INFORMATION SECURITY POLICY

Last updated: 22/07/2025

TOROS YAZILIM management; In line with the ISO 27001:2022 Information Security Management System Standard;

a) Commits to providing secure access to its and its stakeholders' information assets,
b) Protecting the availability, integrity, and confidentiality of information,
c) Protecting information assets from all threats, whether internal or external, intentional or accidental,
d) Assessing and managing risks that may arise on its and its stakeholders' information assets,
e) Protecting the reliability and image of the organization,
f) Implementing necessary sanctions in case of information security violations,
g) Fulfilling the requirements of national, international, and relevant legislation and standards, meeting contractual obligations, and ensuring information security requirements arising from corporate responsibilities toward internal and external stakeholders,
h) Reducing the impact of information security threats on business/service continuity and ensuring continuity and sustainability of operations,
i) Maintaining and improving the level of information security through the established control infrastructure,
j) Providing training to develop competencies in order to raise awareness of information security
commits to these principles.

The Information Security Policy must be understood by everyone working with or in cooperation with Toros Yazılım.