Cybersecurity is also part of management responsibility. Let's discuss your organization's applicable scope and audit preparation together.
CYBER SECURITY LAW NO. 7545Scope, responsibility and control authority.
Article 2 of the law covers public and private actors operating in cyberspace; Exceptions are also regulated. Article 7 imposes responsibilities regarding the provision of information and documents, measures, notification and certain procurement processes. The activity of the institution, its sector and secondary regulations should be examined together.
What does Article 8 regulate?
Article 8 regulates the authority of the Presidency to examine and supervise the activities within the scope when necessary. Audit authority is exercised by appointment; It is envisaged to be carried out or accompanied by Presidency personnel in public institutions and critical infrastructures. The same audit frequency cannot be concluded for every SME. The service siberkobi offers here is contractual evaluation and preparation; This page does not claim official authorization.
Priority and risk assessment are taken into account in the audit program. Legal audit authority and the technical evaluation service that the institution receives voluntarily are different processes. A service provider's website is not a legal mandate or authorization document.
Source check: 23.10.2026. The first text of the Turkish Grand National Assembly, the 2026 amendment text and the scope statements of the Presidency were examined together. The current binding text and secondary regulations should be checked from the official source. This page is not a legal opinion.
Personal Data Protection AuthorityPersonal Data Protection Law No. 6698
It regulates personal data processing, data security and data subject rights.
Impact on your institution
Legal bases, privacy notices, security measures and international transfers must be documented.
The 2024 amendments particularly affect special categories of personal data and the international transfer framework. Transitional provisions and Board decisions must be checked for the specific processing activity.
- Scope and liability inventory
- Risk assessment, control testing and evidence
- Incident response, notification and supplier processes
Official source ↗Check date of the transferred record: 2026-10-22
Cyber Security DirectorateInformation and Communication Security Measures Circular and Guide numbered 2019/12
It introduces information and communication security measures for public institutions and critical infrastructure businesses.
Impact on your institution
Covered organizations must plan guideline compliance and at least annual audit processes.
There is no general annual audit requirement for all private companies. According to the Presidency's statement, the institutional name and logo of the guides have been renewed, and the content and audit procedure have not changed.
- Scope and liability inventory
- Risk assessment, control testing and evidence
- Incident response, notification and supplier processes
Official source ↗Check date of the transferred record: 2026-10-22
STANDARDS & GOOD PRACTICESISO/IEC 27001
It is an information security management system standard; It is not a national law. Tools such as ISO 27002, NIST CSF, COBIT and IEC 62443 are also evaluated within their own scope.
Applicability is considered together with the industry, contracts, scope of the institution and regulations. siberkobi provides readiness assessment and improvement guidance; does not guarantee certification or compliance.
ISO official standard ↗