9 January 2016 SATURDAY Official Gazette Issue : 29588

COMMUNIQUÉ

From the Central Bank of the Republic of Turkey:

COMMUNIQUÉ ON INFORMATION SYSTEMS USED IN PAYMENT AND SECURITIES SETTLEMENT SYSTEMS (Number: 2015/7)

PART ONE

Purpose, Scope, Basis and Definitions

Purpose

ARTICLE 1 – (1) The purpose of this Communiqué is to regulate the procedures and principles regarding the information systems used in the execution of activities related to payment and securities settlement systems.

Scope

ARTICLE 2 – (1) This Communiqué covers the procedures and principles regarding the information systems used in the execution of activities related to payment and securities settlement systems, with respect to general provisions on information systems management, information security management, security vulnerabilities and breaches, audit trails, authentication, access control and non-repudiation, risk management regarding information systems, information systems operation, information systems continuity plan, outsourcing in information systems and other matters.

Basis

ARTICLE 3 – (1) This Communiqué has been prepared based on the third paragraph of Article 4 of the Law No. 6493 dated 20/6/2013 on Payment and Securities Settlement Systems, Payment Services and Electronic Money Institutions, the ninth paragraph of Article 24 and the first paragraph of Article 30 of the Regulation on the Activities of Payment and Securities Settlement Systems published in the Official Gazette dated 28/6/2014 and numbered 29044.

Definitions

ARTICLE 4 – (1) In this Communiqué;

a) Bank: The Central Bank of the Republic of Turkey Joint Stock Company,

b) Information systems: The entire structure consisting of hardware, software, data and processes that enables system operators to fulfill their responsibilities determined by legislation regarding information and data for the purpose of executing activities related to payment and securities settlement systems,

c) Information systems continuity plan: The plan that includes scenarios regarding all kinds of extraordinary situations that may adversely affect the uninterrupted operation of information systems, also taking into account cyber attacks, and matters regarding the elimination of interruptions that may occur in information systems in the event of the realization of these scenarios within a reasonable time and without data loss,

ç) Information systems management: The activities regarding the establishment of appropriate information systems, the effective and efficient use of information systems resources, information security management, the management of risks regarding information systems and ensuring the continuity of information systems for the purpose of executing the activities of payment and securities settlement systems uninterruptedly, securely, effectively and efficiently,

d) Change management: The information systems service management discipline that aims to ensure that all changes related to information systems are carried out effectively, securely and in a timely manner through the use of pre-determined procedures and to minimize the number of incidents that may arise from these changes and the impact of these incidents on the services provided,

e) Audit trail: The records that will enable a financial or operational transaction to be followed step by step from its beginning to its end,

f) Activities Regulation: The Regulation on the Activities of Payment and Securities Settlement Systems published in the Official Gazette dated 28/6/2014 and numbered 29044,

g) Service level: The level regarding the content and quality of services, determined in writing in advance by the system operator and shared with the relevant parties, by taking into consideration the cost of the services and the needs and expectations of those receiving the said services,

ğ) Capacity management: The activities that include monitoring the current capacity and performance of information systems, testing them including stress tests, and reviewing and planning them in line with business needs and technical requirements and business continuity objectives,

h) Participant: The legal entity that has the authority to directly submit transfer orders by participating in the system and is obliged to comply with the system rules,

ı) Securities settlement system: The structure that provides the necessary infrastructure for clearing and settlement transactions carried out to ensure the realization of securities transfers arising from transfer orders between three or more participants and has common rules,

i) Incident: Any development that causes an unplanned interruption in the operation of information systems or a decrease in service quality, including security breaches,

j) Payment system: The structure that provides the necessary infrastructure for clearing and settlement transactions carried out to ensure the realization of fund transfers arising from transfer orders between three or more participants and has common rules,

k) Project management: The process that ensures the planning, organization and execution of information systems projects in a way to ensure their completion in accordance with the foreseen time schedule, budget and quality level through the use of pre-determined methodologies,

l) Penetration test: The activities involving attacks carried out to detect and correct security vulnerabilities, if any, in information systems before they are exploited,

m) System: Payment system and securities settlement system,

n) System operator: The legal entity responsible for the daily operation of the system and holding the activity license required for the operation of the system,

o) Problem: The root cause of one or more incidents,

ö) Stress test: The test in which the adequacy of information systems capacity is measured against situations more intense than the most intense load situation,

p) Person responsible for management: The persons responsible for the management of the system operator as defined in Article 10 of the Activities Regulation, r) Vulnerability scanning: The analysis, generally carried out with automated tools, aimed at detecting, identifying and classifying security vulnerabilities, if any, in information systems components, means.

PART TWO

Principles to be Taken as Basis in Information Systems Management

General provisions regarding information systems management

ARTICLE 5 – (1) The system operator, while carrying out its activities related to information systems, primarily observes the objective of ensuring that the system for whose operation it is responsible works uninterruptedly, securely, effectively and efficiently. (2) The system operator establishes the information systems in a manner compatible with the system's field of activity and updates them by also taking technological developments into account. (3) The system operator creates in writing the policies regarding information systems management in a manner compatible with the system's main strategy and objectives, regularly reviews them and updates them where necessary. (4) The system operator carries out the management of the system in a holistic approach and within the framework of corporate governance practices, in a manner that also covers information systems management, and places the elements regarding information systems management in the appropriate place within the organizational structure. (5) The system operator clearly determines the duties, authorities and responsibilities regarding information systems management and provides all kinds of resources necessary for information systems management. (6) The board of directors of the system operator is responsible for the conduct of information systems management in accordance with the provisions set out in this Communiqué.

Information security management

ARTICLE 6 – (1) The system operator establishes an information security management framework containing rules, principles and policies in order to ensure the confidentiality, integrity and availability of all kinds of information assets related to the system. (2) The system operator establishes an information security management system in accordance with the information security management framework it has established within the scope of the first paragraph. (3) The system operator clearly determines the duties, authorities and responsibilities regarding the establishment, management, review at certain intervals and, where necessary, updating of the information security management system. (4) Within the scope of the information security management system, the duties, authorities and responsibilities of personnel at every level regarding information security are clearly determined. (5) The system operator classifies all information assets within the system according to their confidentiality level by also taking into account their level of importance and legal obligations, clearly determines the access rights and the procedures for retention, transmission and destruction regarding the information assets in each class, and informs all personnel about classification and the obligations related thereto. (6) In the information security management system, all matters regarding personnel, including the personnel's commencement of work, change of duty and position, and departure from work, are evaluated with respect to their aspects affecting information security and the necessary measures are taken. (7) The system operator, within the scope of the information security management system, ensures the security of all kinds of hardware and infrastructure related to the system that are in its own possession and of the physical environment related thereto. The system operator exercises the necessary diligence to ensure the security of hardware and infrastructure related to the system that are not in its own possession and of the physical environment related thereto. (8) The system operator ensures that all kinds of communication processes related to the system between internal and external networks and operational transactions regarding main activities are designed in a manner that will be carried out using security controls and tools. (9) The system operator is obliged to exercise the necessary diligence regarding information security in the event that it establishes a new system, makes a structural change within the existing system, or carries out development, maintenance and repair work regarding existing information systems. (10) The persons responsible for the management of the system operator who have been assigned duties, authorities and responsibilities regarding the information security management system continuously monitor the compliance status of the information security management system with the legislation on information security, the standards
and the information security management framework established within the scope of the first paragraph, take the necessary measures to ensure compliance and regularly report the compliance status to the board of directors of the system operator. (11) The system operator carries out the necessary activities to increase the awareness of personnel on information security matters.

Security vulnerabilities and breaches

ARTICLE 7 – (1) The system operator ensures, in a manner compatible with the information security management framework, the investigation of possible security breaches against information systems, the determination of the appropriate measures to be taken to prevent security breaches, the taking of the necessary measures so that, in the event of a security breach, the breach can be detected and intervened in a timely manner, and the evaluation and recording of security breaches that have occurred and security vulnerabilities that have been detected. (2) The system operator subjects all servers in its possession and related to the system and the communication network to vulnerability scanning before they are first put into operation and afterwards at regular intervals at least six times a year. It is ensured that the priority findings detected in the vulnerability scanning are remedied as soon as possible and that appropriate protective measures are taken until these findings are remedied. Time planning is made for the remediation of non-priority findings within a reasonable period. (3) The system operator ensures that a penetration test is carried out at least once a year in line with scenarios covering possible internal and external threats and reports the results of the penetration test to the Bank. (4) The system operator takes appropriate measures to evaluate possible and actual security breaches and to remedy the security vulnerabilities it has detected as a result of vulnerability scanning and penetration tests, and checks the effectiveness status of the measures it has taken. (5) The system operator submits to the Bank at least once a year a report containing the security breaches that have occurred and the critical security vulnerabilities that have been detected, the measures taken to remedy them and their results.

(6) The system operator securely preserves the evidence related to security breaches that have occurred for at least ten years.

Audit trail logging system

ARTICLE 8 – (1) The system operator shall establish an audit trail record system that will enable the tracking of all authorized or unauthorized access to information systems and of transactions related to system activities that occur in information systems.

(2) The records to be kept in the audit trail record system shall include, at a minimum, depending on the nature of the access or transaction, the type of transaction, the unique identifier of the transaction, the transaction amount, the transaction date, the transaction time, the user identity information, and the application information in which the access or transaction took place.

(3) Audit trails shall be stored in a manner that allows detailed examination and scanning, ready for audit and securely, for a period of at least ten years.

(4) In the event that external services are procured by the system operator in relation to information systems, the system operator shall be responsible for the compliance of the external service provider's audit trail record system with the provisions of this article.

Identity verification, access control and non-repudiation

ARTICLE 9 – (1) The system operator shall establish an adequate and effective identity verification system to be used in transactions carried out in information systems.

(2) The system operator shall clearly determine for which sub-components of the information systems the identity verification system will be applicable and which identity verification techniques will be used for which sub-component in the identity verification system.

(3) The system operator shall clearly determine the authorizations and restrictions regarding the access of personnel to the networks, subsystems, applications, data and physical environments used within the system, in a manner that allows personnel to access the information required by the job within the scope of their duties, authorities and responsibilities, and shall take the necessary measures to prevent unauthorized access.

(4) The system operator shall ensure the establishment of the necessary infrastructure for the security of the data used for identity verification and for its transmission and storage in encrypted form.

(5) The system operator shall take measures to ensure session security in the use of information systems.

(6) The system operator shall establish the technological and legal infrastructure that will ensure non-repudiation for transactions carried out in information systems related to system activities.

Risk management regarding information systems

ARTICLE 10 – (1) The system operator shall take into consideration the risks regarding information systems while establishing the risk management framework to be instituted for the purpose of ensuring the identification, measurement, monitoring and effective management of all risks that may jeopardize the smooth operation of the system.

(2) While assessing the risks regarding information systems pursuant to the first paragraph, the main activities and other activities of the system, the activities of the participants or other organizations directly or indirectly connected to the system, the activities of external service providers, if any, dependencies on third parties and the connections of the system with other systems shall also be taken into consideration.

(3) The system operator shall conduct a comprehensive risk assessment regarding information systems at least once a year and shall submit the report containing the assessment results to the Bank.

Information systems operation

ARTICLE 11 – (1) The system operator shall clearly determine the objectives regarding the reliability, resilience and continuity of the operation of information systems within the framework of the defined service levels and shall take the necessary measures in line with these objectives in order to ensure that the operation of information systems is carried out effectively and efficiently.

(2) The system operator shall measure the level of compliance with the objectives it has determined within the scope of the first paragraph at regular intervals, at least once a year, and shall report the results to the Bank.

(3) The system operator shall establish the information systems in a manner that has sufficient capacity for the defined service levels, shall primarily consider ensuring that the capacity is scalable, and shall perform capacity management for information systems.

(4) The system operator shall ensure the creation, secure storage, updating and reporting of the inventory and configuration information of information assets.

(5) The system operator shall perform incident management in a manner that ensures the timely detection, recording, reporting, analysis and resolution of incidents within the framework of predetermined procedures and the timely notification of all relevant stakeholders about the incident.

(6) The system operator shall perform problem management in a manner that includes the detailed examination of the incident after each significant incident, the performance of root cause analysis, the determination of its effects, and the follow-up and reporting of the problem related to the incident.

(7) The system operator shall carry out all kinds of changes to be made regarding information systems in accordance with the change management procedures it has determined.

(8) The system operator shall carry out all kinds of projects to be realized in information systems through in-house development or external procurement in accordance with the project management procedures it has determined.

Information systems continuity plan

ARTICLE 12 – (1) The system operator shall prepare an information systems continuity plan as a part of the business continuity plan established pursuant to the fifth paragraph of Article 25 of the Activities Regulation.

(2) The information systems continuity plan;

a) shall include the information systems continuity objectives to be determined in compliance with the business continuity plan and the backup and recovery procedures to be established to ensure the achievement of these objectives and the resources to be used,

b) shall include the processes for identifying the source of the incident that causes the plan to be activated, the damage it has caused, its potential size and impact, the parties it affects, and ensuring that the findings are conveyed to the relevant management units,

c) shall include the criteria and procedures regarding the decision-making process for the implementation of the plan and the duties, authorities and responsibilities of the persons or groups who will take part when the plan is activated,

ç) shall include the method of communication with the relevant stakeholders,

d) shall include the method of recording the decisions taken and the actions implemented within the scope of the plan.

(3) The system operator shall test the effectiveness of the information systems continuity plan at least once a year. The system operator shall plan these tests in a manner that includes participants, other systems connected to its information systems, and third-party service providers.

Outsourcing of information systems

ARTICLE 13 – (1) The system operator may carry out outsourcing of information systems. Outsourcing shall not remove the system operator's responsibilities within the scope of information systems management.

(2) The system operator shall assess the risks that may arise due to outsourcing and take the necessary measures.

(3) The outsourcing contract shall, at a minimum, include;

a) Matters relating to the scope of the service and the determined service levels,

b) The conditions relating to the termination of the service and, in the event of termination of the service, the provisions relating to the destruction by the external service provider of the information, documents and records obtained while providing the external service,

c) The rights and obligations of the system operator and the external service provider,

ç) The provisions that ensure that the resources and processes used by the external service provider in relation to the service comply with the security policies of the system operator,

d) Matters relating to the ownership of the elements subject to the contract and intellectual property rights,

e) The provisions relating to the fact that the ownership of the information, documents and records relating to the transactions carried out through outsourcing belongs to the system operator and the confidentiality of the information, documents and records belonging to the system operator,

f) The provisions stating that the contract provisions shall also be binding in the contracts of the external service provider with its subcontractors, if any,

g) The provisions that ensure that the changes required to be made in the information systems in accordance with the legislation and Bank instructions to which the system operator is subject due to its capacity as a system operator are fulfilled by the external service provider within the scope of the service received,

ğ) The provisions stating that the activities carried out through the external service provider are also within the scope of the supervision activity to be carried out by the Bank in respect of the system operator and that it is obliged to provide all kinds of information, documents and records requested from the external service provider in a timely and accurate manner and to provide all kinds of facilities necessary for access thereto,

h) The provisions relating to the procedures to be followed in the event of a breach of the contract provisions for any reason,

shall include.

(4) In the event that the system operator receives external services for the processing and storage of data, this service shall be provided only over hardware allocated to the system operator.

(5) The system operator shall take the necessary measures to ensure the security of its own information and the information of its participants in outsourcing and shall grant the external service provider access authorization in a manner that provides access only to the information required by the work.

PART THREE Miscellaneous and Final Provisions

Implementation principles

ARTICLE 14 – (1) The Bank is authorized to interpret the provisions of this Communiqué, to decide on matters not included in this Communiqué or on which there is no clarity by also taking into account the general provisions, and to issue circulars and instructions in order to regulate and guide the implementation.

Transitional provision

PROVISIONAL ARTICLE 1 – (1) System operators shall make their systems compliant with this Communiqué within one year from the publication of this Communiqué.

Entry into force

ARTICLE 15 – (1) This Communiqué shall enter into force on the date of its publication.

Execution

ARTICLE 16 – (1) The provisions of this Communiqué shall be executed by the Governor of the Central Bank of the Republic of Türkiye.