IYS and Cybersecurity Requirements
The Message Management System (IYS) is a centralized platform where commercial electronic message consents are recorded, stored, and managed. The operation of the system is subject to oversight by the Information Technologies and Communication Authority (BTK) under the Regulation on Commercial Communication and Commercial Electronic Messages.
Companies that operate systems integrated with IYS or provide the infrastructure for these systems must meet specific technical security standards in order to obtain BTK accreditation. These standards cover system reliability, data integrity, and protection against unauthorized access requirements.
IYS platforms process communication consent and approval data belonging to millions of individuals. This data requires special protection under KVKK; the adequacy of technical security measures is of critical importance for both BTK and KVKK audits.
IYS Systems Security Testing Scope
TUGAY conducts penetration tests for IYS companies with specialists who have an in-depth understanding of the platform's architecture and legal requirements:
- IYS API endpoint security tests
- Consent registration and query system integrity tests
- Authentication and session management security
- Unauthorized data access and IDOR tests
- Database security and SQL injection analysis
- Infrastructure and server configuration security
- Service availability and DoS resistance testing
BTK Accreditation Process
- Technical Requirement Analysis: Technical security requirements in the BTK accreditation guide are identified; gaps between the current state and requirements are determined.
- Infrastructure Security Testing: All system components are subjected to penetration testing; high-risk vulnerabilities are prioritized.
- Data Security Verification: The technical security of personal data processing, storage, and deletion processes is verified.
- Remediation and Closure Testing: Identified vulnerabilities are remediated; a closure test documents effectiveness.
- Accreditation Report: A technical security report suitable for use in the BTK application is delivered.
Ongoing Security Programme
Maintaining BTK accreditation requires ongoing security management beyond a one-time security test. TUGAY continuously evaluates the security posture of IYS companies through periodic testing and monitoring services.
- Comprehensive penetration test at least once per year
- API and application testing with each software version update
- 24/7 security monitoring and anomaly detection consulting
- Periodic BTK and KVKK compliance status reporting