What the Information and Communication Security Guide requires of institutions

Presidential Circular No. 2019/12 on Information and Communication Security Measures was published in the Official Gazette dated 6 July 2019 and numbered 30823. In addition to a list of 21 measures, the Circular provides for the preparation of a Guide containing different security levels, for compliance with the Guide in information systems newly established at all public institutions and enterprises providing critical infrastructure services, and for existing infrastructure to be brought into compliance gradually.

The first version of the Guide was published by the Digital Transformation Office in July 2020. The Siber Güvenlik Başkanlığı, established by Presidential Decree No. 177, took over the Office's duties in the field of cyber security; with the Cyber Security Law No. 7545, published on 19 March 2025, the Office's implementation and inventory in this field were transferred to the Directorate. The current version of the Guide is version 1.1, dated 1 March 2026. The version notes give the reason for the change as the design and institutional changes made to the document owing to the transfer of authority. The Guide and the Audit Guide are now published on the website of the Siber Güvenlik Başkanlığı.

The Guide covers institutions and organisations within the state structure that have an IT unit or receive IT services from third parties under contracts, and enterprises providing critical infrastructure services. Institutions group their assets under six main headings defined in the Guide: Network and Systems, Applications, Portable Devices and Media, Internet of Things (IoT) Devices, Physical Premises, and Personnel.

The criticality level of each asset group is determined through a questionnaire that takes into account the importance of the data processed in terms of confidentiality, integrity, and availability, as well as dependent assets, the number of people affected, and institutional, sectoral, and societal consequences. A questionnaire score below 18 is treated as Level 1, between 18 and 28 as Level 2, and 28 or above as Level 3. Measures also come in three levels: basic, intermediate, and advanced. Level 1 groups receive basic measures, Level 2 groups receive basic and intermediate measures, and Level 3 groups receive all three levels.

Based on this rating, the institution carries out a current-state and gap analysis, prepares an implementation roadmap to remedy deficiencies, and, with senior management approval, may apply compensating controls with the same purpose and effect for measures that cannot be met due to technical constraints.

Except for activities falling within the scope of national security and the protection of confidentiality, the Circular requires institutions to establish audit mechanisms and to audit the implementation of the Guide at least once a year. The Guide states that audits will be carried out on the basis of the Information and Communication Security Audit Guide.

According to the frequently asked questions document of the Siber Güvenlik Başkanlığı, institutions submit audit results to the Directorate through the Information and Communication Security Compliance and Audit Monitoring System (BİGDES) within two months of the date the audit report is signed. The relevant sections of the report are signed with a secure electronic signature by the senior executive or personnel authorised by them.

Articles 12 and 13 of the Circular, together with the Guide's headings on application security, cloud computing, and procurement, directly determine the matters that the institution must require of the contractor in software procurement. The following items must be written into the technical specification and the contract, and checks must also be carried out against these items at the acceptance stage.

In addition, the Guide requires that client and server technologies whose technical support has ended, or that contain security vulnerabilities, not be used (Measure 3.2.6.5), and that Turkish language support be provided in the interface of developed applications (Measure 4.6.1.4). Carrying out penetration testing and security audits on institutional systems at least once a year is defined as an intermediate-level measure (Measure 3.1.11.8).

Which of the measures in the Guide are mandatory depends on the criticality level of the relevant asset group. Preparation of the specification should therefore begin by determining which asset group the software to be procured falls under and the level of that group. The measures corresponding to that level, together with the headings relating to application and technology areas (such as personal data security, cloud computing security, new developments, and procurement), should then be carried over into the specification and the acceptance test plan.