This is a courtesy translation. In the event of any discrepancy, the Turkish version prevails.
Purpose, scope and management commitment
The management and employees of Hector Kurumsal Yönetim Danışmanlık Hizmetleri A.Ş. (the “Company”) regard corporate information as a highly valuable asset. Information is critical to sustaining our business and must be properly protected. The Company’s approach to information security aims to minimise the risks to the confidentiality, integrity and availability of corporate information, and the impact of those risks.
Company management has committed in particular to the following:
- Ensuring the confidentiality, integrity and availability of information and information systems,
- Identifying risks to information assets and managing them systematically,
- Meeting the requirements of information security standards,
- Complying with all legislation relating to information security,
- Making use of opportunities for continuous improvement,
- Training staff to raise information security awareness,
- Preparing and publishing the sub-procedures that sit under this policy.
This policy applies to, and is binding on, all personnel who use the Company’s information or business systems, whether full-time or part-time, permanent or contract, regardless of geographic location or business unit. Third-party service providers and their support staff who are outside these categories but need access to Company information are also bound by the general principles of this policy and by other security obligations.
Responsibilities of all employees
The purpose of information security is to protect, maintain and manage the confidentiality, integrity and availability of information and of all supporting business systems, processes and applications. This means that Company information stays in authorised hands, is complete, accurate and usable, and that information and systems are available when needed. All personnel and interns, whatever their position or duties, are therefore responsible for doing their work in a way that protects information within the Company.
All personnel must also protect confidential information and comply with the Company’s ethical principles. The Company undertakes to take the measures set out in personal data protection legislation and to work in full compliance with data protection rules.
Policy ownership and guidance
Functional ownership of this policy, its supporting documents and training activities rests with the IT lead designated by Company management. The IT lead is the source of advice and guidance on applying the policy across the Company; ensures that all employees receive the training needed to reach the right level of awareness; guides the handling of information security incidents; and ensures that the policy is supported by detailed standards, procedures and processes where needed. The IT lead is also responsible for conveying the policy’s requirements to all employees and contractor personnel.
The IT lead is responsible for establishing and maintaining the general management framework for information security, and for reviewing the policy so that it stays aligned with the Company’s business requirements and with changes in the risk environment facing its information systems.
Information security policies are reviewed at least once a year, in line with asset and risk updates, to reflect the current risks facing information assets. Any employee may ask the IT lead to improve or change the policies, and such requests are assessed. The policy’s principles are applied in parallel with the Company’s personnel and HR rules, and employees are responsible for being aware of and complying with them.
Oversight, compliance and resolving breaches
Each unit manager has first-line responsibility for taking the measures needed to ensure compliance with the policy and for overseeing the system. The IT lead is responsible for periodically auditing compliance with all published policies and procedures and for reporting to those concerned.
Breaches of the policy may harm the Company through failure to apply the necessary controls, and may give rise to criminal liability under the Turkish Penal Code and liability for damages. A breach is also a breach of the Company’s personnel rules and may result in disciplinary action. Breaches identified through oversight, audit or reports may lead to sanctions ranging up to termination of employment and judicial or criminal proceedings.
Objectives
To protect its reputation, reliability and information assets, and to keep core and supporting business activities running with as little interruption as possible, the Company sets the following information security objectives:
- Ensure the continuity of information systems,
- Maximise employees’ awareness, and their compliance with security requirements,
- Fully establish compliance with contracts concluded with third parties,
- Minimise information security incidents and turn them into opportunities to learn,
- Ensure that information is produced, accessed and stored in full compliance with the law,
- Apply current and effective technical security controls.
Every employee is responsible for contributing to these objectives. Working together to apply this policy helps keep our information and our reputation protected.