VII-128.10 compliant
SPK penetration testing
Mandatory annual independent penetration testing for capital markets institutions under the Communiqué on Information Systems Management (VII-128.10).
What Is an SPK-Compliant Penetration Test?
The Communiqué on the Procedures and Principles Regarding Information Systems Management (VII-128.10), published by Turkey's Capital Markets Board (SPK) in the Official Gazette on 13 March 2025, requires capital markets institutions to have regular penetration tests performed on their information systems. This communiqué replaced the 2018 Communiqué No. VII-128.9. Senior management is directly responsible for ensuring these tests are carried out periodically.
Under the communiqué, penetration tests must be conducted at least once a year by independent parties that hold national or international penetration-testing certifications and have no responsibility for the institution's information-security compliance; the report must be submitted to the SPK within one month of completion and no later than 31 January of the following year. The Independent Information Systems Audit Communiqué (III-62.2; amended by III-62.2.b on 13 March 2025) sets out the principles of independent information-systems audit.
- Communiqué on the Procedures and Principles Regarding Information Systems Management (VII-128.10) — Official Gazette 13 March 2025, No. 32840 (replacing the 2018 VII-128.9); annual periodic penetration-testing obligation
- Independent Information Systems Audit Communiqué (III-62.2; amended by III-62.2.b on 13 March 2025) — principles of independent information-systems audit
- Submission of the penetration-test report to the SPK within one month of test completion and no later than 31 January of the following year
Who Is Required to Comply?
SPK Penetration Test Scope
Investor Data and Privacy
Verifying that investor identity, account and transaction data are protected against unauthorized access, and that personal-data security is in place.
Trading Platform Security
OWASP-based testing of order-routing, trading and investor-portal applications, including identification of business-logic flaws.
Market Data Integrity
Assessing the integrity of price, order and market-data flows and their resilience against manipulation.
Communiqué Compliance and Reporting
Mapping findings to VII-128.10 and III-62.2 requirements and reporting in a format suitable for submission to the SPK.
Unauthorized Access and Privilege Escalation
Testing authentication, session-management and authorization controls, as well as insider-threat scenarios.
Audit Trail and Logging
Auditing the traceability of critical transactions, log integrity and the logging adequacy needed to support incident response.
Testing Process
Scoping and Communiqué Analysis
An information-systems inventory is produced; VII-128.10 obligations and the test scope (external/internal, application, infrastructure) are clarified.
External and Internal Penetration Testing
Penetration testing is performed on internet-facing assets and the internal network using unauthenticated and authenticated scenarios.
Application and Data Security Testing
Trading platforms, investor portals and APIs are tested, along with the security of market and investor data.
Verification and Re-testing
After identified vulnerabilities are remediated, a closing verification (re-test) is performed.
Reporting in SPK Format
Findings are mapped to communiqué requirements; the report is delivered in a form that can be submitted to the SPK within one month.
SPK-submittable deliverables
Each test ends with findings, an evidence set and a remediation roadmap in a format ready to submit to the regulator.
Your questions
Is SPK penetration testing legally mandatory?
How often must penetration testing be performed?
Who is allowed to perform the test?
When is the report submitted to the SPK?
Which institutions are in scope?
Are there sanctions for institutions that fail to comply?
What does the test cover?
Get in Touch for SPK-Compliant Penetration Testing
Meet your VII-128.10 obligations and protect investor and market data.