Information Security Policy

1. OVERVIEW

Information Security comprises the necessary measures and precautions taken to protect vitally important information, ensure its integrity, and keep it accessible, in line with the principles of confidentiality, integrity, and availability.

• Confidentiality: Ensuring that information does not fall into the hands of unauthorized persons and is protected against unauthorized access.
• Integrity: Ensuring that information is not altered by unauthorized persons.
• Availability: Ensuring that information is accessible and usable by authorized persons whenever needed.

2. SCOPE

This policy covers all employees, interns, and outsourced personnel of BASE9. All users must act in awareness of the responsibilities and legal obligations set out in this policy.

3. OBJECTIVE

The objective of this policy is to protect the reliability of the organization and the image of the authority it represents, to ensure compliance in contracts entered into with third parties, and to ensure the continuity of the organization’s core and supporting business activities with minimal interruption.

4. RESPONSIBILITY

Within the defined scope, the Information Security Management Board is responsible for keeping risks to the company’s information assets at an acceptable level approved by management.

5. INFORMATION SECURITY PRINCIPLES

• • Learning and complying with the principle of protecting confidential information, along with other policies and documents.
• • Ensuring the confidentiality, integrity, and availability of company information in personal and electronic communications.
• • Not sharing internal information resources (documents, announcements, etc.) with third parties without authorization.
• • Protecting the confidentiality, integrity, and availability of information belonging to Base9 customers, business partners, suppliers, or third parties.
• • Not using the company’s information systems and infrastructure for activities that violate legislation.
• • Reporting information security breach incidents and taking measures to prevent such breaches.
• • In order to keep the information security policy applicable and to ensure that the established rules and the measures taken do not disrupt operations, these structures must be reviewed at regular intervals, continuously improved, and action plans must be prepared.
• • Information security risks must be identified and assessed, and a risk treatment plan must be prepared accordingly.

6. VIOLATION OF RULES AND SANCTIONS

In the event that this policy is violated, the cause of the breach is investigated by the Base9 Information Security team, with the support of relevant personnel as needed. If the breach is unintentional and stems from a deficiency such as a lack of training, work is carried out to close the deficiency that caused the problem. In the event of non-compliance with the information security policy, procedures, and instructions, the organization may apply actions such as warning, reprimand, monetary penalty, and termination of contract.

7. GENERAL INFORMATION SECURITY APPROACH

As Base9 Bilişim Teknolojileri Ticaret Anonim Şirketi, in order to manage all kinds of risks to our information security, business continuity, and information assets, we commit to:

• • Ensuring that the information security management system is audited at regular intervals and continuously improved,
• • Considering our corporate data and information (personnel records, customer and supplier data, and others) as valuable and critical, and fulfilling the obligations required by the laws and standards related to information security,
• • Providing the necessary infrastructure and taking the security measures to ensure that the information technology services used in carrying out our corporate activities are maintained without interruption and that information can be accessed only by authorized persons,
• • Establishing, documenting, and continuously improving the Information Security Management System required by the TS ISO/IEC 27001:2022 standard,
• • Following the legal regulations and requirements related to information security,
• • Conducting the necessary training to raise information security awareness,
• • Ensuring that external service providers meet the needs and requirements demanded by the information security system,
• • Defining the information security requirements of third parties, customers, and suppliers, and ensuring their compliance with the information security management system,
• • Defining our company’s information security standards, and auditing and ensuring their compliance at regular intervals.