1. Purpose
Hitit Trans International Transportation & Logistics Inc. is committed to ensuring the security of all information assets it owns or manages, protecting the confidentiality of customer and business partner data, and ensuring business continuity.
The purpose of this policy is to establish the core framework of the Information Security Management System (ISMS), clarify the responsibilities of all stakeholders, and embed an information security culture at the corporate level in compliance with the ISO 27001:2022 standard.
2. Scope
This policy covers the following assets and areas:
- Physical assets: Servers, workstations, network equipment, mobile devices, storage media
- Software assets: Operational systems, ERP/TMS applications, email systems, cloud services
- Information assets: Customer data, contracts, financial records, operational data, trade secrets
- Human resources: All employees, interns, temporary staff and consultants
- Third parties: Information systems shared with service providers, suppliers and business partners
- Facilities: Ankara head office, branch offices and operational sites
3. Core Principles (CIA Triad)
Hitit Trans's approach to information security is built on three fundamental principles recognised by international standards:
Confidentiality
We ensure that information is accessible only to authorised individuals. Unauthorised access is prevented through access control lists, role-based authorisation and encryption technologies. Customer, supplier and employee data is protected at the highest level of confidentiality.
Integrity
We ensure information remains accurate, complete and trustworthy. Data integrity controls, change management procedures and audit logs are kept continuously active to prevent unauthorised modifications.
Availability
We guarantee that authorised users can access information and systems whenever they need to. Business continuity is ensured through backup strategies, disaster recovery plans and high-availability infrastructure.
4. Risk Management Approach
Hitit Trans places the risk-based approach prescribed by ISO 27001:2022 at the centre of its information security management:
- Risk Identification: All information assets are inventoried; threats and vulnerabilities are systematically identified for each asset.
- Risk Assessment: Identified risks are scored according to likelihood and impact values and prioritised using a risk matrix.
- Risk Treatment: The appropriate method — reduction, acceptance, transfer (insurance) or avoidance — is selected and applied for each risk.
- Risk Monitoring: The risk register is updated regularly; the effectiveness of existing controls is measured through an annual risk assessment cycle.
The risk assessment process is renewed at least once a year and whenever significant organisational or technological changes occur.
5. Employee Responsibilities
Information security is everyone's responsibility. Our expectations of all employees:
- Participate in information security awareness training during onboarding and at least once a year
- Never share personal account credentials (passwords, access cards) with others and change them regularly
- Report any suspicious email, social engineering attempt or security vulnerability to the ISMS Manager immediately
- Use corporate devices for business purposes only and refrain from installing unauthorised software
- Transfer confidential information only through encrypted channels
- Comply with the Clean Desk – Clear Screen policy
- Return all corporate assets and access rights upon termination of the employment relationship
Failure to comply with these responsibilities will be addressed under disciplinary procedures.
6. Incident Management and Response
Rapid and effective response to information security incidents is a critical component of Hitit Trans's ISMS:
| Phase | Action | Timeframe |
| Detection | Incident identified by relevant personnel or system | Immediate |
| Reporting | Notification to ISMS Manager (isms@hitittrans.com) | Within 1 hour |
| Assessment | Incident classification and impact analysis | Within 4 hours |
| Response | Containment of incident and prevention of spread | 24–72 hours depending on severity |
| Recovery | System restoration and return to normal operations | As per plan |
| Reporting | Incident report preparation; notification under legal obligations | 72 hours (for personal data breaches) |
For personal data breaches, the notification obligation to the relevant supervisory authority is fulfilled within 72 hours.
7. Legal and Regulatory Compliance
Hitit Trans is committed to compliance with the following legal and international regulations relating to information security:
- Law No. 6698 on the Protection of Personal Data (KVKK — Turkey)
- ISO/IEC 27001:2022 – Information Security Management System Standard
- ISO/IEC 27002:2022 – Information Security Controls
- General Data Protection Regulation (GDPR) — where applicable to EU data subjects
- Sector-specific AEO and IATA security requirements
8. Policy Review
This policy is reviewed under the following conditions:
- Routine annual review each January
- When significant changes occur to the ISO 27001 standard
- Following a significant security incident
- When fundamental changes occur to the technology infrastructure or business processes
Approved by: General Manager, Hitit Trans
Last Updated: 1 January 2024
Next Review: January 2025
ISMS Contact: isms@hitittrans.com