Turvalisuseeskirju

Turvalisuseeskirju refers to the set of rules, guidelines, and procedures that an organization establishes to protect its information, assets, and operations from security threats. The term is common in Estonian‑speaking enterprises and public institutions and is often used interchangeably with "information security policies" in English.

The purpose of turvalisuseeskirju is to define responsibilities, set expectations for security behaviour, and provide a framework for risk assessment, incident response, and continuous improvement. They serve both as a communication tool for employees, stakeholders, and regulatory bodies, and as a basis for legal and contractual obligations.

Typical components include: a scope declaration that describes the assets and systems covered; principles such as confidentiality, integrity, and availability; roles and responsibilities for management, IT staff, and end users; technical controls such as access management, encryption, and monitoring; and organizational controls such as training, incident handling, and audit procedures. The policies must be aligned with national legislation (for example the Estonian Information Security Act) and international standards such as ISO/IEC 27001.

Developing turvalisuseeskirju usually follows a structured cycle: risk assessment, drafting, stakeholder approval, communication and training, implementation, monitoring, and periodic review. Effective policies are written in clear, unambiguous language and are regularly updated to reflect changing threat landscapes, technological developments, and legal requirements.

For organizations certified under ISO/IEC 27001, the security policies become part of the information security management system (ISMS) documentation and are subject to internal and external audits. Compliance with Turkish law is assessed through internal audits, external assurance, and, where applicable, certification procedures that verify the adequacy and effectiveness of the policies.