Critical Infrastructure

Critical infrastructures are infrastructures housing information systems whose failure or loss of integrity could cause loss of life, large-scale economic damage, security gaps and disruption of public order. Energy, transport, finance, health, water management and electronic communications are the main critical infrastructure sectors.

The Cybersecurity Law

The Cybersecurity Law No. 7545, which entered into force in 2025, makes the protection of critical infrastructure one of the core tasks of the Cybersecurity Directorate and imposes specific obligations on critical infrastructure operators:

• Authorised products and services: Cybersecurity products, systems and services used in public bodies and critical infrastructure must be obtained only from persons and organisations authorised or certified by the Directorate. Breach of this obligation is subject to an administrative fine of TRY 1 million to TRY 10 million for 2025.
• Reporting: Vulnerabilities and cyber incidents detected must be reported to the Directorate without delay.
• Compliance with policies and standards: Operators must act in line with the policies, strategies, action plans and standards published by the Directorate.
• Information requests: Information, documents, hardware and software requested by the Directorate must be provided on time.

See our Cybersecurity Compliance Programme for how we support companies with these obligations.

Sector-Specific Rules

In critical infrastructure sectors, sector-specific rules apply alongside the Cybersecurity Law. The main ones are the Banking Regulation and Supervision Agency’s rules on information systems, the Information and Communication Technologies Authority’s security rules for the electronic communications sector, and the Presidency Digital Transformation Office’s Information and Communication Security Guide. These rules often also require regular penetration testing, audits and incident response teams.