Penetration Testing by Regulation

In Turkey, many organizations, including banks, capital markets institutions, payment and e-money institutions and energy companies, are required by their regulators to have penetration tests performed. Nokta Guard explains each regulation's test frequency, scope and reporting expectations based on the official texts and plans the test within that framework.

Total 7 solutions

BDDK Penetration Testing Tests aligned with information systems audits for banks and financial institutions.
CMB (SPK) Penetration Testing Capital Markets Board information systems requirements for brokerages and asset managers.
EMRA (EPDK) Penetration Testing Tests aligned with the cybersecurity competency model for energy companies.
CBRT Payment & E-Money Institutions Information systems obligations of payment and electronic money institutions.
KVKK Technical Measures Penetration testing and controls for personal data security.
PCI DSS Penetration Testing The standard's testing requirements for organizations handling card data.
ISO 27001 Penetration Testing Technical testing for certified organizations and those preparing for certification.

01 / 02

Which regulations expect penetration testing?

The pages below explain who each regulation covers, what it expects in terms of penetration testing and how to prepare.

Finance: BDDK, Capital Markets Board (SPK), Central Bank (TCMB) payment and e-money institutions, SEDDK insurance.
Energy and communications: EMRA (EPDK), ICTA (BTK).
Public sector and critical infrastructure: Information and Communication Security Guide, Cybersecurity Law No. 7545.
Cross-industry: KVKK technical measures, PCI DSS, ISO/IEC 27001.

02 / 02

How we use regulatory information

The information on these pages is based on official texts. Because regulations change, we re-check the current text at the proposal stage. Where legal interpretation is needed, we work alongside your legal and compliance teams.

FAQ

Frequently Asked Questions

Is penetration testing legally required in Turkey?

There is no general requirement for all companies. Sector regulations such as those of BDDK, the Capital Markets Board and the Central Bank, however, require covered institutions to have penetration tests performed at least once a year. Under frameworks such as KVKK and ISO 27001, penetration testing serves as evidence of appropriate security measures.

Do these regulation pages replace legal advice?

No. They are informational and based on official texts. For a definitive reading of your obligations, consult your legal and compliance teams.

What happens to the test plan if a regulation changes?

We check the current text of the relevant regulation during scoping. If a new version or amendment has been published, we adapt the test plan and report format accordingly.