Sector Compliance: BDDK, SPK and EPDK Cybersecurity Requirements

Sector compliance means meeting the information systems and cybersecurity requirements set by your regulator. These rules are usually concrete: how often you test, how independent the testing team must be and what the report must contain.

Requirements differ by sector, so we plan every engagement against the current text of the applicable regulation.

• BDDK (Banking Regulation and Supervision Agency): Regulation on Banks' Information Systems and Electronic Banking Services (Official Gazette, 15 March 2020). It requires banks to have penetration tests performed by independent teams at least once a year.
• SPK (Capital Markets Board): Communiqué on the Principles of Information Systems Management (VII-128.10; Official Gazette, 13 March 2025). It replaced the earlier Communiqué VII-128.9 and sets annual penetration testing and procedures for submitting test reports to the Board for institutions in scope.
• EPDK (Energy Market Regulatory Authority): Cybersecurity Competency Model Regulation for the Energy Sector (2023). It requires covered licensees to implement and audit controls according to their criticality level; amendments in 2024 and 2025 updated its scope and audit requirements.

• Define scope and test frequency based on the regulation
• Network, web, mobile and API penetration testing
• Map findings to the relevant regulatory articles
• Executive summary and technical report structured for regulatory review
• Remediation tracking and verification testing

Some regulations set independence, certification or experience criteria for the testing team or firm. We review the applicable requirements with you at the proposal stage and structure the engagement so that it stands up in audit.

Banks, brokerage and asset management firms and other institutions regulated by the Capital Markets Board, as well as electricity, natural gas and oil licensees. Technology providers serving these institutions, whose customers expect testing to the same standard, can also benefit.

1. Initial call and obligation analysis
2. Agreement on scope, schedule and rules of engagement
3. Test execution
4. Reporting and findings walkthrough
5. Verification test and closing report

For the testing requirements of each regulation, see our BDDK, SPK and EPDK Penetration Testing pages.