CMB (SPK) Penetration Testing under VII-128.10

The Communiqué on the Principles of Information Systems Management (VII-128.10) was published in Official Gazette No. 32840 on 13 March 2025 and repealed the previous Information Systems Management Communiqué (VII-128.9).

It covers exchanges, central clearing and custody institutions, capital markets institutions such as brokerages and portfolio management companies, publicly held companies and crypto asset service providers. Certain institution types are exempt from specific provisions; we confirm with you whether the penetration testing obligation applies to your institution type.

• Frequency: Information systems are penetration tested at least once a year. The Board may also request additional testing when it deems necessary.
• Who tests: Testing is carried out by natural or legal persons who have no role in meeting information security requirements and hold a national or international certification in penetration testing.
• Method: Testing follows the procedures set out in the Communiqué's annex (EK-1).
• Reporting: The report is sent to the Board within one month of test completion and in any case no later than 31 January of the following year.

We clarify with you, at the proposal stage, the certification and competence requirements the regulation sets for the testing provider.

We design the test according to the EK-1 procedures and define access points and user profiles explicitly in the scope document.

• Internet and internal network testing, web and mobile trading platforms and API testing (see Penetration Testing).
• Social engineering and DDoS resilience testing where needed.
• A report formatted for Board submission, with findings classified by risk level.
• Remediation guidance to feed your board-approved action plan, followed by retesting.