Compliance is security in writing
KVKK (Turkey’s Personal Data Protection Law No. 6698) requires every organisation that processes personal data to take appropriate technical and administrative measures to protect that data. ISO/IEC 27001 is the international standard that defines how information security should be established as a management system and continually improved.
What the two have in common is this: knowing which information is valuable, assessing the risks to it, applying measures and being able to prove it. A large part of this work takes place in the IT infrastructure.
What do we do together?
Risk analysis
Together we assess your information assets, the threats to those assets and your existing measures, and identify the priority risks.
Technical measures
We implement and document technical measures in your infrastructure, such as access authorisation, logging, encryption, backup, malware protection and data loss prevention.
Preparing for ISO 27001
We help you prepare the policies and procedures the standard requires, implement the controls and get ready for the certification audit. Certification itself is carried out by accredited certification bodies.
Awareness training
The weakest link in security is very often people. We give your staff clear, accessible training on phishing, password security and data protection.
Compliance with Unna
In compliance work, the legal process and the technical implementation cannot be separated. We work alongside your legal adviser on the legal assessment and privacy notices, and we take responsibility for actually implementing the technical measures.
- We listen first. Together we map which personal data you process, where, and on which systems.
- We plan together. We prioritise technical measures according to the risk analysis and draw up a workable roadmap.
- We implement. We put the measures in place in your infrastructure and document the evidence for each one, ready for audit.
- We stay by your side. We support you with internal audits, periodic reviews and bringing new systems into compliance.
Part of the whole
This page is the clearest example of how Unna’s solutions complement one another. The technical measures required by KVKK and ISO 27001, and how they are met:
- Access control: identity and access management (ADManager Plus, PAM360)
- Data loss prevention: Safetica DLP
- Network security and logging: firewalls, Unna Controller, Firewall Analyzer and 5651 logging
- Malware protection: endpoint security (Bitdefender, ESET)
- Backup and continuity: backup (Veeam, UnnaBulut) and disaster recovery
- Physical security: server room
Frequently asked questions
Do you issue the ISO 27001 certificate?
No. Certification is carried out by independent, accredited bodies. We prepare you technically for the audit and support you throughout the process.
What should we do if we suffer a data breach?
KVKK requires breaches to be reported to the Personal Data Protection Board as soon as possible, and the Board has set this period at 72 hours. Having your logs ready is critical for determining the scope of the breach. If an incident occurs, we are by your side for the technical investigation.
