ISMS Policy

ISO 27001:2022 INFORMATION SECURITY, CYBERSECURITY AND PRIVACY PROTECTION MANAGEMENT SYSTEM

The main objective of the Information Security Management System (ISMS), within the scope of Personal Data and Information Security Activities, is to demonstrate that information security management is ensured across human resources, infrastructure, software, hardware, organizational information, third-party information, and financial resources; to secure risk management; to measure the performance of information security management processes; and to regulate relationships with third parties regarding information security.

In this context, within the scope of our ISMS Policy:

1. To protect information assets against all kinds of threats that may arise internally or externally, intentionally or unintentionally; to ensure accessibility of information as required by business processes; to meet legal and regulatory requirements; and to carry out continuous improvement activities.
2. To manage personal data and information assets; to determine the security values, requirements, and risks of these assets; and to develop and implement controls against security risks.
3. To ensure the continuity of the three fundamental elements of the INFORMATION SECURITY, CYBERSECURITY AND PRIVACY PROTECTION MANAGEMENT SYSTEM in all activities:

1. Confidentiality: Preventing unauthorized access to information and information assets.

1. Integrity: Ensuring and demonstrating the accuracy and completeness of information.

1. Availability: Ensuring that authorized users can access information when needed.

1. To define the framework for determining personal data, information assets, their values, security requirements, vulnerabilities, threats, and the frequency of such threats.
2. To allocate financial resources and personnel for risk treatment.
3. To continuously monitor risks by reviewing technological expectations within the scope of provided services.
4. To comply with national and international regulations, laws, and relevant legislation; to fulfill obligations arising from agreements; and to meet information security requirements stemming from corporate responsibilities towards internal and external stakeholders.
5. To reduce the impact of information security threats on service continuity and to contribute to continuity.
6. To prepare, maintain, and test business continuity plans.
7. To sustain environmentally conscious and socially responsible practices aimed at environmental sustainability and combating climate change.
8. To ensure continuous improvement.
9. 
   

We hereby commit to maintaining the fulfillment of these requirements.