Tepeören Software: ISO 27001:2022 transition and KVKK compliance

The transition period for Tepeören Software's certificate issued to the 2013 version was about to expire. The company also wanted to be ready for a KVKK inspection, but the two workstreams were running independently of each other.

Approach

• The 2013 SoA was mapped to the four themes and 93 controls of 2022; a gap analysis was made for the 11 new controls
• Supplier security assessment for cloud service providers and sub-processors
• Writing data deletion, data masking and secure coding policies and integrating them into the CI/CD pipeline
• The KVKK data inventory, VERBİS registration and ISO 27001 risk register were merged

Result

The transition audit was completed in three weeks with only one minor nonconformity. Thanks to the single record infrastructure the annual KVKK update fell from two days to half a day.