Turkey named its critical infrastructure sectors: what it means for manufacturing, healthcare and logistics

Turkey's Cybersecurity Law No. 7545 gives the Cybersecurity Board the task of naming critical infrastructure sectors. According to publicly reported information, the Board named the following areas at its first meeting in May 2026:

• Digital infrastructure, digital services, electronic communications
• Energy, water management
• Finance
• Food and agriculture
• Manufacturing
• Public services
• Media and crisis communication
• Postal and courier services, transport, space
• Healthcare
• Defence industry

The list is broad. A sector being on it does not mean every company in that sector will face the same obligations; the size thresholds and criteria that define scope will be set out in secondary regulations.

Why prepare now?

In manufacturing, healthcare and logistics, IT and operational technology (OT) are closely linked. A ransomware attack can stop not only email but also a production line, warehouse management or patient records. These measures protect the business whether or not you end up in scope.

1. Separate IT and OT networks

PLCs, SCADA systems and machine PCs on the production floor should be separated from the office network by a firewall. Traffic between the two should be limited to the connections that are actually needed.

2. Keep an up-to-date network map

Without knowing which device connects where, both segmentation and incident response slow down. Keeping switch and firewall configs backed up and versioned lets you roll back within minutes if a change causes an outage.

3. Control remote maintenance access

Remote access for machine vendors and software companies is often left permanently open. Provide it through MFA-protected VPN or ZTNA, only when needed and with logging.

4. Protect backups with an offline copy

Keeping at least one backup copy offline or immutable is the most reliable protection against ransomware. Measure restore times for critical systems.

5. Prepare the incident notification chain

Who decides, whom to notify and how quickly should be written down. Make personal data breach notification under KVKK part of the same plan.

Let's prepare together

At Bilgi Teknoloji we plan network segmentation, firewall and VPN and backup and disaster recovery projects around how manufacturing, healthcare and logistics companies actually work.