Hasan Kalyoncu University Bilişim Teknolojileri Hasan Kalyoncu University
TREN

Technical and Administrative Measures (KVKK Art. 12)

Last Updated: 24.04.2026

Article 12 of Law No. 6698 on the Protection of Personal Data (KVKK) obliges the data controller to take all necessary technical and administrative measures to prevent unlawful processing of and access to personal data and to ensure their preservation at an appropriate level of security.

As the IT Directorate, we implement the following measures across the University:

Technical Measures

1. Network and System Security

  • Corporate firewall (next-generation firewall)
  • Intrusion detection and prevention systems (IDS/IPS)
  • Network segmentation (DMZ, internal network, guest network)
  • Remote access via VPN (with MFA)
  • DDoS protection
  • Wireless network security (WPA3-Enterprise)

2. Application Security

  • Web application firewall (WAF)
  • OWASP Top 10 protections (SQL injection, XSS, etc.)
  • Secure session management
  • Input validation and output encoding

3. Identity and Access Management

  • Centralised identity management
  • Multi-factor authentication (MFA)
  • Role-based access control (RBAC)
  • Least-privilege principle
  • Periodic access rights reviews
  • Privileged account management

4. Encryption

  • TLS 1.3 in transit
  • AES-256 at rest
  • Column-level database encryption (for sensitive data)
  • Mobile device encryption (BitLocker, FileVault)

5. Logging and Monitoring

  • Centralised log management with SIEM
  • Traffic logs compliant with Law No. 5651
  • User activity logs
  • 24/7 anomaly detection
  • Log integrity (WORM, hash chaining)

6. Backup and Data Protection

  • 3-2-1 backup rule
  • Offline/off-site backup copies
  • Regular backup restore tests
  • Ransomware-resilient backups

7. Vulnerability Management

  • Regular vulnerability scans
  • Penetration tests (annual)
  • Patch management process
  • Hardware/software inventory tracking

8. Malware Protection

  • Endpoint protection (EDR)
  • Email security (anti-spam, anti-phishing)
  • Web gateway filtering

Administrative Measures

1. Policies and Procedures

  • KYS.POL.02 — Information Security Policy
  • KYS.POL.05 — Retention and Disposal Policy
  • Access control policy
  • Supplier relations policy
  • Incident response procedures

2. Human Resources

  • Confidentiality agreements upon hiring
  • Regular awareness training
  • Phishing simulations
  • Access revocation upon role change

3. Supplier Management

  • Supplier security assessments
  • Data Processor agreements (DPA)
  • Regular audits

4. Data Classification

  • Public, internal, confidential, and top-secret classifications
  • Controls applied according to classification level

5. Incident Response

  • 24/7 monitoring
  • Defined escalation processes
  • KVKK breach notification (within 72 hours)
  • Coordination with USOM

Continuous Improvement

Our measures are subject to the PDCA cycle (Plan-Do-Check-Act) within the ISO 27001:2022 ISMS framework. They are continuously improved through annual internal/external audits, management reviews, and risk assessments.

Contact

For questions regarding technical measures: destek@hku.edu.tr

Share