Information Security Policy
Our company, TEPENET İNTERNET TELEKOMÜNİKASYON İLETİŞİM LTD. ŞTİ., has adopted the ISO/IEC 27001:2022 Information Security Management System (ISMS) standard as a fundamental principle in providing, operating and managing internet access services over wired and wireless electronic communication infrastructures. The main purpose of this policy is to safeguard the confidentiality, integrity and availability of all corporate and personal information assets shared by our subscribers, employees and business partners.
The scope of this policy covers all internet access services, data hosting infrastructures, backbone/network management units, customer operation centres, and all physical and electronic information assets used in carrying out these processes.
2. Our Core Principles and Commitments
- The Three Core Dimensions of Information Security: All data within our company is protected against access by unauthorised persons (Confidentiality), its accuracy is preserved against unauthorised changes (Integrity), and it is continuously accessible within the scope of legal authorisations (Availability).
- Legal Compliance and Regulations: Full compliance is ensured with Law No. 5651 in particular, the regulations of the Information and Communication Technologies Authority (BTK), the Personal Data Protection Law (KVKK) and the related national and international legal obligations.
- Proactive Risk Management: Possible information security risks are analysed periodically; identified threats and system vulnerabilities are eliminated and risks are kept at an acceptable level.
- Business Continuity and Crisis Management: To keep ISP operations uninterrupted, disaster recovery plans are prepared and tested with regular drills, and operational readiness for emergency scenarios is maintained at all times.
- Network Defence Mechanisms: To protect our network infrastructure against cyber threats, malware and unauthorised intrusion attempts, up-to-date firewalls, IDS/IPS systems, encryption layers and the "Least Privilege" principle are applied effectively.
- Continuous Improvement Cycle: In line with the ISO 27001:2022 standard, our ISMS processes, performance indicators and internal audit results are continuously reviewed and improved.
3. Resource and Infrastructure Management
Company management commits to providing in full the financial, technological and physical infrastructure needed to employ staff who keep up with technological developments and whose competence is increased through continuous training, and to support the company's competitiveness in the sector.
4. Training and Awareness Activities
Periodic training and awareness programmes are organised to raise the information security awareness of our employees and external suppliers. Every member of staff is obliged to make the ISMS policies and procedures an integral part of the way they work.
5. Breach Reporting and Disciplinary Process
Any information security breach, vulnerability or suspicious situation must be reported to the Information Security Management unit without delay as soon as it is noticed. All identified breaches are investigated promptly, and the necessary administrative/technical sanctions and preventive measures are put into effect.
6. Review and Entry into Force
This policy document is reviewed at least once a year with the participation of top management and unit managers, in line with the requirements of the ISO 27001:2022 standards and taking into account the structural and technological changes of our company; its currency and effectiveness are thereby guaranteed.
General Manager
