Assurance · registers
Capability, and the gaps in it
A capability register that lists only what works is a marketing document. This one carries thirty-one named gaps, each with the thing that is actually missing.
Capability layers10
Modules32
Engines21
Critical gaps2
High gaps12
Medium13
Low4
Capability layers
module coverageL1 · Intake & Citizen Access1 mod
Web, helpline, walk-in, partner referral, Citizen Shield app
L2 · Triage & Command5 mod
Sentinel triage, duty desk, mission coordination, SITREP
L3 · Investigation Engines3 mod
21 engines from OSINT to timeline reconstruction
L4 · Forensic Laboratory6 mod
Acquisition, disk, memory, mobile, network, malware
L5 · Financial & Crypto4 mod
Mule-chain tracing, holds, off-ramp attribution
L6 · Predictive & Digital Twin3 mod
Forecasting, early warning, seven-layer national model
L7 · Inter-Agency Bus2 mod
26 partner rails with maturity staging 0–4
L8 · Agentic Layer4 mod
Orchestrator, 13 specialists, Policy Guard, approval engine
L9 · Citizen, Victim & Recovery2 mod
Golden hour, NCII removal, risk flags, restitution
L10 · Governance & Audit2 mod
Authority register, hash-chained ledger, transparency statistics
Investigation engines
E01–E21| # | Engine | Purpose |
|---|---|---|
| E01 | Acquisition | Forensically sound image capture with hash verification |
| E02 | Disk & File | File-system and deleted-artefact recovery |
| E03 | Timeline | Unified super-timeline across all sources |
| E04 | Memory | Volatile memory capture and process analysis |
| E05 | Mobile Artefact | Extraction and chat/media reconstruction |
| E06 | Email & Browser | Header, attachment and history analysis |
| E07 | Network Evidence | PCAP, flow and session reconstruction |
| E08 | Malware Detonation Lab | Sandboxed execution and IOC extraction |
| E09 | Speech & Script | Urdu and regional-language transcription |
| E10 | Case & Mission Ledger | Authoritative case and mission state |
| E11 | OSINT Collection | Public-source enrichment with preserved captures |
| E12 | Financial Trace | Mule-chain and account linkage |
| E13 | Crypto Trace | Wallet labelling and off-ramp attribution |
| E14 | Hash & Similarity | CSAM hashing and near-duplicate detection |
| E15 | Geospatial | District, corridor and jurisdiction resolution |
| E16 | Predictive | Volume and typology forecasting with bands |
| E17 | Twin Simulation | Scenario evaluation on the seven-layer model |
| E18 | Policy Guard | Action allow / approve / deny evaluation |
| E19 | Audit Ledger | Append-only hash-chained record |
| E20 | Evaluation Harness | Offline and online agent evaluation |
| E21 | Reporting | SITREP, ECS package and statistics output |
Gap register
G01–G31IL
| Ref | Layer | Gap | Priority | Note |
|---|---|---|---|---|
| G01 | L7 | No live PTA block API — manual short-code suppression only | high | Blocks queue at stage 2 pending signed rail |
| G02 | L5 | Bank hold confirmation is desk-mediated, not API | high | Median 38m to confirmation; golden hour needs <10m |
| G03 | L5 | Crypto exchange portal coverage is partial | high | 6 of 14 venues reachable |
| G04 | L4 | No national CSAM hash set under agreement | critical | Relies on partner hash feeds with consent |
| G05 | L4 | Mobile extraction covers 3 of 7 handset families | medium | Tool validation records incomplete |
| G06 | L3 | Urdu transcription accuracy below target on code-switched speech | medium | 78% WER on Urdu-English mixing |
| G07 | L7 | No automated MLA tracking beyond 90 days | medium | Monthly manual chase |
| G08 | L6 | Digital twin lacks telecom topology layer | high | Five of seven layers populated |
| G09 | L6 | Predictive model not validated on post-2025 typology drift | medium | MAPE rises to 16% beyond 14 days |
| G10 | L1 | No citizen-side two-factor identity binding | low | Reference-number only |
| G11 | L9 | Victim referral network covers 9 districts of 34 | high | Outside coverage routes to manual triage |
| G12 | L9 | NCII removal notifications depend on platform email | medium | No structured response channel |
| G13 | L10 | Warrant scope monitoring is post-hoc, not pre-flight | critical | Mismatch detected at review, not at query |
| G14 | L10 | Audit ledger hash chain not independently attested | high | Self-attested integrity only |
| G15 | L10 | No court e-filing integration in production | medium | Package handed over manually |
| G16 | L10 | Prosecutor portal read-only by policy | low | Deliberate restriction |
| G17 | L7 | Safe City video request path is letter-based | high | No API with provincial centres |
| G18 | L7 | Suspect register partners limited to 4 institutions | medium | Bank, wallet, telco, platform |
| G19 | L7 | No structured SIM-swap feed from operators | high | Wave detection lags 4–6h |
| G20 | L8 | Agent evaluation harness runs offline only | medium | No online champion/challenger |
| G21 | L8 | Sandbox lacks GPU-accelerated malware detonation | low | CPU detonation only |
| G22 | L8 | No dedicated covert-operations audit view | high | Restricted log exists, review workflow manual |
| G23 | L5 | Asset valuation lacks an independent valuer panel | medium | Internal estimate only |
| G24 | L5 | Restitution payout requires manual SBP instruction | high | No bulk payout rail |
| G25 | L10 | No standard acquittal root-cause taxonomy adopted | medium | Local coding scheme in use |
| G26 | L1 | Reportinging centre coverage 64 of 168 districts | high | Citizen Shield app bridges the gap |
| G27 | L1 | No offline-first sync for field officers | low | Online only |
| G28 | L1 | Advisory distribution limited to app and portal | medium | No SMS broadcast rail |
| G29 | L3 | Entity resolution confidence not exposed to prosecutors | medium | Package shows result, not band |
| G30 | L7 | No cross-provincial case deconfliction service | high | Duplicate investigations possible |
| G31 | L10 | Statistics not yet ICCS-mapped end to end | medium | 42% of typologies mapped |
Module register
M01–M32| # | Module | Layer | Function |
|---|---|---|---|
| M01 | Citizen Shield app | L1 | Golden-hour reporting, case tracking, local advisories |
| M02 | Sentinel intake | L2 | Triage, typology, urgency scoring, de-duplication |
| M03 | Case & complaint management | L2 | Reporting-centre workflow, inquiry, referral |
| M04 | Duty desk & watch | L2 | Shift handover, escalation, critical alerts |
| M05 | Mission coordination | L2 | Phase clock, task capsules, decisions, SITREP |
| M06 | SITREP generator | L2 | Live state to formatted situation report |
| M07 | OSINT collection | L3 | Public-source enrichment with preserved captures |
| M08 | Entity resolution | L3 | Identifier linkage and confidence weighting |
| M09 | Network evidence | L3 | PCAP, flow and session reconstruction |
| M10 | Acquisition | L4 | Write-blocked imaging with hash verification |
| M11 | Disk & file analysis | L4 | Artefact recovery and file-system timelines |
| M12 | Memory analysis | L4 | Volatile artefact capture and process tree |
| M13 | Mobile artefact | L4 | Extraction, chat reconstruction, media indexing |
| M14 | Email & browser | L4 | Header analysis and browsing reconstruction |
| M15 | Malware detonation | L4 | Sandboxed execution, capability and IOC extraction |
| M16 | Financial trace | L5 | Mule-chain linkage across banks and wallets |
| M17 | Crypto tracing | L5 | Wallet labelling and exchange off-ramp mapping |
| M18 | Hold & freeze | L5 | Golden-hour hold requests with authority capture |
| M19 | Asset recovery | L5 | Attachment, restitution and payout matching |
| M20 | Forecasting | L6 | Volume and typology projection with bands |
| M21 | Early warning | L6 | Threshold breach detection to public advisory |
| M22 | Digital twin | L6 | Seven-layer national model and scenario engine |
| M23 | Partner bus | L7 | Signed request/response rails with maturity staging |
| M24 | Cross-border desk | L7 | Preservation, disclosure, INTERPOL, MLA |
| M25 | Orchestrator & planner | L8 | Goal to task graph with budgets and deadlines |
| M26 | Policy Guard | L8 | Allow / approve / deny per action and legal basis |
| M27 | Approval engine | L8 | Approval cards with e-signature and expiry |
| M28 | Sandbox executor | L8 | Ephemeral containers, read-only evidence mounts |
| M29 | Victim & gender desk | L9 | NCII removal timers, risk flags, referrals |
| M30 | Disruption console | L9 | Takedowns, blocks and suspect-register growth |
| M31 | Authority register | L10 | Warrants, scope monitoring, compliance scoring |
| M32 | Transparency & statistics | L10 | ICCS-coded statistics and annual report builder |
Global benchmarks
what good looks likeUK — Action Fraud / NCSC
National reporting plus automated disruption at scale; suspension notice regime.
Singapore — SPF / CSA
Golden-hour payment kill-chain with bank APIs; ~70% of reported losses recovered in-year.
UAE — Dubai Police / CSC
Unified smart-intake, AI-assisted triage, sub-15-minute acknowledgement.
INTERPOL — AFJCTF
24/7 fusion desk model; stop-payment and takedown coordination.
Estonia — RIA / CERT
Digital-twin-like national model; forensic tool validation regime.
Named for comparison only. None of these figures is presented as a Pakistan measurement.
Role workspaces
16 personasDirector GeneralDuty DirectorWatch OfficerMission CommanderGolden-Hour OfficerInvestigatorForensic ExaminerIntel / Twin AnalystLiaison OfficerProsecutorAccountability OfficerAsset Recovery OfficerVictim & Gender Desk OfficerContent Legal ReviewerCovert Operations SupervisorCitizen
A persona filters what a screen shows; it never expands what an officer is authorised to do. Authority comes from the warrant register, not from a dropdown.
Implementation roadmap
phased, dependency-orderedPhase 0
weeks 1–8
Foundations
Token design system, datastore, audit ledger, authority register, triage pipeline. No partner rail required.
Phase 1
weeks 9–20
Golden hour
Hold and freeze rails with the four stage-2 financial partners; SITREP and mission coordination in production use.
Phase 2
weeks 21–40
Fusion
Forensic engines, ECS gate, prosecutor portal, cross-border desk with preservation-first playbooks.
Phase 3
weeks 41–78
Scale
Reporting-centre rollout to 64 districts, telecom layer (closes G08), joint co-located cells at stage 4.
Floor plan & sources
what this rests onFloor plan. Watch floor for the duty director and video wall; golden-hour desk co-located with the financial partners; forensic lab separate from the command floor; a quiet room for the victim desk, because NCII interviews cannot happen within earshot of a watch floor.
Sources. Structure, agent identities, module numbering, engine list, partner catalogue, autonomy ladder and governance rules come from the NCCIA Agentic C2 Architecture v1.2. Public-record figures are those the document marks as published. Everything else is illustrative and marked IL wherever it is shown — 31 gaps included.