What Does SOME Mean?
SOME, an acronym for the Computer Security Incident Response Team, was published in our country on October 20, 2012, in the Official Gazette by a Council of Ministers Decision. You can examine the address to learn about these tests. There are two different types of this response team. These are;
- Sectoral Some: Established within the institutions responsible for regulating and supervising critical sectors. These institutions can be listed as EPDK, RTÜK, SPK.
- Institutional Some: Established within public institutions or critical infrastructure operators. All public institutions and organizations with an information technology department are obliged to establish a Some.
Some Establishment Stages
Plan for its Place and Capacity within the Institution: Within the institution where it will be established, the Some systems should be planned independently of the institution's information technology systems, and the capacity of this system should be adjusted by considering domestic and international stakeholders.
Working with Internal Stakeholders: Systems that are commonly used with the Some system within the institution should be identified. Relationships with personnel should also be determined.
Working with External Stakeholders: Determinations should be made for carrying out Some processes with stakeholders outside the institution, from whom the institution receives support for cybersecurity or networks, and the relationships between them should be defined.
Training: Necessary trainings should be provided for the competencies of the personnel who will take görev in Some.
Documentation: The recording of all processes related to the institution, the clear definition of the duties and responsibilities of the personnel, and the preparation of controls and forms for auditing the compliance of the work with standards are carried out in this process.
Use of Forms: The correct, effective, and timely use of the forms used should be ensured.
Reporting: Necessary checks should be provided and submitted for the preparation of reports in the form and content determined by law.
Testing and Auditing: Corrective preparations for adverse events should be made by conducting internal audits, and necessary tests should be performed for information assets.
