Common threats and systems
- Authorization and data exposure flaws in citizen-facing web portals and mobile apps.
- Long-lived legacy systems that are hard to update.
- Phishing attacks aimed at staff.
- Inter-agency integrations and contractor access.
Cybersecurity for Public Institutions
Public institutions have a wide attack surface because of their citizen-facing digital services and large volumes of personal data. Nokta Guard measures the effectiveness of the Information and Communication Security Guide's measures through penetration testing for ministries, municipalities, universities and other public bodies.
Drag and drop, or click.Relevant regulations
The core framework for public institutions is the Information and Communication Security Guide prepared under Presidential Circular No. 2019/12. Cybersecurity Law No. 7545 and, for all systems processing personal data, KVKK Technical Measures also apply.
Recommended services
- Web, mobile and API penetration testing; source code analysis for in-house software.
- Internal network and Active Directory penetration testing.
- Phishing simulation and awareness training.
- A report mapping findings to the Guide's asset groups, plus retesting.
Frequently Asked Questions
Are public institutions required to perform penetration testing?
The Information and Communication Security Guide lists penetration testing among the methods for auditing measures, and implementation of the Guide is audited at least once a year. Frequency and scope depend on asset criticality.
Do you also perform Guide compliance audits?
Guide compliance audits and penetration tests are separate engagements; outsourced compliance audits are carried out by firms authorized under the program defined in the Audit Guide. We focus on penetration testing and technical validation.
Will testing disrupt citizen services?
We plan testing under rules that protect service continuity, outside working hours where needed. High-risk tests are carried out only with your prior approval.