Purpose
Article 1- The purpose of this Policy is to take precautions regarding information sharing and security in parallel with the requirements of the information age, due to the duties and position of Startupfon Crowdfunding Platform Inc. (hereinafter referred to as the Platform), to ensure the protection of information against all threats that may arise intentionally or accidentally from within and/or outside, evaluated in terms of confidentiality, integrity, and availability, and to carry out the activities effectively, accurately, quickly, and securely.
This Policy aims to frame the information security conditions to which the employees and relevant parties of the Platform must comply in all its activities, and to regulate the principles and rules regarding written regulations.
Scope
Article 2- This policy covers the information system assets located in the headquarters and branches of Startupfon Crowdfunding Platform Inc., personnel with access to information systems, business processes related to software development, sales, installation, support, integration, training, consulting services, and the establishment, operation, management, and use of information systems; the Information Security Policy, prepared by senior management, ensures the confidentiality, integrity, and availability of information when necessary, and is approved by the board of directors. The approved information security policy is announced to the personnel and the public. This policy includes the definition of necessary roles and responsibilities for the operation of information security processes, the establishment of processes for managing risks related to information systems, and the implementation and monitoring of controls.
2.1 Internal Scope
Administration, Structure, Roles, and Responsibilities of the Organization
The departments included in the scope;
Includes Information Technologies, Finance, Accounting, and Information Quality Management.
Policies, goals, and strategies to be implemented
• Policies defined in all management systems,
• Annual Information Security Management System goals determined by Management,
• Organizational culture,
• Capabilities understood in terms of resources and knowledge (e.g., capital, time, people, processes, systems, and technologies),
• Management Representatives and the Information Security Management System team appointed by management for the establishment, operation, and maintenance of the Information Security Management System,
• Relationships with internal stakeholders and their perceptions and values, the organization's culture, standards, guidelines, and models adapted by the organization, the nature and scope of contractual relationships are also included.
• Standards, guidelines, and models adopted by the organization for Information Security management systems,
• Issues related to products, production processes, design activities, installation and service activities, strategic plans, financial opportunities, human resources structure that may positively or negatively affect our responsibility for Information Security,
• Controversial problems and changing situations or discussions affecting the ability to achieve the intended outputs determined by the Platform Information Security Management System.
External Scope
Policies, goals, and strategies to be implemented
Social and cultural, political, legal, regulatory, financial, technological, economic, natural, and competitive environments at international, national, regional, or local levels,
Global Competition Law, Policies, and Procedures,
Confidentiality of supplier and investor data,
Relationships with stakeholders that have an impact on the organization’s objectives and their perceptions and values,
All Platform employees and subcontractors, including Top Management, to meet investor expectations
All Platform employees, including Top Management, to ensure investor satisfaction,
All relevant legal regulations, regulatory, contractual obligations, standards,
Suppliers and outsourced service providers,
Product certifications are outside the scope.
Legal Basis and Definitions
Article 3- This Policy has been prepared based on the “Crowdfunding Communiqué (lll – 35/A.2)” published in the Official Gazette dated 27.10.2021 with number 31641 and the “Information Systems Management Communiqué (VII-128.9)” published in the Official Gazette dated 9.1.2020 with number 31003 (“Information Systems Management Communiqué”).
3.1. ISMS: Information Security Management System.
3.2. Inventory: All types of information assets important for the institution.
3.3. Know-How: The competence to perform a task.
3.4. Information Security: Information, like all other institutional and commercial assets, is a valuable asset for a business and therefore must be properly protected. The Platform considers know-how, processes, formulas, techniques and methods, personnel information, commercial, industrial, and technological information as CONFIDENTIAL INFORMATION.
3.5. Confidentiality: The restriction of access to the content of information only to authorized individuals who have permission to view the information/data. (Example: Even if the email is intercepted during encrypted email transmission, unauthorized individuals can be prevented from reading the emails.)
3.6. Integrity: The ability to detect unauthorized or erroneous modifications, deletions, or additions and to ensure detectability. (Example: Storing summary information along with data stored in databases, digital signatures)
3.7. Availability: The asset must be ready for use whenever it is needed. In other words, systems must be continuously available, and the information in systems must not be lost and must remain continuously accessible. (Example: Use of uninterruptible power supplies and redundant power supplies in chassis to protect servers from power fluctuations and outages).
3.8. Information Asset: The assets that the Platform possesses and are important for carrying out its business without interruption are as follows within the processes covered by this policy:
• All types of information and data presented in paper, electronic, visual, or auditory media,
• All software and hardware used to access and modify information,
• Networks that enable the transfer of information,
• Departments, units, teams, and employees,
• Facilities and special areas,
• Solution partners,
• Services, products, or services provided by third parties.
3.9. Senior Management:
3.10. ISMS Committee:
3.11. ISMS Manager
3.12. SSL VPN: It is a type of connection to a network secured by using the internet browsers provided by operating systems without requiring any software or hardware on the end-user side. It is possible to use SSL VPN with mobile devices or personal devices.
3.13. Static IP: IP addresses assigned by Internet Service Providers may change over time. Static IP addresses, however, do not change; they remain fixed for the assigned device or server.
3.14. Server: A computer technology that responds to user requests over a computer network.
3.15. Driver: A driver is a software that allows your computer to communicate with hardware or devices.
3.16. Switch: A network hardware that allows computers and other network devices to connect to each other.
3.17. Tunnel: A data obfuscation method used by applications to access the corporate network.
3.18. UTP Cable: Unshielded twisted pair cable used for data communication between computers.
3.19. Virus Pattern: It is a signature file used by antivirus programs to recognize viruses.
3.20 VLAN (Virtual Local Area Network): This is a logical grouping made by connecting network users and resources to ports on a switch.
3.21. VPN: The abbreviation for Virtual Private Network, which is a technology used for secure remote access to networks. Since it creates a virtual network extension, a machine connecting remotely appears to be physically connected to the network.
3.22 Router: It guides the computers on the network to find their directions. In other words, devices that serve to transfer IP packets from one network to another are called routers.
SECOND CHAPTER
PARTIES, RESPONSIBILITIES, and UNITS
Responsibility and Authority
Article 4- The qualities and qualifications of the tasks for which responsibilities and authorities are defined are specified in job descriptions. It is for the continuation and development of activities related to information security. The ISMS Team is appointed by Senior Management. Representatives of the ISMS have been appointed from the departments within scope. Appointments have been made by name as ISMS team members. The ISMS Manager is responsible for the currency and continuity of the Information Security Policy. Updates to the Information Security Policy are determined in Management Review meetings and reflected in the document by the ISMS Manager. Each update is approved by Senior Management.
4.1. Management Responsibility
• The Platform’s Senior Management commits to complying with the defined, enforced, and implemented Information Security System and providing the necessary resources for the efficient operation of the system, ensuring that the system is understood by all employees.
• During the establishment of the ISMS, the ISMS Management Representative is appointed by a letter of appointment. When necessary, the document is revised by senior management and the appointment is repeated.
• Managers at the management level assist in giving responsibility to the personnel at lower levels regarding security and serve as role models. The understanding starting from the upper levels must reach down to the lowest rank employees in the organization. Therefore, all managers support their employees to comply with written or verbal security instructions and participate in security-related activities.
• Senior Management creates the budget necessary for comprehensive information security activities.
4.2. Responsibilities of ISMS Team Members
• Conducting inventory and risk analysis studies related to their departments,
• Informing the Management Representative when there is a change that will affect the information security risks in the information assets under their responsibility, to conduct a risk assessment,
• Ensuring that department employees are working in accordance with policies and procedures,
• Raising awareness about ISMS within their departments, ensuring communication, and meeting documentation requirements,
• Being responsible for maintaining the existing structure of the ISMS and providing continuous improvements.
4.3. Responsibilities of Internal Auditors
• Responsible for conducting and reporting audit activities in internal audits assigned in accordance with the internal audit plan.
4.4. Responsibilities of Department Managers
• Responsible for the implementation of the Information Security Policy and ensuring that employees comply with the principles, ensuring that third parties are aware of the policy, and reporting security breach incidents related to information systems they notice.
4.5 Responsibilities of All Employees
• Responsible for carrying out their activities in accordance with the information security objectives, policies, and information security management system documents,
• Tracking the information security objectives related to their unit and ensuring that the targets are met.
• Paying attention to any information security vulnerability observed or suspected in systems or services and reporting it,
• Required to enter into confidentiality agreements and meet information security requirements in addition to service contracts (consulting, etc.) with third parties that are not under purchasing responsibility.
4.6. Responsibilities of Third Parties
• Responsible for being aware of and complying with the Information Security Policy as well as the behaviors specified under the ISMS.
Information Security and Risk Management Framework
Article 5- Information, like other essential commercial and corporate assets, is an asset that has value for a business and an organization and therefore must be properly protected. Information security protects against hazards and threats to ensure business continuity and minimize losses. Information security is defined in this policy as the protection of the following information qualities:
Confidentiality: Guaranteeing that information is accessible only to individuals who have been granted access privileges,
Integrity: Ensuring the accuracy of information and processing methods and that they cannot be altered without authorization,
Availability: Ensuring authorized users can access information and related resources as quickly as needed.
The information security policy document is a document that specifies the highest-level principles to be used during the application of the audits created to deliver the above protections and requirements.
The Platform's risk management framework covers the identification, assessment, and treatment of information security risks. Risk Analysis, feasibility statements, and risk treatment plans describe how information security risks are controlled. The ISMS is responsible for the management and execution of the risk treatment plan. All these activities are detailed in the “Asset Inventory and Risk Assessment Procedure.”
Information Security Goals and Objectives
Article 6- This policy aims to guide Platform employees to act in accordance with security requirements, to raise awareness and consciousness levels, and thereby to ensure that the core and supporting business activities of the company continue with minimal disruption, to maintain its reliability and image, and to protect the physical and electronic information assets affecting the company’s entire operations to ensure compliance defined in contracts with third parties. The targets set by management are monitored at specified intervals and reviewed in ISMS meetings.
Information Security Organization
Article 7- An organization has been established regarding the Information Security Management System as follows in the Platform.
The ISMS Management Representative is responsible for the maintenance and development of activities related to the ISMS.
The ISMS Manager is responsible for the establishment and operation of the Information Security Management System.
The ISMS Management Representative and the ISMS Manager are appointed by Senior Management.
ISMS Responsible personnel have been identified in the units included in the scope. ISMS Responsible personnel are obliged to follow and coordinate the Information Security Management System activities in their own units.
Business Continuity Plan
Article 8- The Platform has prepared a Business Continuity Plan and Emergency Action Plan based on the Information Systems Management Communiqué. These plans, which are necessary for the Platform to carry out its value-creating activities at a predetermined level during any disaster, crisis, and emergency situation, document and define the scope, structure, basic elements, information systems continuity plan, and emergency and unexpected situation plan. The goal is to minimize the operational, financial, legal, and reputational negative effects, manage issues, identify the actions to be prioritized in the event of any unforeseen and emergency situation, and protect the company's assets and reputation.
Risk Management
Article 9- The Platform’s ISO 27001 Risk Management Framework includes the identification, assessment, and treatment of Information Security and Service Management risks. Risk Analysis and Risk Treatment Plan describe how Information Security and Service Management risks are controlled. The ISMS Executive and Management Committee is responsible for the management and execution of the Risk Treatment Plan.
In the management of risks related to information systems, at a minimum, the following issues are taken into consideration:
Negative consequences of failing to adapt to developments in the competitive environment due to the rapid advancements in information technologies, difficulties in adaptation, and changes in legal regulations,
The potential for unforeseen errors and fraudulent activities due to the use of information systems,
The possibility of dependency on external service providers due to the use of external resources in information systems,
Significant reliance of business and services on information systems,
The increasing difficulty in ensuring the security of transactions conducted through information systems, data, and records kept for audit trails.
The Risk Management Plan below has been prepared for the issues mentioned above.
Inventory No:
Type
Brand
Model
Time of Purchase
Serial Number
