# ISO 27001 Information Security Management and DDO Software

**URL:** https://securesys.com.tr/en/services/iso-27001-information-security-management-and-ddo-software

### Why Use ISMS Software?

Presidential Circular **No. 2019/12**, published in Official Gazette No. 30823 dated 06.07.2019 to define the measures public institutions and organisations and operators of critical infrastructure must take in relation to information and communication security, obliges those institutions to carry out an audit at least once a year and to report the results to the Digital Transformation Office (DDO). The **Information and Communication Security Guide**, prepared under DDO coordination with the participation of stakeholders in line with that circular, defines the technical and administrative measures institutions have to apply, clause by clause.

Running this process on spreadsheets, email threads and scattered documents causes three problems in practice: incomplete or out-of-date records at audit time, corporate knowledge lost when the responsible people change, and the report due to the DDO being left to the last minute. Our **ISMS software** moves the Guide's implementation steps and audit tables into a digital environment: it automates the mandatory annual audit process, documents the Guide implementation roadmap on your behalf, sends reminders for audit dates and outstanding actions, and preserves institutional memory even when the responsible staff change.

### The Processes the Platform Covers

The ISMS software lets you manage the periodic tasks required to operate an ISO 27001 Information Security Management System from a single screen:

- **Asset management:** Build an inventory of your information assets, classify them by criticality level and assign them to responsible staff.
- **Risk management:** Carry out periodic risk assessments, create treatment plans for the risks identified and track their progress.
- **Audit tracking:** Follow internal and external audit findings and corrective and preventive actions (CAPA) from one screen, with owners and deadlines assigned.
- **Document management:** Automate version control and the review calendar for policies, procedures and instructions.
- **Tasks and reminders:** Assign the periodic tasks defined in the Guide to the relevant staff and track deadlines with automatic reminders.
- **Reporting:** Generate the annual audit report due to the DDO automatically from existing data, in a ready-to-submit format.

### Who Is It Mandatory For? Municipalities and Universities

Circular No. 2019/12 covers public institutions and organisations within the state apparatus, together with critical infrastructure operators that have an IT unit or procure IT services. Within this scope:

- **Municipalities** — metropolitan, provincial and district municipalities, together with their affiliated undertakings, are subject to the obligation to comply with the Guide and carry out an annual audit. In municipalities with dense populations, the volume of citizen data makes the compliance process even more critical.
- **Universities** — state universities and their affiliated research centres are required to operate ISMS processes for the security of student and staff information systems and research data.
- **Public institutions and ministries** — including their central and provincial organisations.
- **Critical infrastructure operators** — organisations serving the energy, water, transport, finance and healthcare sectors.

Our ISMS software is designed to adapt to the organisational structure, existing processes and headcount of each of these institution types; a small district municipality and a large university can use the same platform at different scales.

### Its Relationship With ISO 27001

Compliance with the DDO Guide overlaps substantially with the **ISO 27001 Information Security Management System**; both rest on a risk-based approach, an asset inventory, an audit cycle and continuous improvement (the PDCA cycle). By using our ISMS software you prepare for ISO/IEC 27001 certification at the same time as achieving DDO compliance — eliminating duplicated work and meeting both requirements from a single system. For institutions that already hold ISO 27001 certification, the platform substantially shortens the process of adapting existing ISMS documentation to the DDO Guide format.

### An Integrated Security Approach: Software + Technical Validation

ISMS software documents the processes; demonstrating that your systems are genuinely secure, however, requires technical validation. What makes SecureSys different is that you can also obtain the technical side of your ISMS process from the same team, through our [TS 13638 level A/B/C TSE-approved penetration testing](/en/services/tse-13638-certified-penetration-test-firm) capability. Our [cyber hygiene compliance](/en/services/cyber-hygiene-compliance) consulting also supports embedding the routine security practices the ISMS calls for into the organisation's culture. The result is a security level that has genuinely been tested and internalised, rather than compliance that exists only on paper.

### Why SecureSys ISMS Software?

- **More than 10 years of information security experience** — not just software, but consulting support alongside it.
- **TS 13638 level A/B/C TSE-approved** penetration testing and security assessment capability.
- **Ankara-based, with on-site support** — and experience working with public institutions.
- **KVKK-compliant** data processing practices.

### How Do I Get Started?

The transition to the ISMS software generally follows these steps:

- **Preliminary assessment:** A short analysis of your existing processes and documentation is carried out.
- **Deployment and adaptation:** The platform is configured to your organisational structure and existing asset inventory.
- **Team training:** The relevant staff receive short training on using the platform and on the processes the Guide requires.
- **First audit cycle:** Your annual audit is run through the platform and the DDO report is produced in a ready-to-submit format.

You can request a demo tailored to your organisation to see exactly how the process would work.

### Frequently Asked Questions

#### Is ISMS software mandatory?

For the public institutions and critical infrastructure operators within the scope of Presidential Circular No. 2019/12, compliance with the Information and Communication Security Guide and an annual audit are mandatory; using dedicated software for that process is not mandatory, but it speeds the process up considerably and removes errors.

#### How often is the report submitted to the DDO?

The Guide provides for institutions to carry out an audit at least once a year and to report the results, together with a corrective and preventive action plan, to the Digital Transformation Office.

#### Can ISO 27001 certification be obtained with the ISMS software?

The software makes the documentation and audit tracking of your ISO 27001 process easier; the certification audit itself is carried out by an independent certification body. SecureSys also supports that process with consulting.

#### Is it suitable for a small municipality or a university department?

Yes. The platform is designed to scale to the organisation's size and existing IT capacity — a unit with only a few staff can manage the process on its own.