SKT

Aim

The purpose of this Policy is to protect and appropriately manage the confidentiality, integrity and accessibility of the information assets owned by SKT and the units it provides service to.

Scope

Our supplier security policy for all suppliers and/or (sub)contractors with whom we cooperate in order to protect our shared information and information assets against information security threats that may occur knowingly or unknowingly in the provision of goods and services is defined as follows. Implementation of this policy is important to ensure the confidentiality, integrity and availability of our information assets. It covers the rules that must be followed to protect information security in supplier relations.

Applicability

Protecting the integrity, confidentiality and availability of information shared with the supplier and/or (sub)contractor,
Ensuring the healthy operation of the information systems infrastructure and the continuity of all work and transactions carried out through the services received from the supplier and/or (sub)contractor,
Protecting the confidentiality of corporate and personal information shared with confidentiality and non-disclosure agreements,
Complying with legal and regulatory requirements, including data protection, intellectual property rights and copyrights, within the scope of the service,
Goods and service procurement contracts include conditions such as agreed upon maintenance/repair conditions, resolution period, intervention period, supply period, and penal terms if these conditions are not met,
Conducting risk analyzes in cases where confidentiality and non-disclosure agreements cannot be signed, and agreeing on the measures to be taken with the supplier,
Considering the information transfer rules of contracts,
Adapting to the differences that may occur in information security practices due to innovations and changes that may occur in the legislation that is obligatory within the scope of the service (law, regulation, notification, circular, etc.),
Using remote access tools approved by SKT for remote access to Information Systems, recording and reporting remote access activities,
Recording Information Security Violations that occur during service procurement,
Computers used for remote access by suppliers and/or (sub)contractors during service procurement
Taking necessary precautions to protect against malicious software and close security vulnerabilities,
Regularly evaluating suppliers with information security criteria and sharing the evaluations with suppliers,
Increasing the Information Security awareness of suppliers and ensuring information security by organizing Information Security Awareness trainings and Information security audits when necessary,
Any changes that may occur in the products or services provided by the supplier and/or (sub)contractor (personnel changes, version updates, hosting condition updates, etc.) will be reported to SKT. notification and agreement.

Goals

To determine the value of information assets through appropriate risk assessment, to understand their vulnerabilities and threats that may put them at risk, and to reduce risks to acceptable levels.
To fulfill the requirements of the law through the design, implementation and maintenance of the Information Security Management System.
To protect the reliability and image of the institution.
To comply with all customer contractual terms regarding information security.
Ensuring business continuity of the institution.
To ensure and maintain TS ISO IEC 27001 compliance.

Review

This policy is reviewed regularly once a year by the SKT Information Security Board, taking into account significant security vulnerabilities and threats, and based on controls related to process or technical infrastructure changes. This revised and updated policy is approved by SKT Management. Reviews include the nature, number and effectiveness of recorded vulnerabilities, the impact of audits on business efficiency, and the effects of technological change.

General Manager on Behalf of All SKT Employees