"What is an information security policy, and what should ours say?" is a question that usually comes up after a customer audit, a supplier questionnaire or a data breach. Copying a ready-made template may look easy, but a text that does not fit the company's real assets and risks proves useless at the first audit.
In this article we explain what an information security policy is, what it is for and which headings a company policy can include, drawing on three public sources in Türkiye and the public overview of ISO/IEC 27001. The headings are not an invented template; each one rests on the measure areas in the sources named below.
What is an information security policy?
An information security policy is the high-level document that puts in writing a company's rules, responsibilities and review arrangements for protecting its information and information systems. Detailed implementation steps are generally found in the procedures attached to the policy.
ISO's overview page for ISO/IEC 27001 states that the standard brings a holistic approach to information security, addressing people, policies and technology together. In other words, a policy is not a document that replaces technical safeguards; it is the link that ties the people and technology safeguards into the same framework. For the standard itself and details of certification and versions, see our article on ISO 27001.
What is the purpose of an information security policy?
What the sources have in common is protecting the confidentiality, integrity and availability of information. Presidential Circular No. 2019/12 defines the purpose of the measures as reducing security risks and, in particular, ensuring the security of critical data whose compromise in these three properties could have serious consequences.
As regards personal data, the Personal Data Security Guide (Kişisel Veri Güvenliği Rehberi) of KVKK states that a good policy enables risks to be identified in advance and measures to be taken consistently. According to the guide, policies and procedures should be integrated into the company's operations; when they are not prepared on time, the level of security cannot be adequately ensured. This forms the administrative side of the obligation to take technical and administrative measures under Article 12 of Law No. 6698 on the Protection of Personal Data (KVKK); the Law's other obligations are summarized in our article on company obligations under KVKK.
Which frameworks can be used as a reference?
Circular No. 2019/12. Published in the Resmî Gazete (Türkiye's Official Gazette) of 6 July 2019, the Circular lists 21 measures, ranging from storing critical data within the country to the use of corporate email, and provides for the preparation of an Information and Communication Security Guide.
Information and Communication Security Guide (Bilgi ve İletişim Güvenliği Rehberi). The first version of the Guide was published in July 2020 by the Digital Transformation Office (Dijital Dönüşüm Ofisi); version 1.1 is dated March 2026. According to its version table, the update was made because the powers of the now-abolished Office were transferred to the Siber Güvenlik Başkanlığı (Cybersecurity Presidency). The Guide covers institutions within the state organization and businesses providing critical infrastructure services. It is not binding on a company outside this scope, but because its measures are written independently of products and technologies, it offers a good list of headings. The Guide also includes an annex table mapping its content to international standards.
KVKK Personal Data Security Guide. Dated April 2025, this guide lists, as a separate item in its table of administrative measures, corporate policies in areas such as access, information security, use, retention and destruction.
For obligations relating to critical infrastructure and the Cybersecurity Law, see our article on Law No. 7545.
Sample information security policy headings
The headings below were compiled from topics that appear in the sources as separate measure areas. Not every company will need all of them to the same degree; the selection should be based on assets and risks.
| Policy heading | What it governs | Source |
|---|---|---|
| Purpose, scope and asset inventory | Which hardware, software and data are to be protected | BİGR 2.1.1, 3.1.1–3.1.2 · KVKK administrative measures |
| Roles and responsibilities | Approval, implementation and audit duties | BİGR role definitions · KVKK 2.2 |
| Risk assessment | Identifying and prioritizing threats | KVKK 2.1 · ISO overview page |
| Data classification | Sorting data into categories | BİGR 3.1.7.1 |
| Access control and authorization | Opening and closing accounts, least privilege | BİGR 3.1.12.1 · Circular Art. 15 |
| Passwords and authentication | Password rules, authentication | BİGR 3.2.1 · KVKK technical measures |
| Corporate email and communication | Separation of corporate and personal accounts | Circular Arts. 18–19 · BİGR 3.1.4 |
| Mobile and portable devices | Use of phones, laptops and external storage | BİGR 3.3 · Circular Arts. 9–10 |
| Remote working | Rules for remote access, devices and data | BİGR 3.1.14.1 |
| Backup and business continuity | Backups, disaster recovery | BİGR 3.1.13 · KVKK 3.6 |
| Incident management | Cyber incident response and notification | BİGR 3.1.10 · Circular Art. 14 |
| Suppliers and cloud services | Contract and security terms | BİGR 3.5.3, 4.3 · KVKK 2.5, 3.4 |
| Training, awareness and discipline | Employee training, confidentiality undertaking | BİGR 3.5.2 · KVKK 2.2 |
| Retention and destruction | Data retention periods and destruction | KVKK administrative measures · BİGR 4.1.5 |
| Review and audit | Periodic checks and updates | KVKK 2.3 · BİGR 2.3.2 |
BİGR: Bilgi ve İletişim Güvenliği Rehberi (Information and Communication Security Guide, Version 1.1). KVKK: Kişisel Veri Güvenliği Rehberi (Personal Data Security Guide). Circular: Presidential Circular No. 2019/12. The numbers are the section or measure numbers of the guide concerned.
For a few of the headings, the sources emphasize the following points:
- Access: The KVKK guide recommends basing access rights on the principle "Everything Is Forbidden Unless Permitted" (İzin Verilmedikçe Her Şey Yasaktır). The Circular likewise requires access permissions, including those of senior managers, to be granted according to the work actually performed.
- Discipline: According to the KVKK guide, there should be a disciplinary process that applies when employees do not comply with security policies and procedures.
- Suppliers: The same guide asks companies to make sure that data processors they use provide at least the company's own level of security. The related risks are discussed in our article on supplier-related data breaches.
- When an incident occurs: The process of notifying the Personal Data Protection Board of breaches involving personal data is described in our article on KVKK data breach notification.
Who is responsible for keeping the policy up to date?
The sources reviewed contain no provision pointing to a single unit for all companies. The Information and Communication Security Guide defines the "Information Security Manager" (Bilgi Güvenliği Yöneticisi) as the staff member responsible for ensuring and managing information security in the institution; during implementation, it uses a responsibility assignment matrix that distinguishes the roles of responsible, approving, consulted and informed. The KVKK guide likewise requires that, within the scope of policies and procedures, checks be carried out regularly, documented and continued after updates.
There is also a separate timetable for the institutions covered by the Circular: the implementation of the Guide must be audited at least once a year. This is not a requirement for companies outside that scope, but an annual review is a reasonable reference point.
Where to start?
- List your assets: A policy written without listing which systems and data are to be protected stays generic.
- Choose headings according to risk: The table above can be used as a checklist; for each heading, compare the measures in the source with your current situation.
- Set ownership and a schedule: State in the document itself who approves the policy, who implements it and how often it is reviewed.
Frequently asked questions
Is an information security policy legally required? The sources reviewed contain no requirement for all companies to have a document called a "policy". However, for companies that process personal data, Article 12 of Law No. 6698 makes it mandatory to take technical and administrative measures, and the KVKK guide counts corporate policies among these administrative measures.
Is a policy needed for ISO 27001 certification? ISO's public overview states that the standard defines the requirements a management system must meet, and treats policies as part of the holistic approach. The details of the requirements are in the paid text of the standard.
Conclusion
A good information security policy is a short, workable document that selects the measure areas defined in the sources according to the company's own assets and risks. From Orient Global's perspective, carrying out an asset inventory and gap analysis before writing the policy is the firmest starting point for ensuring that the text stands up at audit.
This article is for general information only and does not replace legal advice. For your own situation, consult your advisor.
#interimmanagement #forwarddeployedengineering