Certified for quality. Accountable by policy.

• Determining our goals and objectives, regular monitoring and continuous improvement
• Focusing on customer satisfaction in all our activities
• To ensure compliance with all legal and other requirements that are our national and international obligations
• Focus on creating value for all our stakeholders by using environmentally friendly technology to facilitate society's access to healthier and more comfortable living spaces
• To use the four cornerstones of production: human, machine, material and method, in the most efficient way, to follow changes, to make continuous improvements, to plan our work by foreseeing risks and opportunities
• To work to become an exemplary business in our sector with the sustainable management model we have created by evaluating quality, environment, occupational health and safety issues together
• Continuously measuring customer satisfaction in our after-sales services, knowing their needs and expectations and solving customer demands clearly, transparently and quickly
• To provide the resources necessary for our activities

We commit and declare it as our quality policy.

Approved — Gökhan Manav, CEO · 19 July 2024

The main theme of ISO 27001 Information Security Management System; Siberson Bilişim Güvenliği A.Ş to demonstrate that information security management is provided within human, infrastructure, software, hardware, user information, organizational information, third party information and financial resources, to ensure risk management, to measure information security management process performance and to ensure information security. To ensure the regulation of relations with third parties on relevant matters.

In this regard, the purpose of our ISMS Policy is:

• To protect the information assets of Siberson Bilişim Güvenliği A.Ş against all kinds of threats that may occur from inside or outside, knowingly or unknowingly, to ensure accessibility of information as required through business processes, to meet legal legislation requirements, to work for continuous improvement
• To prevent unpermitted or unauthorized access, use, modification, disclosure, elimination, change of hands and damage to information assets made available for use, based on confidentiality, integrity and accessibility as the basic elements of information security
• Information security assets include not only data held electronically; to deal with the security of all data in written, printed, oral and similar media
• To undertake the necessary work to ensure the privacy and confidentiality of all persons' data within the framework of the law
• To raise awareness by providing Information Security Management and KVKK/GDPR training to all personnel
• To ensure that the personnel of the institution have a conscious approach to information security and fulfill their duties within their areas of responsibility, and pay utmost attention to the published policies, procedures, instructions and announcements
• Evaluating all existing or suspicious vulnerabilities targeting Information Security within the scope of information security incident management and, as a result of the evaluations, ensuring that the activities of updating existing controls or commissioning new controls are carried out as soon as possible
• To prepare, maintain and test business continuity plans
• To identify current risks by making periodic evaluations on Information Security; as a result of evaluations, to review and follow up action plans
• To ensure that the studies that support the objectives in our Information Security Policy are included in the Information Security Targets established every year and that the progress of these studies is monitored and reported throughout the year
• To ensure continuous improvement of the Information Security Management System and to ensure that efforts for continuous improvement are reviewed by the management.

Approved — Gökhan Manav, CEO · 19 July 2024

This policy has been prepared to draw the basic framework and explain the principles necessary for the implementation, operation and continuous improvement of a business continuity management structure compatible with the business continuity needs and priorities of Siberson Bilişim Güvenliği A.Ş.

• Ensuring life safety as the first priority in disasters and emergencies
• To maintain our reputation as a reputable and solid company that our customers trust and therefore prefer
• Establishing, operating and continuously improving our business continuity structure, taking into account the expectations of relevant parties and legal and regulatory obligations
• Finding and implementing preventive and protective measures before the disaster strikes
• To implement our business continuity capacity in line with the requirements of the ISO 22301 standard and to continuously improve it according to the practices of the ISO 22301 standard
• To determine the necessary measurable targets for our business continuity structure to meet expectations and go further and to evaluate them annually
• Conducting business impact analysis to determine priority activities that support our products and services
• To make preparations to protect and save the priority activities determined in the business impact analysis
• Conducting regular drills with realistic scenarios to ensure that our plans work in emergency situations

We are committed to ensuring and improving business continuity with the established control infrastructure.

Approved — Gökhan Manav, CEO · 19 July 2024

Siberson Bilişim Güvenliği A.Ş:

• It believes in the importance of risk management in order to create value with the technology, products and services it offers to its stakeholders, to increase stakeholder satisfaction, to achieve effective results by using its resources in the most efficient way and to ensure their sustainability. As an indicator of this, it takes risk management into consideration in all its managerial and operational activities.
• To carry out its activities in a sustainable manner in line with its mission and to achieve the goals and objectives determined within the scope of the Strategic Plan, it identifies and rates corporate risks with appropriate technology infrastructure and an effective systematic, takes necessary precautions, monitors and reports regularly. It also continuously improves the risk management approach through reviews. It uses risk management models accepted in national and international practices for integrated management of risks.
• It undertakes to have the necessary resources to fulfill obligations related to risk management and carry out actions.
• It groups the risks it monitors under the following basic categories: Strategic risks, legal risks, financial risks, process risks, project risks, environmental risks, occupational health and safety risks and information security risks.

Approved — Gökhan Manav, CEO · 19 July 2024

This policy was created to establish, operate and develop a service management system based on the ISO 20000-1 standard, so that the information security services offered by Siberson Bilişim Güvenliği A.Ş. to its internal and external customers are provided reliably, consistently, with high quality and continuous improvement, at affordable costs, and in compliance with the relevant laws and regulations.

The goal to be achieved in service management and requirements is customer satisfaction. For this purpose, questioning and measurement methods to determine customer satisfaction have been put into operation on a regular basis after the services provided.

Working in a customer-oriented manner, the goal of Siberson Bilişim Güvenliği A.Ş. is to achieve the process performance targets in each service process, to ensure business continuity of the customers it serves and to improve service processes in order to fully fulfill service level agreements and contracted customer conditions.

Approved — Gökhan Manav, CEO · 19 July 2024

Our main policy is to constantly improve our processes and increase customer satisfaction by handling the notifications of our customers and related parties with a customer-oriented approach, reaching a solution as quickly as possible with an effective and efficient system.

To do so:

• Accepting that customer notifications are justified in the first place, closely monitoring and investigating them in all authorities such as telephone, e-mail, social media, and adopting a fair and objective approach to all kinds of notifications
• Establishing rapid communication, producing solutions and ensuring customer satisfaction
• To provide service to meet the demands of our customers with our professional staff and approach, by adopting an understanding that suits our customers' expectations of quality service from us
• Regularly reviewing the customer complaint management process and systems used to identify areas open to improvement and increasing efficiency, reporting activities and continuous improvement
• To create a strong, accurate, clear and sustainable customer-institution relationship for the products or services that our institution offers directly or indirectly to customers
• Evaluating and responding to the feedback of customers, employees and other relevant parties in the fastest and most accurate way, and resolving problems in a way that prevents their recurrence, by increasing internal and external communication power and providing all necessary resources
• Aiming to create a participatory, positive company culture where employees work willingly and with high motivation, while preserving company values
• To be respectful to the environment, people and society
• To comply with relevant legal requirements to ensure customer satisfaction and continuity

We commit.

Approved — Gökhan Manav, CEO · 19 July 2024

• To ensure that our employees, subcontractors and visitors comply with the rules regarding Occupational Health and Safety prepared by our institution
• To create and maintain relevant policies, procedures, systems, information and training in order to create and support an effective occupational health and safety culture within our institution
• To comply with the applicable OSH-related legislation, regulations and standards
• To detect and eliminate unsafe situations and behaviors that may cause occupational accidents and occupational diseases in the workplace through an effective risk assessment, and to ensure the health, safety and social welfare of employees at all levels, visitors and subcontractors
• To take all kinds of precautions in accordance with the OHS legislation in force and other OHS-related requirements, to keep tools and personal protective equipment available and to ensure their use when necessary
• Creating a periodic training program to create and develop Occupational Health and Safety awareness of our employees and ensuring that all relevant personnel receive appropriate OHS training
• Allocating sufficient resources to continuously improve OHS performance
• To provide regular health surveillance for employees
• To ensure the continuity of our OHS Management System, which has been established and implemented in this direction

We are committed to OHS as our policy.

Approved — Gökhan Manav, CEO · 19 July 2024