Türkiye's Cyber Security Council receives Digital Sovereignty Strategy

Türkiye's Cyber Security Council met on 27 October 2026 under the chairmanship of President Recep Tayyip Erdoğan. According to the statement issued afterwards by the Presidency's Communications Directorate, the Digital Sovereignty Strategy was submitted to the Council. The strategy aims to reduce dependence on foreign critical technologies, build national technology capacity and protect critical infrastructure.

What was on the agenda

The statement lists four main themes: the effect of geopolitical developments on the cyber security environment, recent international cyber incidents and shifting threat dynamics, how advances in artificial intelligence are changing the nature, scale and speed of cyber threats, and the national security risks posed by algorithmic steering and cognitive influence operations on digital platforms.

The Council decided that the actions set under the strategy will be carried out by the relevant institutions within their own areas of responsibility, that implementation will be monitored and that progress will be reviewed regularly. The statement also notes that cyber threats spread quickly across sectors, and commits to stronger inter-institutional coordination, joint risk assessment capability and deeper cooperation between the public sector, private sector and academia.

Why it matters

No new obligation, deadline or penalty for companies was announced. The significance lies in the direction rather than the detail. Türkiye's legal framework for cyber security is already set by Law No. 7545, and the Cyber Security Directorate holds audit powers. Seeing supply dependency and critical infrastructure treated at Council level signals where secondary legislation and audit practice are likely to concentrate next.

The supply chain emphasis is the part worth noting. Several incidents in Türkiye over recent months began not at the target organisation but at a software or remote support provider serving it. That indirectly concerns companies outside the law's formal scope: an SME supplying an in-scope organisation increasingly meets the same security requirements through its contracts.

What this means for SMEs in Türkiye

In practice this shows up as security clauses in customer contracts. An engineering office, agency or logistics firm working with a large manufacturer, a port, a hospital or a public body is answering the same questions more and more often: how do you manage remote access, where are your backups and how often are they tested, and how quickly do you report a breach?

In many SMEs on Istanbul's Anatolian side there is no written answer to those questions. The infrastructure may run perfectly well, yet nobody has recorded who has access to what, which accounts are still open, or when the last restore test was carried out. When an audit or a customer questionnaire arrives, what is usually missing is not technology but documentation.

What Kamer Bilişim recommends

• Inventory your access, then reduce it. Who connects to your network remotely: staff, software vendors, your accountant, maintenance providers? Close accounts belonging to leavers, put time limits on standing VPN and remote support accounts, and require multi-factor authentication on every administrative account.
• Test your backups rather than confirming they exist. Keep three copies on two types of media, with one off-site and disconnected from the network. Run a genuine restore test every quarter and record the result with its date.
• Put supplier and incident response in writing. Keep one document listing your critical software and service providers, their level of access and their contact points. Decide in advance who calls whom in a breach and within how many hours you will notify.

If you would like to review your access inventory, backup testing and supplier security against your current infrastructure, you can reach us through our contact page.

Source: Anadolu Agency, Milliyet, Hürriyet