Our organization implements comprehensive policies, procedures and control mechanisms under the ISO/IEC 27001 Information Security Management System to protect the confidentiality, integrity and availability of its information assets. Our information security management system is supported by corporate procedures covering processes such as risk management, access control, asset management, network security, business continuity, incident management, secure software development, technical vulnerability management, backup, monitoring and employee awareness.
Information Security Business Continuity
To ensure the continuity of information systems and minimize the impact of potential disruptions, business continuity plans are established, and backup, recovery and continuity processes for critical information systems are regularly reviewed.
Procedures supporting this scope include:
• ISMS Business Continuity Procedure
• Data Backup Procedure
• Capacity Management Procedure
• Procedure for the Maintenance, Repair and Decommissioning of Systems Containing Information
Information Security Risk and Vulnerability Management
Our organization conducts regular risk analyses to identify and assess information security risks and implement appropriate controls. Information systems are continuously monitored and improved through technical vulnerability management, network security controls, change management and security testing.
Procedures supporting this scope include:
• ISMS Risk Assessment Procedure
• ISMS Risk Treatment Procedure
• Technical Vulnerability Management Procedure
• Network Security Management Procedure
• Change Management Procedure
• Log Management Procedure
• Protection Against Malicious Software Procedure
• Antivirus and Malware Prevention Procedure
Information Security Incident Reporting Process
Our employees are responsible for reporting information security breaches, suspicious activities, security vulnerabilities or situations that may constitute policy violations to the relevant information technology teams and authorized managers within the defined incident management process. Reports are assessed, recorded and followed up with the necessary corrective and preventive actions.
Procedures supporting this scope include:
• Information Security Breach Incident and Disciplinary Management Procedure
• ISMS Risk Treatment Procedure
• Monitoring, Measurement, Analysis and Evaluation Procedure
• Log Management Procedure
Information Security Awareness
To ensure the sustainability of our information security culture, regular information security awareness trainings are provided to our employees. Employees are informed on topics such as access security, password management, social engineering, data protection, secure e-mail use, mobile device security and relevant corporate rules.
Procedures supporting this scope include:
• ISMS Awareness Procedure
• Password and Encryption Procedure
• E-Mail Use Procedure
• Mobile Devices and Remote Working Procedure
• Computer Use Procedure
• Clean Desk and Clear Screen Procedure
Internal Audit and Continuous Improvement
The Information Security Management System and information technology infrastructure are subject to regular internal audits. Based on the findings identified, corrective and preventive actions are planned, and the system is continuously improved.
Procedures supporting this scope include:
• Information Systems Technical Audit Management Procedure
• Monitoring, Measurement, Analysis and Evaluation Procedure
• ISMS Risk Assessment Procedure
• ISMS Risk Treatment Procedure
Independent External Audit and Certification
Our Information Security Management System is audited by independent certification bodies and certified under the ISO/IEC 27001 Information Security Management System standard.
Information Security Incidents
Our organization records, analyzes and carries out the necessary improvement actions for information security incidents within defined incident management processes. In the event of significant information security incidents that are required to be publicly disclosed, the necessary notifications are made in accordance with applicable legal obligations. Over the past fiscal years, the company had zero significant information security breaches requiring public disclosure.
