Regulation on Network and Information Security in the Electronic Communications Sector

Overview

Issued by the Information and Communication Technologies Authority (BTK) and published in the Official Gazette of 13.07.2014 (No. 29059), this regulation sets network and information security obligations for authorised electronic-communications operators. The obliged parties include telecom operators and infrastructure operators. It is directly relevant to telecom-operator and carrier-neutral data centre clients.

The regulation requires operators to establish an information security management system (ISMS) covering all authorised services and critical systems (Article 6(1)). Access to areas with critical systems is limited to authorised persons, and entry and exit records are kept for at least two years (Article 17(2)). Measures are required against fire, flood, earthquake, lightning, explosion and other environmental threats, and incoming communication and power lines must be brought in underground or otherwise protected (Article 18).

Equipment must be protected against the loss of support systems such as electricity, water, HVAC and ventilation (Article 19(1)). Incidents affecting more than 5% of subscribers must be reported to the Authority as soon as possible (Article 38(1)). Obliged operators must set up, or buy services from, a disaster recovery centre far enough away not to be affected by the same disaster, within two years of becoming obliged (Article 39(1)-(2)). The regulation contains other obligations, such as inventory and backups, whose details this record does not go into. Related documents include Law No. 7545 on Cyber Security, ISO/IEC 27001, ISO/IEC 22237-6 and NFPA 76.

Key points

1. Operators must establish an ISMS covering all authorised services and critical systems (Article 6(1)).
2. Access to areas with critical systems is limited to authorised persons; entry and exit records are kept for at least 2 years (Article 17(2)).
3. Measures are required against fire, flood, earthquake, lightning, explosion and other environmental threats; incoming communication and power lines underground or otherwise protected (Article 18).
4. Equipment is protected against loss of support systems such as electricity, water, HVAC and ventilation (Article 19(1)).
5. Incidents affecting more than 5% of subscribers must be reported to the Authority as soon as possible (Article 38(1)).
6. Obliged operators set up, or buy, a disaster recovery centre far enough not to be affected by the same disaster, within two years of becoming obliged (Article 39(1)-(2)).
7. Related documents: Law No. 7545 on Cyber Security, ISO/IEC 27001, ISO/IEC 22237-6, NFPA 76.

Using it in design

• In the telecom client profile, enforce 2-year access-log retention, underground or protected utility entries and support-system redundancy checks.
• In multi-site planning, add a DR-site distance and hazard-independence check (different seismic and flood exposure).
• Size the physical access control system to retain records for at least 2 years.
• Include loss scenarios for electricity, water, HVAC and ventilation support systems in the redundancy check.

Who should read it

Engineers and managers doing design, security and compliance work for telecom operators and carrier-neutral data centres.

Related standards

• 7545 sayılı Siber Güvenlik Kanunu
• ISO/IEC 27001
• ISO/IEC 22237-6
• NFPA 76

Publication details

Authors

Bilgi Teknolojileri ve İletişim Kurumu (BTK)

Publisher

Bilgi Teknolojileri ve İletişim Kurumu (BTK)

Year

2014

Document number

RG 29059 (13.07.2014)

Document language

Turkish

Source type

Expert / community

Access

Free to read

Licence

Bibliographic reference only — the document is not redistributed here; confirm reuse terms at the original source

Citation