Information Security Policy

Document details

Code

ISO-POL-01

Version

1.0

Owner

ISMS Coordinator

Approved by

Top management (Cem Karaca)

Approval date

26 October 2026

Review

Once a year, at the management review; and whenever the scope or the threat landscape changes

Related clauses

ISO/IEC 27001:2022 clause 5.2; Annex A 5.1

Communication

All employees and relevant suppliers; read acknowledgement is obtained

1. Purpose and commitment

2. Scope

This policy applies to all activities, systems and employees within the approved ISMS scope, and to suppliers working on behalf of VeriTeknik.

3. Principles

1. Risk-based approach. Controls are selected according to the outcome of the risk assessment; a risk above the acceptance threshold is never left without an assigned owner and a treatment plan.
2. Least privilege and segregation of duties. Access is granted only as far as the work requires, time-limited access cannot become permanent, and privileged operations require a second approval or a record.
3. Strong authentication. The staff panel and administrative access are multi-factor; shared accounts are not used.
4. Evidence comes from the system. Administrative and change operations are written to an immutable record chain; evidence is not produced by hand.
5. Secure development. Code reaches production through version control and review; secrets are not kept in code; dependencies and security scans are monitored regularly.
6. AI gates. An operation proposed by the AI assistant does not run until it has passed an approval gate defined in code; the model cannot give approval on behalf of a customer or a staff member.
7. Protection of personal data. Personal data is processed only for its stated purpose, retention periods are documented, and when a period ends the data is deleted or anonymised.
8. Supplier security. Suppliers that access information or carry the service are selected against security requirements and monitored.
9. Incident readiness. Incidents are recorded, assessed and reported to the customer and, where required, to the authorities in a timely manner; lessons are learned.
10. Continuity. Backups are taken regularly and restores are tested; critical services have a continuity plan.
11. Awareness. Every employee reads and acknowledges this policy and receives training at least once a year.

4. Roles

• Top management: approves the policy, provides resources, runs the management review and accepts residual risks.
• ISMS Coordinator: operates the ISMS, manages the schedule and records, and reports.
• Risk and asset owners: manage the risks and controls in their own areas.
• All employees: comply with policies and procedures, and report incidents and vulnerabilities.

Detailed roles are kept in the Ops Hub programme roles and in ISO-DOC-03.

5. Nonconformity

A breach of this policy enters the corrective action process (ISO-PRO-07); a deliberate violation is subject to the disciplinary process.

6. Supporting policies and procedures

This policy is implemented through the following documents (the codes are held in the document register): risk management (ISO-PRO-01), document and record control (ISO-PRO-02), incident management (ISO-PRO-03), business continuity (ISO-PRO-04), supplier relationships (ISO-PRO-05), access control (ISO-PRO-06), nonconformity and corrective action (ISO-PRO-07), internal audit (ISO-PRO-08).