.

This framework was developed by the PDA Standards Board and approved under the procedures defined in clause 11.5 of this document.

Document Control

Contact:

Note on referenced resources

This framework references a number of portal resources, registers, schemas, and persistent identifiers — including the Standards Portal at https://standards.dnp.gov.pk, the Series Ownership Register, the Publications Register, the International Standards Reference Register, the Recognised External Standards Register, the JSON-LD metadata schema, the NISO STS XML application profile, and the fillable DOCX template — together with Uniform Resource Name (URN) and Digital Object Identifier (DOI) assignments for DNP publications.

These resources are being progressively enabled. All portal endpoints referenced in this framework will be operational at https://standards.dnp.gov.pk by 31 May 2026. URN and DOI registration will be completed in accordance with the procedures of the relevant registration authorities and retrofitted to existing publications upon assignment; until then, the fields urn and doi in structured metadata may be recorded as “pending” and placeholder notations may appear on cover pages.

Publications issued during this transitional period are valid and authoritative from their date of publication. Portal registration and identifier assignment are completed upon availability without requiring re-issuance.

1 Scope

This framework governs all standards and regulatory publications bearing the Digital Nation Pakistan (DNP) designation. DNP publications establish technical requirements, governance frameworks, guidelines, and regulatory instruments for Pakistan's digital ecosystem.

It applies to all DNP publications regardless of publishing authority. The bodies authorised to publish under the DNP designation are identified in the Series Ownership Register (clause 16).

This framework does not govern:

• (a) primary legislation (Acts, Ordinances, Rules);
• (b) administrative, operational, or corporate governance regulations of any publishing authority;
• (c) regulations issued by other bodies under their own enabling legislation (which may be catalogued in the Recognised External Standards Register, clause 14, as needed);
• (d) judicial or quasi-judicial orders, enforcement actions, penalties, or dispute resolution decisions of any publishing authority.

2 References

• Digital Nation Pakistan Act, 2025 (Act No. I of 2025)
• IETF RFC 2119 – Key words for use in RFCs to Indicate Requirement Levels
• ISO/IEC Directives, Part 2 – Principles and rules for the structure and drafting of ISO and IEC documents
• ANSI/NISO Z39.102-2022, STS: Standards Tag Suite (v 1.2) – XML format for publishing and exchanging full-text content and metadata of standards

3 Definitions

3.1 DNP designation: The identifier “DNP” (Digital Nation Pakistan) prepended to all publications issued within this architecture.

3.2 Publishing authority: A body authorised to issue publications under the DNP designation.

3.3 Series: A thematic domain identified by a single letter, grouping related publications.

3.4 Document type: A classification code indicating the legal standing and normative language of a publication.

3.5 Maturity level: A designation indicating the degree of real-world implementation experience a published standard has achieved.

3.6 Series custodian: The publishing authority designated as the primary responsible body for a specific series, accountable for the lifecycle management of all publications within that series.

3.7 Designated publishing authority: A body formally authorised, through gazette notification under the Digital Nation Pakistan Act, to issue publications bearing the DNP designation within one or more specified series.

3.8 Series Ownership Register: The authoritative table (clause 17.3) mapping each DNP series to its designated publishing authority, maintained by PDA at https://standards.dnp.gov.pk/authorities.

3.9 Architecture Review Board (ARB): A standing technical review body established by PDA to review and approve architectural and structural decisions affecting DNP publications, including amendments to the series architecture (clause 6), approval of Reference Architectures (clause 11.8), and resolution of disputes between jointly-owned series (clause 17.4).

4 Abbreviations

5 Reference Syntax and Versioning

5.1 Canonical Format

Every DNP publication is identified by a reference constructed as follows:

DNP-{Series}.{Number}[.{Sub}] {Type} [Rev.{n}] ({Month}/{Year})

• DNP – Constant prefix. Digital Nation Pakistan.
• {Series} – Single letter identifying the thematic domain (see clause 6).
• {Number} – Three-digit publication number (001–999).
• [.{Sub}] – Optional sub-number for parts or annexes.
• {Type} – Document type code (see clause 7).
• [Rev.{n}] – Revision number. Omitted for first edition.
• ({Month}/{Year}) – Date of approval.

NOTE – The publishing authority is recorded in the document metadata and on the cover page, not in the reference number. This ensures references remain stable if responsibility for a publication transfers between authorities.

5.2 Examples

6 Series Architecture

DNP publications are organised into fifteen thematic series. Each series is identified by a single letter.

6.1 Numeric Block Allocation

Within each series, number ranges group related publication types:

7 Document Type Classification

Every DNP publication carries one of the following type codes:

7.1 Normative Language

In Standards (STD), Regulations (REG), Reference Architectures (RA), and Technical Specifications (TS): “SHALL” denotes mandatory requirements and “SHALL NOT” denotes prohibitions, per RFC 2119.

In Guidelines (GDL), Best Current Practices (BCP), and Codes of Practice (COP): “SHOULD” denotes recommended practices.

In Technical Reports (TR) and Experimental Specifications (EXP): all content is informative.

8 Maturity Model

Published standards carry a maturity level indicating real-world implementation experience. Maturity is separate from the drafting lifecycle (clause 9).

Typical progression: PUB (PILOT) → PUB (PROPOSED) → PUB (FULL). Regulations and internationally-aligned frameworks may enter directly at PROPOSED or FULL.

9 Classification

Every DNP publication carries one of four classification tiers, assigned at the Final Draft stage and recorded on the cover page and in the machine-readable metadata (clause 13).

• The default classification is PUBLIC. Any higher tier requires documented justification in the publication's document-control record.
• Classification is approved together with the Final Draft by the same approval authority that approves the publication. Reclassification requires approval by the same authority, recorded in the change history.
• Where a subject area spans multiple tiers, it SHALL be published as a set of companion documents each carrying its own classification, rather than as a single document with redactions. The PUBLIC companion SHALL reference the restricted companions by DNP identifier so that the existence of the complete set is publicly recorded.
• For PUBLIC publications, the Public Comment Draft is open to all. For INTERNAL publications, it is distributed to registered participants. For RESTRICTED and CONFIDENTIAL publications, public consultation is replaced by structured technical and security review of equivalent rigour.
• The machine-readable metadata field classification SHALL carry one of the values PUBLIC, INTERNAL, RESTRICTED, or CONFIDENTIAL.
• Where primary legislation imposes stricter classification or compels disclosure, the statutory requirement prevails.
• PDA maintains a Publications Register at standards.dnp.gov.pk/register listing every DNP publication, regardless of classification tier, so that the existence of every publication is publicly discoverable.

10 Publication Lifecycle

Every publication passes through defined lifecycle stages:

10.1 Review Cycles

• Standards (STD), Regulations (REG), and Reference Architectures (RA): mandatory review every three years.
• Frameworks (FWK) and Best Current Practices (BCP): every five years.
• Experimental Specifications (EXP): reviewed after 18 months and either promoted, renewed, or withdrawn.

Every review, whether scheduled or unscheduled, SHALL conclude with one of three formal outcomes recorded in the publication's document-control history: (a) Confirmed: the publication remains current and in force without change, and the next scheduled review date is reaffirmed; (b) Revised: the publication is amended or superseded, and the revised version is issued under the same DNP reference with an incremented revision number and a new review date; or (c) Withdrawn: the publication is retracted and assigned WDN status.

Any DNP publication may be submitted for unscheduled review by the PDA Standards Board, or the Architecture Review Board where a material change in the security landscape, applicable legislation, normative references, or implementation findings warrants earlier review. An unscheduled review follows the issuance procedure for the original document type (clause 11) and, where it results in revision, resets the scheduled review clock from the new publication date.

11 Issuance Procedures

11.1 Standards and Technical Specifications (STD, TS)

• New Work Item Proposal submitted to the responsible division.
• Working Draft (WD) developed by the working group, consulting international references.
• Committee Draft (CD) circulated for technical and policy review.
• Public Comment Draft (PCD) published on the Standards Portal for 30-day consultation or as appropriate.
• Final Draft (FD) approved by the publishing authority.
• Gazette notification. Published (PUB) status takes effect.
• Registration in the Standards Portal with full metadata.

11.2 Regulations (REG)

Same as 11.1, with two additional requirements: (a) legal review by the publishing authority's legal division, and (b) a Regulatory Impact Assessment published alongside the PCD.

11.3 Best Current Practices (BCP)

Same as 11.1, with a minimum 30-day consultation period. Requires documented evidence of successful operational practice.

11.4 Experimental Specifications (EXP)

Streamlined process: WD → CD → FD → PUB. No public consultation required. Mandatory designation of pilot participants and defined duration (maximum 18 months).

11.5 Frameworks and Guidelines (FWK, GDL)

WD → CD → PCD → FD → PUB with minimum 30-day consultation. No gazette notification required.

11.6 Technical Reports and Advisories (TR, ADV)

Technical Reports require internal approval only. Advisories are issued on an emergency basis with immediate publication.

11.7 Profiles (PRF)

Same as 11.5, with an additional conformity mapping to the parent standard(s).

11.8 Reference Architectures (RA)

WD → CD → PCD → FD → PUB with minimum 30-day consultation. Requires: (a) architecture review by the PDA Standards Board's architecture review committee or an equivalent technical review body; (b) explicit mapping to the governance framework(s) it implements, where applicable; (c) conformity criteria defining what it means for downstream publications to conform to this reference architecture; (d) a classification decision per clause 9 indicating which elements of the architecture are PUBLIC and which are subject to restricted access. Does not require gazette notification. Initial publication is typically at PILOT maturity.

12 Document Template

All DNP publications follow this structure:

Front matter

• Cover page – DNP logo, publishing authority name, series identification, reference number, title, summary, metadata table.
• Document control – Authors, reviewers, approval authority, revision history.
• Table of contents
• Foreword – Signed by head of publishing authority (STD, REG, FWK, RA).

Normative body

• 1. Scope 2. References 3. Definitions 4. Abbreviations 5+ Requirements – using RFC 2119 normative language as appropriate. Conformity assessment clause required for STD and REG.

Back matter

• Annexes – Normative (A, B, C…) and Informative (I, II, III…). Bibliography. Machine-readable metadata block (JSON-LD).

13 Structured Metadata

Every DNP publication includes a machine-readable JSON-LD metadata block with the following minimum fields:

• identifier – Full DNP reference
• publishingAuthority – Code and name of the designated publishing authority for this series, as per the Series Ownership Register (clause 17.3)
• title / titleUrdu – Bilingual titles
• series / type / status – Domain, document type, lifecycle stage
• maturityLevel – PILOT / PROPOSED / FULL / HISTORIC
• classification – one of PUBLIC, INTERNAL, RESTRICTED, CONFIDENTIAL (clause 9)
• normativeReferences – International and DNP standards required for conformance
• dateApproved / dateEffective / dateReview
• jurisdiction – PK (ISO 3166-1)
• gazetteReference – SRO number and gazette date, if gazette-notified (see clause 16.3)

The metadata schema is published at standards.dnp.gov.pk/schema/dnp.

14 International Standards References

DNP publications reference international standards (ISO, ITU-T, IETF, W3C, NIST) normatively or informatively within their text. DNP does not republish international standards under DNP numbering.

The International Standards Reference Register (ISRR), maintained at standards.dnp.gov.pk/isrr, indexes all international standards referenced by DNP publications.

15 Recognised External Standards Register

Standards published by other national authorities that are relevant to the DNP ecosystem are catalogued in the Recognised External Standards (RES) Register at standards.dnp.gov.pk/res.

RES entries carry one of three conformity levels:

16 Governance

This framework is maintained by the PDA Standards Board. Amendments to the series architecture (clause 6) require approval by the Architecture Review Board (ARB). All other amendments follow the FWK issuance process (clause 11.5).

Three-year review cycle. Next scheduled review: May 2029.

16.1 Gazette Notification

This framework, including the Series Ownership Register (clause 17.3), SHALL be notified in the Official Gazette of Pakistan as an SRO under the Digital Nation Pakistan Act, 2025. Amendments to clauses 6 (Series Architecture) and 16 (Publishing Authorities) require re-notification. Amendments to other clauses take effect upon publication on the Standards Portal.

16.2 Standing of DNP Publications

DNP publications of type REG are individually gazette-notified as SROs. Publications of type STD, when designated as FULL maturity, SHALL be referenced in the relevant gazette notification to confer mandatory compliance status. All other document types (FWK, GDL, BCP, TS, TR, EXP, PRF, ADV, COP) do not require individual gazette notification.

16.3 Relationship Between SRO Numbers and DNP References

Where a DNP publication is gazette-notified, it carries two identifiers: the SRO number assigned by the Cabinet Division (e.g., S.R.O. 456(I)/2026) and the DNP reference (e.g., DNP-D.050 REG). Both identify the same instrument.

The SRO number has legal primacy and is the authoritative reference for courts, the Official Gazette, and all legal proceedings. The DNP reference has operational primacy and SHALL be used in all technical cross-references between DNP publications, in the Standards Portal, and in machine-readable metadata.

Both identifiers SHALL be displayed on the cover page and recorded in the structured metadata (clause 13) of any gazette-notified DNP publication. The SRO number is recorded in the metadata field gazetteReference.

17 Publishing Authorities & Series Ownership

17.1 The DNP designation is a national standards designation. Publications under it may be issued by bodies other than PDA, provided those bodies are formally designated as publishing authorities for specific series.

17.2 Designation as a publishing authority for a DNP series requires:

• Statutory mandate relevant to the series' domain (established by Act of Parliament, Ordinance, or SRO);
• Formal request to PDA with evidence of technical competence and institutional capacity;
• Approval by the PDA Standards Board;
• Gazette notification of the designation under the Digital Nation Pakistan Act.

17.3 The following table constitutes the Series Ownership Register. Amendments to this register follow the process in 17.2 and require an amendment to this framework (see clause 16).

17.4 Where a series is designated as “jointly” owned, both authorities must concur on publications. Conflicts may be addressed by the Architecture Review Board.

17.5 Where a publishing authority has not yet been constituted (e.g., Cybersecurity Authority), and an interim custodian has not been identified, PDA may serve as an interim custodian. Upon formal establishment of the designated body, series ownership transfers automatically without amendment to this framework, provided the gazette notification in 17.2(d) is completed.

17.6 All publishing authorities SHALL follow the nomenclature, document types, maturity model, lifecycle, and issuance procedures defined in this framework. No publishing authority may create alternative numbering systems for publications within the DNP designation.

17.7 PDA maintains the authoritative copy of the Series Ownership Register at https://standards.dnp.gov.pk/authorities.

17.8 Where a series has multiple publishing authorities with distinct remits, the Series Ownership Register SHALL specify the document types each authority is authorised to publish. Absent such specification, all designated authorities for a series may publish any document type within that series, subject to concurrence under clause 17.4.

Annex A (Normative) — DNP Publication Template Specification

This annex prescribes the mandatory layout, tables, typography, and content structure for all DNP publications. All publishing authorities SHALL use this specification. A fillable template implementing this specification is available at standards.dnp.gov.pk/template.

A.1 Cover Page

Every DNP publication SHALL include a cover page with the following elements in order:

A.2 Document Control Page

Page two SHALL be the document control page containing:

A.3 Mandatory Clause Structure

The normative body SHALL follow this clause sequence. Clauses marked M are mandatory for the indicated types; O are optional.

A.4 Header and Footer

Header (all pages after cover): DNP reference and date, left-aligned, with a horizontal rule below. Example: “DNP-X.001 FWK (03/2026)”.

Footer (all pages after cover): DNP reference and date centred, with a horizontal rule above. Page numbers are not separately displayed (they are embedded in the footer reference).

A.5 Typography

A.6 Back Matter

The following elements appear after the normative body:

• Normative annexes (A, B, C…) — carry the same binding force as the main body.
• Informative annexes (I, II, III…) — supplementary, non-binding.
• Bibliography — non-normative references, prefixed with “b-”.
• Machine-readable metadata block — JSON-LD as per clause 13. Final page of the publication.

A.7 Electronic Publishing Formats

All published DNP documents SHALL be made available in the following formats:

NOTE — NISO STS XML is the machine-readable structured format for the full text and structure of DNP publications. JSON-LD provides metadata only and does not replace NISO STS for full-text markup. The NISO STS schema and DNP application profile are published at standards.dnp.gov.pk/schema/sts.

A.8 Fillable Template

PDA maintains a fillable DOCX template implementing this specification at https://standards.dnp.gov.pk/template. All publishing authorities SHALL use this template as the starting point for new DNP publications. The template is an operational tool maintained by PDA and is not itself a DNP publication; it is updated without a formal amendment cycle whenever this annex is revised.