Novus BT
Regulations & Standards

CBDDO Guide

We provide end-to-end support implementing the minimum security measures defined in the CBDDO Information Security Guide for public institutions and critical infrastructure operators.

0

Core Requirements

0

Support Areas

0

Related Solutions

0/24

Compliance Support

Presidency of Digital Transformation Office Information Security and Communication Guide

About the Regulation

The CBDDO Information Security Guide is one of Turkey's most comprehensive official frameworks defining minimum security measures for public institutions and critical infrastructure operators. It covers a broad range, from network security to data classification, incident management to backup.

We build the compliance process not as a checklist matching each clause one by one, but as a holistic security architecture grounded in your organization's real risk profile.

Who Does This Apply To?

Applies to public institutions and organizations, local governments, and private-sector organizations defined as critical infrastructure operators.

Core Requirements

01

Implementation of minimum network and system security measures

02

Data classification and access authorization policies

03

Security incident management and notification processes

04

Regular backup and disaster recovery plan

05

Information security awareness training

06

Security hardening standards on network devices and servers

07

Mandatory multi-factor authentication for critical systems

08

Annual internal audit and reporting to senior management

Let's assess your compliance status together. Get the fastest answer in a 20-minute call.

Schedule a Call
Your Compliance Journey

How We Support You Through This Process

We treat compliance not as a one-off audit preparation, but as an ongoing responsibility we continuously monitor.

Gap analysis of existing infrastructure against the Guide's minimum measures

Concrete implementation roadmap for gaps

Setting up incident management and notification processes

Preparing audit-ready security documentation

Frequently Asked

Frequently Asked Questions About CBDDO Guide

Usually not; we first compare your existing infrastructure against the Guide's measures and provide a plan that closes only the real gaps.
Yes, organizations classified as critical infrastructure may have additional reporting and incident-notification timelines; we clarify these together with you.
Yes, we support pre-audit preparation and preparing the technical documentation requested during the audit.
Mandatory for public institutions and critical infrastructure operators; usable as a good-practice reference for other parts of the private sector.
We clarify the areas your cloud provider shares security responsibility for, and close the remaining responsibility areas on your behalf.
No, measures are applied proportionally to the institution's size and criticality level; we determine the right scope together.

Don't Let the Next Vulnerability Catch You Off Guard

Let our expert team analyze your infrastructure and map out a security and network architecture roadmap tailored to you — the first consultation is completely free.