INFORMATION SECURITY MANAGEMENT SYSTEM POLICY

The main theme of the TS EN ISO 27001:2013 Information Security Management System is to demonstrate that information security management is ensured within personal data protection, human resources, infrastructure, software, hardware, user information, company information, third-party information, and financial resources; to secure risk management, measure the performance of information security management processes, and regulate relationships with third parties regarding information security.

This policy covers all units using the Information Technology infrastructure, users accessing information systems as third parties, and service, software, or hardware providers providing technical support to information systems.
Information Security aims to protect the reputation, trustworthiness, and information assets of our Company, ensure the continuity of business operations with minimal interruptions, increase employees’ awareness and compliance with security requirements, ensure compliance with third parties, and actively implement up-to-date technical security controls. It is managed with the Company’s risk-oriented approach.

OUR INFORMATION SECURITY OBJECTIVES;

Protect Ender Alüminyum Sanayi ve Ticaret Anonim Şirketi’s information assets against all threats, internal or external, intentional or unintentional, ensure information accessibility in line with business processes, comply with legal requirements, and undertake continuous improvement efforts,
Document, certify, and continuously improve our Information Security Management System in accordance with ISO 27001 standard requirements,
Prevent unauthorized or illegitimate access, use, modification, disclosure, destruction, transfer, or damage of information assets based on the core elements of confidentiality, integrity, and availability,
Ensure the security of not only data stored electronically but also information in written, printed, verbal, or similar forms,
Act in line with the Company’s Vision and Mission,
Reduce the impact of information security risks on business continuity and ensure continuity of operations,
Protect and enhance the Company’s reputation against negative effects based on information security,
Ensure confidentiality, integrity, and availability of all information stored in physical and electronic media by fully complying with legal requirements, customer requirements, operational, and contractual obligations.

Increase awareness of users and employees regarding information security to minimize risks, ensuring they understand their responsibilities,
Define and evaluate the security requirements of the electronic infrastructure, follow technological developments, improve it, and ensure service continuity,
Ensure an acceptable level of security for external access to the system,
Define the information security requirements of stakeholders, customers, and suppliers and ensure their compliance with the Information Security Management System,
Protect the confidentiality of critical data related to strategic objectives, design, production, sales, supply, customer, and employee information in our products and services,
Detect and respond promptly to information security violations by integrating our activities with other management systems we implement.

Ender Alüminyum Sanayi ve Ticaret Anonim Şirketi