ISO 27001:2022 Information Security, Cybersecurity and Privacy Protection Management System Policy
The main theme of the Information Security, Cybersecurity and Privacy Protection Management System is, within the scope of Personal Data and Information Security Activities, to demonstrate that information security management is ensured across people, infrastructure, software, hardware, organizational information, information belonging to third parties and financial resources; to secure risk management; to measure the performance of the information security management process; and to ensure that relations with third parties on matters related to information security are regulated.
Our Commitments under Our ISMS Policy
- To protect information assets against all kinds of threats that may arise from inside or outside, knowingly or unknowingly; to ensure the availability of information as business processes require; to meet the requirements of the legislation; and to carry out work toward continual improvement.
- To manage personal data and information assets; to determine the security values, needs and risks of the assets; and to develop and implement controls for security risks.
- To ensure, in all activities carried out, the continuity of the three core elements of the Information Security, Cybersecurity and Privacy Protection Management System:
| Core Element | Definition |
|---|---|
| Confidentiality | Preventing unauthorized access to information and information assets |
| Integrity | Demonstrating that the accuracy and integrity of information are ensured |
| Availability | Demonstrating that information can be reached by those who are authorized when needed |
- To define the framework that the methods will set for identifying personal data, information assets, their values, security needs and vulnerabilities, the threats to the assets and the frequency of those threats.
- To provide financial resources and personnel for the treatment of risks.
- To monitor risks continuously by reviewing technological expectations in the context of the scope of the services provided.
- To fulfill the requirements of national or international regulations, laws and the related legislation; to meet obligations arising from agreements; and to meet the information security requirements arising from corporate responsibilities toward internal and external stakeholders.
- To reduce the impact of information security threats to service continuity and to contribute to continuity.
- To prepare, maintain and test business continuity plans.
- To continue environmentally sensitive work, conscious of social responsibility, on ensuring environmental sustainability and on climate change.
- To ensure continual improvement.
We undertake to continue fulfilling the requirements of the activities.