ZEKASTRA Cyber

Standards and law

Where the advice in this section comes from, and the Turkish legal provisions that frame it. Each entry links to its primary source.

Frameworks and catalogues

NIST Cybersecurity Framework 2.0
Organises security outcomes into six functions: Govern, Identify, Protect, Detect, Respond and Recover.
ISO/IEC 27001
The international standard for an information security management system, certifiable by an accredited body.
CIS Critical Security Controls v8
A prioritised set of 18 safeguards groups, with implementation groups sized for small to large organisations.
MITRE ATT&CK
A public knowledge base of adversary tactics and techniques, observed in real incidents; useful for naming what you detect.

OWASP Top 10
An awareness list of the most critical web application security risks. This section cites the 2021 edition.
OWASP Application Security Verification Standard
A testable list of requirements for secure web applications, in three levels.
NIST SP 800-63B
Authentication guidance: length over composition rules, screening against breached passwords, no forced periodic changes without cause.
NIST SP 800-61 Rev. 2 — Computer Security Incident Handling Guide
Preparation, detection and analysis, containment, eradication and recovery, and lessons learned.

Law No. 7545 on Cybersecurity
Published in the Official Gazette on 19 March 2025. It sets out principles of cybersecurity and the duties of the Cybersecurity Presidency, including for critical infrastructure and information systems.
Turkish Penal Code, Article 243
Defines the offence of entering, or remaining in, all or part of an information system unlawfully.
Turkish Penal Code, Article 244
Covers hindering or disrupting the operation of an information system, and corrupting, destroying, altering or making data inaccessible.
Personal Data Protection Law No. 6698, Article 12
Obliges the data controller to take the technical and administrative measures needed for an appropriate level of security, and sets a duty to notify when personal data is obtained unlawfully by others.

This page summarises provisions and is not legal advice. Texts change; read the current version at the linked official source before relying on it.