GDPR CONSULTANCY

We install Microsoft File Server if there is not any file management software on use. Thus, all files can be managed from a single center. Then, a separate server is configured and backups of existing files are created there.

Folder Matrix and Authorization Matrix are created to determine in which folders personal data related to GDPR will be stored and who can access it. There is always a backup copy of your systems in case computers fail or files are deleted.

Backup plans are made for all systems. While making these plans, the 3-2-1 rule is taken into consideration.

A globally proven, licensed, supporting Enterprise Backup system is used. For all backups, a restore/recovery test is performed periodically. For Disaster Management and Business Continuity, a Disaster Recovery Plan is made based on critical servers and data according to the needs of the institution. The replication server is positioned in different ways according to the criticality of the data.

We use a licensed software in this process and we keep it up to date constantly. Installing/uninstalling applications outside of the system administrator is prevented. Also, the BIOS is encrypted and boot devices are blocked. Data security and against leakage, USB, DVD, SD, Bluetooth etc. devices are also blocked.

A globally proven endpoint security system (Antivirus) is used. DLP (Data Loss Prevention) system is established and necessary rules are configured. Access, sharing and deletion policies are created and logged for classified data.

We install the Active Directory sofware to your device. With this software, authentication and access control are centralized. Other applications are integrated with Active Directory. Group Policies are configured. DNS, DHCP, other applications and services are restricted from working on the DC server.

Access Policies are applied for network and internet access. A separate server is configured for patch management and distributed to all systems. Free WUS (Windows Update Service) can be used for your Microsoft systems.

Mail systems are very important for both institutions and GDPR. Most of the personal, corporate and commercial data is processed in e-mail systems. Globally proven, licensed, supported and stable Corporate Mail systems are preferred. Our mail systems have spam mail and malware security systems. You can also create rules for your corporate brand and GDPR through your mail system, and manage your mail as you wish.

It is a must to keep access records in all systems within the framework of GDPR, and IS027001 standards. Log records are signed with the HASH method and it is guaranteed that they cannot be changed. Log records are kept in secure areas for the period determined by law and access is limited. SIEM (Security Information and Event Management) is a system that centrally collects, stores and analyzes the logs produced by all systems in real time. SIEM Systems have more detailed configuration and reporting features than log analysis.