Turkey's Cybersecurity Law No. 7545: first steps for businesses

Cybersecurity Law No. 7545 was published in Turkey's Official Gazette and entered into force on March 19, 2025. The law holds public bodies as well as natural and legal persons responsible for taking cybersecurity measures, and treats accountability as a core principle.

The details of implementation (thresholds, notification procedures, technical standards) are set through secondary regulations. While these are awaited, the technical preparation is fairly clear.

1. Understand the institutional structure

The law established a Cybersecurity Board under the Presidency; implementation is run by the Cybersecurity Directorate, set up by Presidential Decree No. 177. The Directorate has powers to manage standards and certification, carry out audits and, where needed, conduct on-site inspections.

2. Build an asset inventory

Risk assessment is impossible without knowing which servers, network devices, cloud services and applications are in use. The inventory should include owner, location, software version and whether the asset is exposed to the internet.

3. Centralise log collection and retention

To show what happened after an incident, firewall, server, identity and endpoint logs should be kept centrally and in tamper-proof form. Your existing Law 5651 and KVKK logging setup is a good starting point.

4. Write an incident response plan

Who to call, which systems to isolate and whom to notify when an attack is detected should be written down in advance. Test the plan with a tabletop exercise at least once a year.

5. Tighten access and identity controls

Multi-factor authentication for remote access and admin accounts, least privilege and fast removal of leavers' accounts are the most basic measures.

6. List your suppliers

Software vendors, maintenance companies and cloud providers that access your systems are part of the cyber risk chain. Record who accesses what, and how.

7. Put it on the management agenda

Security budget, risk acceptance and post-incident communication are management decisions. Give management a short status report at least twice a year.

Let's prepare together

At Bilgi Teknoloji we plan inventory, central monitoring and logging, vulnerability scanning and incident response planning to fit the size of your company.