BDDK Penetration Testing for Banks

The Regulation on Banks' Information Systems and Electronic Banking Services was published in Official Gazette No. 31069 on 15 March 2020 and entered into force on 1 July 2020. It sets minimum principles for banks' information systems management, information security, cyber incident management and electronic banking services.

It defines penetration testing as security testing performed to identify and fix vulnerabilities before they are exploited. Other financial institutions supervised by BDDK may be subject to separate information systems rules; we identify the right text for your institution type with you.

The regulation's penetration testing provisions can be summarized as follows:

• Frequency: The bank has its information systems penetration tested at least once a year.
• Independence: Testing is performed by independent teams with no role in the design, development, implementation or operation of the bank's IT-based services.
• Continuity: The bank's corporate cyber incident response team (SOME) is responsible for performing or commissioning routine penetration testing of IT assets before incidents occur.
• Scope and reporting: Test scope and report submission follow BDDK's related rules and the bank's own policies.

We design the test around your bank's information systems inventory and split scope by access point, such as internet, internal network and, where relevant, branch network.

• External, internal / Active Directory, web, mobile banking and API penetration testing (see Penetration Testing).
• Social engineering and DDoS resilience testing where needed.
• An audit-traceable report with an executive summary, CVSS-scored findings and remediation guidance.
• Retesting after remediation and a closure report.
• Our Sector Compliance service for regulatory mapping.