TurkeyElectronic Communications Network and Information Security Regulation, Operator Security Management Duties
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2024. Publisher's page: https://www.btk.gov.tr/uploads/pages/elektronik-habeles-me-sekto-ru-nde-s-ebeke-ve-bilgi-gu-venlig-i-yo-netmelig-i-5a341795a1773.pdfIn force since .
A sector security regimes rule binding private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Security, Governance
As of .
What it requires
- This binds an operator authorized under the Electronic Communications Law that the Information Technologies and Communications Authority (BTK) regulates, including infrastructure operators, mobile and fixed telephone operators and internet service providers; the additional measures bind only operators of the listed authorization types at or above the annual net sales value the Board sets (arts. 1 and 5; reached by declaring that you provide telecom services).
- Take the basic network and information security measures of the third part of the Regulation, and set up an information security management system (BGYS) that covers all services of your authorization and your critical systems (arts. 5(1) and 6(1)).
- Audit the management system by internal audit, or have it audited, at least once every two years (art. 13(1)).
- Prepare a network and information security report each year by the end of March, keep it for 5 years, and give it to the Authority on request or at an audit (art. 37(1)).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureNo
Private right of actionNo
Penalty structure
Article 60(1) of Electronic Communications Law No. 5809 lets the Authority apply an administrative fine of up to three percent of an operator's net sales of the previous calendar year for violating the legislation; no per-article fine for this Regulation is stated.
- Rule
- Turnover pct only
- As of
- Turnover percentage cap
- 3
Who enforces it
Enforcement body
Bilgi Teknolojileri ve İletişim Kurumu (BTK), the Information Technologies and Communications Authority
Settledness
- As of
- Open questions
- Has the Regulation been amended or replaced since its publication on ?
- Which annual net sales value has the Board set for the additional measures?
What this law does
The Regulation sets the procedures and principles operators must follow to ensure network and information security. Article 5 requires every operator to take the basic measures of the third part. Article 5 also requires an operator of a listed authorization type whose annual net sales reach a Board-set value to take the additional measures of the fourth part.
Article 6 requires the operator to establish an information security management system covering its authorized services and critical systems. Article 13 requires an internal audit of that system at least once every two years. Article 37 requires an annual network and information security report by the end of March.
Article 60 of Electronic Communications Law No. 5809 lets the Authority fine an operator up to three percent of its net sales of the previous calendar year for violating the legislation.
When LexLint raises it
When your app profile says your app provides telecom services.