Bilgi ve İletişim Güvenliği Rehberi - 3.6.2 Sistem Odası/Veri Merkezine Yönelik Güvenlik Tedbirleri (Information and Communication Security Guide - measures for system rooms/data centres)

Overview

The guide is Version 1.1 (01.03.2026) published by the T.C. Cumhurbaşkanlığı Siber Güvenlik Başkanlığı; the section covered is 3.6.2. It is Turkey's national information-security guide for public bodies and critical infrastructure, and it grades measures for system rooms and data centres in three levels.

Beyond access control, it sets physical-infrastructure expectations. The power feed to the system room/data centre must be redundant; a dedicated UPS must carry the room until the generator starts, and no other devices may be connected to that UPS. The generator fuel tank must always be full and redundant, fuel checks must be recorded during long runs, and UPS and generator maintenance and tests must be logged.

Water, power, humidity, temperature and smoke must be monitored with thresholds and alarms, and monitoring must not be exposed externally. Rooms must be located away from kitchens, water and waste lines, water-based suppression, ducts, gas and flammables, with seismic resistance documented and lightning protection provided. Walls and floors must use moisture- and flame-resistant insulation, the room must be sealed with no openings for heat, humidity and air tightness, and data center earthing must be measured periodically.

Level 3 requires redundant precision air conditioning: one unit on standby starts automatically on failure or insufficient cooling, restarts automatically after power returns and raises fault alarms. Cables must be labelled individually and routed in separate cable trays, and entry must be authenticated and logged. The related sources are ISO/IEC 27001 and TS EN 50600-2-5.

Key points

1. Power feed to the room must be redundant; a UPS must carry the room until the generator starts, with no other devices on that UPS (3.6.2.7, level 1).
2. Generator fuel tank must always be full and redundant; UPS and generator maintenance/tests must be logged.
3. Water, power, humidity, temperature and smoke must be monitored with thresholds and alarms; monitoring must not be exposed externally (3.6.2.5).
4. Rooms must be away from kitchens, water/waste lines, water-based suppression, ducts, gas and flammables; seismic resistance documented; lightning protection provided (3.6.2.8).
5. Moisture- and flame-resistant insulation in walls and floors; room sealed with no openings; data center earthing measured periodically.
6. Level 3: redundant precision air conditioning with a standby unit that starts automatically, auto-restart after power return and fault alarms (3.6.2.15).
7. Cables labelled individually and routed in separate cable trays; authenticated and logged entry.

Using it in design

• Provide a Turkey public-sector compliance checklist mapping the measures to design objects: dedicated IT UPS, N+1 air conditioning with auto changeover, redundant feeds, generator fuel redundancy, room adjacency checks against wet areas.
• Warn when a shared UPS or a single cooling unit is used for a room tagged as public-sector critical.
• Design the monitoring system so it is not exposed externally.
• Add cable labelling and separate cable tray requirements to the cabling specification.

Who should read it

Engineers and compliance officers designing system rooms and data centers for public bodies and critical infrastructure in Turkey.

Related standards

• ISO/IEC 27001
• TS EN 50600-2-5

Publication details

Authors

T.C. Cumhurbaşkanlığı Siber Güvenlik Başkanlığı

Publisher

T.C. Cumhurbaşkanlığı Siber Güvenlik Başkanlığı

Year

2026

Document number

Sürüm 1.1 (01.03.2026), Bölüm 3.6.2

Document language

English

Source type

Turkish regulation

Access

Free to read

Licence

Copyright retained; citation only — the publisher’s terms apply to the original document

Citation