1. Home
  2. Services
  3. Information Security and Compliance
Information security consulting

Information Security and Compliance Consulting

Information security consulting covers building the management system, the technical controls and the supporting evidence that protect an organization's information assets. From ISO 27001 certification readiness and the technical and administrative measures required by KVKK (Türkiye's Personal Data Protection Law No. 6698) to penetration testing and internal audit, we bring policy and practice together in one system.

Request a meeting Free assessment
Sample interface: readiness by ISO 27001 control theme, risk matrix and vulnerability tracking list ISO/IEC 27001 · readiness Annex A control themes Organizational 31/37 People 8/8 Physical 12/14 Technological 27/34 risk matrix likelihood → impact ↑ vulnerability management · open items last scan: today High Outdated TLS configuration in progress Medium Admin panel publicly exposed closed Medium Missing security headers closed Low Server version disclosure scheduled
Scope
ISO 27001, 27701, 22301 and PCI DSS readiness, KVKK measures, penetration testing, internal audit, training
Approach
Risk-based; policy and technical controls together
Working model
Project · periodic testing · ongoing advisory
First step
Free initial consultation and a current-state assessment
When you need it

When does security and compliance work come up?

Security requirements usually come up with a customer request, an audit or a growth step. We scope the work around that goal.

  • A customer is asking for ISO 27001 certification or a security audit. The scope, timeline and required steps need to be clarified.
  • KVKK's technical measures need to be put into practice. Access, logging, encryption and disposal processes need to work in line with the data inventory.
  • Vulnerability scan results need follow-up. Findings need to be prioritized, assigned to owners and tracked through to closure.
  • You want your systems tested by an independent party. Externally and internally reachable systems are tested through penetration testing within a defined scope.
  • Security awareness training for employees is being planned. Regular, recorded training on topics such as phishing, passwords and device security.
Scope

What do we cover in information security and compliance?

From the management system to technical testing, areas you can choose according to your needs.

ISO 27001 certification readiness

Scope and risk assessment, policies and procedures, the Statement of Applicability and preparation for the certification audit.

ISO 27701, ISO 22301 and PCI DSS

Readiness for privacy, business continuity and cardholder data security, run on its own or alongside your existing system.

Information and Communication Security Guide

BİG Rehberi compliance: defining asset groups and criticality levels, gap analysis, implementing the measures and audit preparation.

KVKK technical and administrative measures

Access, logging, encryption, backup and disposal processes put into practice, based on your personal data inventory.

Internal audit

Internal audit of the management system by auditors independent of the team that built it, with corrective action follow-up.

Penetration testing

Web, external and internal network and cloud tests; black-, gray- or white-box, written rules of engagement and retesting.

Vulnerability management

Regular scanning, prioritization of findings, tracking through to closure and clear, regular reporting to management.

Awareness training

Hands-on training for employees on topics such as phishing, passwords and device security, with attendance records.

Process

Risk-based, step by step.

We tie every control to a risk and address the highest risks first, so effort goes where it makes the most difference. The flow below shows an end-to-end engagement; each area can also be taken on separately.

Frameworks we follow

Our work is based on recognized standards and regulations:

  • ISO/IEC 27001:2022 and 27002
  • ISO/IEC 27701:2025, ISO 22301, PCI DSS v4
  • KVKK (Law No. 6698) and the Personal Data Security Guide
  • Information and Communication Security Guide
  • OWASP testing guides
  • CIS Controls
1

Current state and scope

We review assets, processes and existing controls, and define the scope together.

Output: Scope and gap analysis
2

Risk assessment

We evaluate threats and their impact, and prioritize controls.

Output: Risk assessment report and risk treatment plan
3

Implementing controls

We put policies, processes and technical measures in place together.

Output: Policy set, implemented controls
4

Testing and verification

We verify that controls work through vulnerability scanning and penetration testing; the internal audit is carried out by an auditor independent of the team that built the system.

Output: Test reports, internal audit report
5

Maintaining the system

We keep the system current through periodic testing, evidence tracking and management review.

Output: Periodic reports
Deliverables

What a security and compliance engagement delivers.

Depending on scope, tangible outputs you can show to an auditor, a customer or management.

Gap and risk analysis

Current state, risks and a prioritized risk treatment plan.

Policy and procedure set

Practical documents tailored to your organization.

Internal audit report

Findings, nonconformities and a corrective action plan.

Test reports

Executive summary, technical findings, evidence and remediation advice.

Remediation verification

Retesting to confirm that closed findings are fixed.

Training material

Awareness training content and attendance records.

Who it is for

A starting point that fits your goal.

SMEs preparing for customer audits

Businesses preparing for enterprise customers' security questionnaires and supplier audits.

Companies aiming for ISO 27001

Those who want to approach certification in phases, on a realistic timeline and with a structure that produces evidence.

Public sector and critical infrastructure suppliers

Public institutions and their suppliers that are expected to comply with BİG Rehberi measures.

Before we start

Making the first meeting productive.

None of these are prerequisites; whatever you have makes the first meeting more concrete.

What you can prepare, if available

  • A list of systems and assets, even if incomplete
  • Your goal: ISO 27001 certification, KVKK measures, a customer questionnaire or an audit
  • Any previous audit, scan and test reports
  • Process owners and contacts
  • Constraints: timeline, downtime windows, systems to keep out of scope
Frequently asked questions

About information security and compliance

References and standards

It covers identifying your organization's information assets and risks, putting policies, processes and technical controls in place against those risks, and verifying through testing and audits that they work. The work is usually scoped around a standard such as ISO 27001 or a customer requirement.

No. The certificate is issued by the accredited certification body that performs the certification audit. We prepare your organization for that audit, carry out the internal audit and support you throughout the process.

Three things determine the duration: the breadth of the scope, your current maturity level and the time process owners can set aside. After the gap analysis, we draw up a realistic, phased timeline.

No. Auditors ask for records and evidence that policies are applied, such as access reviews, backup tests, training records and incident records. That is why, alongside the documents, we also set up how the evidence will be produced.

Yes, each area can be taken on separately. For a penetration test alone, the output is a test report with an executive summary, technical findings and remediation advice, plus retesting to verify the fixes. For an internal audit alone, you receive an internal audit report with findings and a corrective action plan; for readiness work alone, a gap analysis, a risk treatment plan and a policy set.

Yes. The standard expects auditors not to audit a system they built themselves, so the internal audit is carried out by an auditor independent of the team that built the system.

Yes; each one addresses a different need. ISO/IEC 27701:2025 specifies the requirements for a privacy information management system (PIMS) for processing personal data; it can be implemented on its own or, if you already have an ISO 27001 system, together with it. ISO 22301 covers business continuity management systems for handling disruptions. PCI DSS is a security standard for organizations that process, transmit or store cardholder data; depending on the organization's level and the requirements of its acquiring bank or the card brands, a self-assessment questionnaire (SAQ) or an assessment by a Qualified Security Assessor (QSA) is required. In each case, we prepare your organization for the assessment.

The guide is published by Türkiye's Cybersecurity Directorate (Siber Güvenlik Başkanlığı) and applies to public institutions and organizations and to critical infrastructure operators. Suppliers serving these organizations may also be expected to comply through their contracts. We run compliance work from identifying asset groups through to preparing for the annual audit. The annual compliance audit itself is carried out by auditors with the competence required by the regulations; a firm that provides compliance consulting to an organization cannot audit that same organization for a set period.

Our service focuses on the technical and administrative measures under KVKK. Legal matters such as privacy notices, consent and contracts fall within your legal advisor's remit; we carry out the technical measures in coordination with them, working from the same documents.

Before testing starts, the rules are set in writing: written authorization, in-scope and out-of-scope systems, testing windows, contacts on both sides and the conditions under which testing will be stopped. Steps that carry a risk of disruption in production are planned with you separately.

In black-box testing, the tester starts with no information, like an outside attacker. In gray-box testing, limited information is provided, such as an ordinary user account. In white-box testing, the architecture, source code or configuration is also shared. Which one is suitable depends on what you want to measure.

Common practice is at least once a year and after major changes; regulatory or customer requirements may call for more frequent testing. For applications that change often, we recommend complementing periodic testing with DevSecOps controls.

Yes. When needed, we start the work under a non-disclosure agreement; reports are shared only with the people you designate, over a secure channel.

Related services

DevSecOps

Secure CI/CD and software supply chain

IT Architecture and Cloud

Cloud migration, hybrid architecture, cost management
Free initial consultation

Let's work through your security and compliance goals together.

In a free initial consultation we discuss your current situation and goals, and share our first impressions and possible next steps in the same meeting.

Request a meeting +90 216 203 01 21
  • A technical conversation with specialists in your area
  • First impressions of your situation and possible approaches
  • Where it fits, a next step: an assessment, a project proposal or consulting
  • A non-disclosure agreement before the meeting when needed
  • A reply within 4 business hours