Security Control Checklist

CATEGORY 01

Authentication & Access Control

User authentication, authorization and access management controls.

0/12

Strong password policy is enforced on all user accounts At least 12 characters, upper/lowercase letters, numbers and special characters are required. ISO 27001 A.9.4.3

Multi-factor authentication (MFA) active MFA is mandatory, especially for critical systems and remote access. NIST SP 800-63B

The principle of least privilege (Least Privilege) is applied Users only have the minimum privileges required for their work. ISO 27001 A.9.1.2

Regular access reviews are carried out User permissions are checked at least every 3 months. ISO 27001 A.9.2.5

Default passwords have been changed All system, device and application default passwords have been changed. ISO 27001 A.9.4.3

Account lockout policy is active After 5 unsuccessful attempts, the account is locked. NIST SP 800-53

Session timeout configured The session is automatically closed after 15-30 minutes of inactivity. ISO 27001 A.9.4.5

No shared accounts Each user has their own private account, account sharing is prohibited. ISO 27001 A.9.2.1

Has a privileged account management (PAM) solution Admin accounts are specially managed and monitored. ISO 27001 A.9.2.3

Entry/exit procedures are documented There is an account management procedure when an employee starts and leaves work. ISO 27001 A.7.2.2

Remote access protected by VPN All remote access is done via VPN and MFA. ISO 27001 A.13.1.1

Service accounts are regularly audited Service accounts are reviewed and unused ones are closed. ISO 27001 A.9.2.5

CATEGORY 02

Network Security

Network infrastructure, firewall, segmentation and network monitoring controls.

0/11

Firewall active and configured Firewalls are installed at all network entry/exit points and their rules are reviewed regularly. ISO 27001 A.13.1.1

Network segmentation applied With VLANs, the network is divided into sections and critical systems are isolated. ISO 27001 A.13.1.3

Unnecessary ports and services are closed Only necessary ports are open, others are blocked in the firewall. ISO 27001 A.12.5.1

IDS/IPS systems are active Network traffic is monitored and attack attempts are automatically detected. ISO 27001 A.12.4.1

Wi-Fi networks are protected with WPA3 Strong encryption is used in wireless networks, the guest network is separate. ISO 27001 A.13.1.1

DMZ configured External services are in the DMZ, isolated from the internal network. ISO 27001 A.13.1.3

DDoS protection active A DDoS attack protection solution (CDN/WAF) is used. ISO 27001 A.17.2.1

DNS security ensured DNSSEC is active, DNS queries are monitored, there is DNS hijacking protection. ISO 27001 A.12.4.2

There is a NAC (Network Access Control) solution Devices connected to the network are verified and unauthorized devices are blocked. ISO 27001 A.13.1.1

Network map documented There is an up-to-date network topology map and it is updated regularly. ISO 27001 A.12.1.2

Network traffic monitoring is in progress Network traffic is constantly monitored and anomalies are detected. ISO 27001 A.12.4.1

CATEGORY 03

Data Protection & Encryption

Data classification, encryption, backup and data loss prevention controls.

0/10

There is a data classification policy Data is classified according to sensitivity levels (Public, Internal, Confidential, Top Secret). ISO 27001 A.8.2.1

Data in motion is encrypted (TLS 1.2+) All network traffic and web communication is protected by strong encryption. ISO 27001 A.10.1.1

Data at rest is encrypted (AES-256) Disk, database and file encryption applied. ISO 27001 A.10.1.1

3-2-1 backup strategy implemented 3 copies, 2 different media, 1 off-site backup. ISO 27001 A.12.3.1

Backups are tested regularly Restoration tests from backups are performed at least every 3 months. ISO 27001 A.12.3.1

DLP (Data Loss Prevention) solution is active Leakage of sensitive data is automatically prevented. ISO 27001 A.13.2.3

Has USB and removable media control Unauthorized USB use is prevented and data transfer is monitored. ISO 27001 A.8.3.3

Data masking is applied Real data is masked in test and development environments. GDPR Art.25

Key management is secure Encryption keys are managed with HSM or KMS. ISO 27001 A.10.1.2

Data destruction procedure documented Data that is no longer used is securely destroyed. ISO 27001 A.8.3.2

CATEGORY 04

Application Security

Web applications, APIs and software development security controls.

0/11

Input validation is applied All user input is validated server side. OWASP A03:2021

Output encoding is being done Responses to XSS attacks are encoded. OWASP A03:2021

Prepared statements are used Parameterized queries are used against SQL injection. OWASP A03:2021

CSRF tokens are used CSRF protection is active on form submissions. OWASP A01:2021

Security headers configured CSP, HSTS, X-Frame-Options, X-Content-Type-Options headers are active. OWASP A05:2021

Error messages do not inform the user Detailed error messages are written to the log, and a generic message is shown to the user. OWASP A04:2021

Regular security testing is carried out SAST, DAST and penetration tests are applied periodically. ISO 27001 A.14.2.8

API security ensured APIs are protected by rate limiting, authentication and authorization. OWASP API Top 10

Dependencies are kept up to date Third party libraries are updated regularly, there are no known vulnerabilities. OWASP A06:2021

WAF (Web Application Firewall) is active Web applications are protected with WAF. ISO 27001 A.13.1.1

Secure SDLC implemented Security is integrated in the software development lifecycle. ISO 27001 A.14.2.1

CATEGORY 05

Physical Security

Physical access control, environmental security and hardware protection.

0/8

Server room is physically protected It is protected by locked doors, security cameras and access cards. ISO 27001 A.11.1.2

Visitor access is controlled Visitors are registered and escorted. ISO 27001 A.11.1.6

Environmental controls in place Temperature, humidity, fire and flood sensors are installed. ISO 27001 A.11.2.1

There is an uninterruptible power supply (UPS) UPS and generator backup are available for critical systems. ISO 27001 A.11.2.7

Table cleaning policy is enforced Sensitive documents are not left on the table, they are kept in locked cabinets. ISO 27001 A.11.2.9

Screen lock policy is active The computer automatically locks when employees leave their desks. ISO 27001 A.11.2.9

Hardware inventory is kept All IT assets are registered, location and ownership information is up to date. ISO 27001 A.8.1.1

There is a safe disposal procedure Old hardware and media are disposed of safely. ISO 27001 A.8.3.2

CATEGORY 06

Logging & Monitoring

System logs, security monitoring and event detection checks.

0/9

Logging is active in all critical systems Servers, firewalls, applications keep logs. ISO 27001 A.12.4.1

There is central log management (SIEM) All logs are collected and analyzed in a central system. ISO 27001 A.12.4.1

Logs are stored unchangeable Log integrity is protected and unauthorized changes are prevented. ISO 27001 A.12.4.2

Time synchronization (NTP) implemented All systems are synchronized to the same time source. ISO 27001 A.12.4.4

Anomaly detection enabled Abnormal activities are automatically detected and warned. ISO 27001 A.12.4.1

There is a log retention policy Logs are stored for a period of time in accordance with legal requirements (min. 1 year). ISO 27001 A.12.4.2

Admin activities are monitored Privileged user transactions are logged specifically. ISO 27001 A.9.4.2

There is a 24/7 SOC (Security Operations Center) Security incidents are constantly monitored and intervened. ISO 27001 A.16.1.2

Log reviews are carried out regularly The security team reviews the logs periodically. ISO 27001 A.12.4.1

CATEGORY 07

Employee Training & Awareness

Human factor safety, training programs and awareness activities.

0/8

Cyber security awareness training is provided All employees are given regular cyber security training. ISO 27001 A.7.2.2

Phishing simulations are being made Employees are tested with a phishing simulation at least once a month. ISO 27001 A.7.2.2

There is a start-up safety orientation New employees are informed about security policies. ISO 27001 A.7.2.2

Role-based special training is provided Special security training for departments such as IT, finance and HR. ISO 27001 A.7.2.2

Security policies are accessible All employees can easily access security policies. ISO 27001 A.5.1.1

There is a security breach reporting channel Employees can easily report suspicious situations. ISO 27001 A.6.1.2

Training records are kept It is recorded who received which training and when they completed it. ISO 27001 A.7.2.2

Regular security bulletins are published Employees are informed about current threats. ISO 27001 A.7.2.2

CATEGORY 08

Incident Response & Management

Security incident response, computer forensics and crisis management.

0/9

Incident Response Plan (IRP) documented The security incident response procedure is written and up to date. ISO 27001 A.16.1.5

There is CSIRT (Computer Security Incident Response Team) The incident response team has been defined and its duties have been determined. ISO 27001 A.16.1.1

There is an incident classification system Security incidents are classified according to their severity level. ISO 27001 A.16.1.4

Communication plan is ready It has been determined who will be contacted and how in case of an incident. ISO 27001 A.16.1.2

There are computer forensic procedures The procedure for collecting and preserving digital evidence is documented. ISO 27001 A.16.1.7

Exercises are being carried out Incident response drills are held at least once a year. ISO 27001 A.16.1.7

There is a regulatory notification procedure Legal notification procedure for KVKK/GDPR violations is ready. KVKK Art.12 / GDPR Art.33

Post-event analysis is carried out A lessons learned report is prepared after each incident. ISO 27001 A.16.1.7

There are agreements with external sources External support providers such as digital forensics, PR and law have been identified. ISO 27001 A.15.1.1

CATEGORY 09

Compliance & Policy Management

Legal regulations, standards and security policies.

0/10

Information security policy is documented There is an up-to-date IG policy approved by senior management. ISO 27001 A.5.1.1

KVKK/GDPR compliance ensured Legal requirements for the protection of personal data have been met. KVKK / GDPR

Has ISO 27001 certification Compliance with international information security standards has been achieved. ISO 27001

There is compliance with sectoral regulations Sectoral requirements such as PCI-DSS, HIPAA, BDDK have been met. Sectoral Standards

Risk assessment is carried out periodically A comprehensive risk analysis is conducted at least once a year. ISO 27001 A.12.6.1

Internal audits are carried out Regular internal security audits are planned and implemented. ISO 27001 A.18.2.3

Supplier security assessment is being carried out The security situations of third parties are evaluated regularly. ISO 27001 A.15.1.1

Contracts contain security clauses Security requirements are specified in supplier and customer contracts. ISO 27001 A.15.1.2

Policies are reviewed regularly All security policies are updated at least once a year. ISO 27001 A.5.1.2

Cyber insurance policy is active Insurance policy against cyber risks is available and up to date. Risk Transfer

CATEGORY 10

Cloud & Mobile Security

Cloud services, mobile devices and remote work security.

0/12

Cloud configuration is secure AWS/Azure/GCP configurations are constantly monitored with CSPM. CSA STAR

Cloud access is protected with MFA MFA is mandatory in all cloud management consoles. CSA CCM

Cloud data encrypted Both at-rest and in-transit encryption are implemented. CSA CCM

There is an MDM (Mobile Device Management) solution Mobile devices are centrally managed and protected. ISO 27001 A.6.2.1

BYOD policy documented Rules for the use of personal devices for work have been determined. ISO 27001 A.6.2.1

Remote working security ensured Solutions such as VPN, Zero Trust, secure web gateway are active. ISO 27001 A.6.2.1

SaaS applications are monitored The SaaS applications used are monitored with CASB. CSA STAR

Have a cloud backup strategy There is a backup and disaster recovery plan for cloud data. ISO 27001 A.12.3.1

Mobile application security is being tested The company's mobile applications undergo regular security testing. OWASP MASVS

IoT devices are managed IoT devices are in inventory, security updates are being applied. ISO 27001 A.8.1.1

Shadow IT detection is in progress Unapproved cloud services and applications are detected and managed. ISO 27001 A.12.5.1

Has a multi-cloud security strategy There is centralized security management if multiple cloud providers are used. CSA STAR