Compliance Compass
Which regulations apply to you? See your missing layers in 2 minutes.
Pick your sector and a few basics. The Compass finds which of KVKK, Law 7545, BRSA, NIS2 and 12 more regulations bind you, and shows your gaps across 12 security layers.
- 3 steps · about 2 minutes
- Calculated in your browser
- No form for the result
Coverage score
By your answers, how much of the layers your regulations weigh is in place.
- Critical gap
- 0
- Needs work
- 0
- In place
- 0
Regulations in scope
Cyber Security Law No. 7545AppliesPossible
- Who it covers
- Public bodies, critical infrastructure operators and providers of cyber security products or services.
- Timeline
- In force (March 2025); secondary legislation pending.
- Sanctions
- Administrative fines and prison terms are foreseen; details on the regulation page.
Summary only; current details are on the regulation page and in the official text.
In force (March 2025); secondary legislation pending.
KVKK (Turkish Data Protection Law No. 6698)AppliesPossible
- Who it covers
- Every organisation that processes personal data.
- Timeline
- Data breaches must be notified within 72 hours.
- Sanctions
- Administrative fines, revalued every year.
Data breaches must be notified within 72 hours.
BRSA Information Systems & Electronic Banking RegulationAppliesPossible
- Who it covers
- Banks and financial institutions supervised by the BRSA.
- Sanctions
- BRSA administrative sanctions and audit findings.
Summary only; current details are on the regulation page and in the official text.
BRSA administrative sanctions and audit findings.
CMB Information Systems Management CommuniquéAppliesPossible
- Who it covers
- Brokerages, portfolio managers and other entities supervised by the Capital Markets Board.
- Sanctions
- CMB administrative sanctions and audit findings.
Summary only; current details are on the regulation page and in the official text.
CMB administrative sanctions and audit findings.
EMRA Cyber Security Competency ModelAppliesPossible
- Who it covers
- Licence holders in the electricity, natural gas and petroleum markets.
- Sanctions
- EMRA administrative sanctions and licence audits.
Summary only; current details are on the regulation page and in the official text.
EMRA administrative sanctions and licence audits.
Law No. 5651 (Internet publications)AppliesPossible
- Who it covers
- Hotels, malls, cafés, campuses and workplaces that offer Internet access to guests or the public.
- Timeline
- Access logs must be kept for the period set by the regulation.
- Sanctions
- Administrative fines.
Summary only; current details are on the regulation page and in the official text.
Access logs must be kept for the period set by the regulation.
Presidential Information & Communication Security GuideAppliesPossible
- Who it covers
- Public bodies and operators of critical infrastructure services.
- Timeline
- Compliance audits and reporting are periodic.
Summary only; current details are on the regulation page and in the official text.
Compliance audits and reporting are periodic.
NIS2 DirectiveAppliesPossible
- Who it covers
- Essential and important entities serving the EU, and their supply chains.
- Timeline
- Member-state transposition deadline: 17 October 2024.
- Sanctions
- Up to €10m or 2% of global turnover for essential entities.
Member-state transposition deadline: 17 October 2024.
DORA (Digital Operational Resilience Act)AppliesPossible
- Who it covers
- EU financial entities and their critical ICT third-party providers.
- Timeline
- Applies since 17 January 2025.
- Sanctions
- Sanctions are set by member-state authorities.
Applies since 17 January 2025.
GDPR (EU General Data Protection Regulation)AppliesPossible
- Who it covers
- Organisations offering goods or services to people in the EU, or processing their data.
- Timeline
- Data breaches must be notified within 72 hours.
- Sanctions
- Up to €20m or 4% of global turnover.
Data breaches must be notified within 72 hours.
EU AI ActAppliesPossible
- Who it covers
- Organisations placing AI systems on the EU market or using them in the EU.
- Timeline
- Phased application; prohibitions apply since February 2025.
- Sanctions
- Up to €35m or 7% of global turnover for prohibited practices.
Summary only; current details are on the regulation page and in the official text.
Phased application; prohibitions apply since February 2025.
CRA (EU Cyber Resilience Act)AppliesPossible
- Who it covers
- Manufacturers placing products with digital elements (software, devices) on the EU market.
- Timeline
- Vulnerability reporting mandatory since September 2026; full application in December 2027.
- Sanctions
- Up to €15m or 2.5% of global turnover.
Summary only; current details are on the regulation page and in the official text.
Vulnerability reporting mandatory since September 2026; full application in December 2027.
ISO/IEC 27001:2022AppliesPossible
- Who it covers
- Any organisation running an information security management system, or asked for certification by customers.
- Timeline
- The transition from the 2013 edition ended in October 2025.
- Sanctions
- No legal fine; risk of losing certification and tenders.
The transition from the 2013 edition ended in October 2025.
ISO/IEC 27017 (cloud security)AppliesPossible
- Who it covers
- Organisations that use or provide cloud services.
- Sanctions
- No legal fine; a certification standard.
No legal fine; a certification standard.
IEC 62443 (OT/ICS security)AppliesPossible
- Who it covers
- Organisations that operate, integrate or build industrial control systems.
- Sanctions
- No legal fine; sector regulators may refer to it.
No legal fine; sector regulators may refer to it.
PCI DSS 4.0.1AppliesPossible
- Who it covers
- Every organisation that processes, stores or transmits card data.
- Timeline
- Future-dated requirements became mandatory on 31 March 2025.
- Sanctions
- Fines imposed by card brands and acquirers; loss of card acceptance.
Future-dated requirements became mandatory on 31 March 2025.
Applies Regulations that appear to apply, based on your answers. Possible Regulations that may apply depending on your structure; worth confirming.
Layer map
12 security layers, weighted by the regulations in scope and your answers.
- ANAC · Zero Trust
- BAPN · OT
- CHotspot · 5651
- DEndpoint
- EPAM · UAM · ITDR
- FDLP & AI Security
- GBrowser · SSE · GenAI
- HLLM · AI agents
- ICloud · K8s · ASPM
- JSOC · CTEM · Vulns
- KPhishing
- LPatch · MFA · Audit
- Gap
- Partial
- In place
- Out of focus
Top 3 priorities
Open layers that the regulations in scope weigh most heavily.
Network access control & Zero Trust
Strong mapping:
Recommended solutions
- Network Access Control (NAC)
- Zero Trust Architecture
APN, OT & critical infrastructure
Strong mapping:
Recommended solutions
- Mobile & Private APN Security
- OT/ICS Security
- Critical Infrastructure Protection
Guest Internet & access logging (5651)
Strong mapping:
Recommended solutions
- Guest Wi-Fi & Hotspot Logging
Endpoint compliance & application control
Strong mapping:
Recommended solutions
- Endpoint Protection (EPP) & App Control
Privileged access, user activity & ITDR
Strong mapping:
Recommended solutions
- Privileged Access Management (PAM)
- User Activity Monitoring
- Identity Threat Detection (ITDR)
Data loss prevention & classification (DLP & AI Security)
Strong mapping:
Recommended solutions
- Data Loss Prevention (DLP)
- Data Classification & Discovery
Browser, SSE & GenAI usage
Strong mapping:
Recommended solutions
- Enterprise Browser Security
- Security Service Edge (SSE)
- GenAI Usage Security
LLM & AI agent security
Strong mapping:
Recommended solutions
- LLM & AI Agent Security
Cloud, Kubernetes & application security
Strong mapping:
Recommended solutions
- Cloud-Native App Protection (CNAPP)
- Kubernetes & Container Security
- DevSecOps, ASPM & SBOM
24/7 monitoring, exposure & vulnerability management
Strong mapping:
Recommended solutions
- Micro SOC 24/7 Monitoring
- Continuous Exposure Management (CTEM)
- Vulnerability & Attack Surface Management
- Threat Intelligence & Dark Web Monitoring
Phishing simulation & protection
Strong mapping:
Recommended solutions
- Phishing Simulation & Protection
Patching, MFA (Buguardian Authenticator) & infrastructure audit
Strong mapping:
Recommended solutions
- Patch & Endpoint Management
- MFA & SSO
- Firewall, AD & Database Auditing
By your answers, no priority gap is open.
Every layer the regulations in scope weigh is in place. The next step is to back this up with evidence: an independent check before an audit surfaces missing records and reports.
Regulation × layer matrix
Show
● strong mapping · ○ supporting mapping. Mappings rest on vendor statements and NSS assessment.
| Regulations in scope | A: Network access control & Zero Trust — | B: APN, OT & critical infrastructure — | C: Guest Internet & access logging (5651) — | D: Endpoint compliance & application control — | E: Privileged access, user activity & ITDR — | F: Data loss prevention & classification (DLP & AI Security) — | G: Browser, SSE & GenAI usage — | H: LLM & AI agent security — | I: Cloud, Kubernetes & application security — | J: 24/7 monitoring, exposure & vulnerability management — | K: Phishing simulation & protection — | L: Patching, MFA (Buguardian Authenticator) & infrastructure audit — |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 7545 | strong mapping | strong mapping | supporting mapping | supporting mapping | strong mapping | strong mapping | supporting mapping | supporting mapping | supporting mapping | strong mapping | supporting mapping | supporting mapping |
| KVKK | supporting mapping | — | strong mapping | supporting mapping | strong mapping | strong mapping | strong mapping | supporting mapping | supporting mapping | strong mapping | strong mapping | strong mapping |
| BRSA | strong mapping | supporting mapping | — | supporting mapping | strong mapping | strong mapping | supporting mapping | supporting mapping | supporting mapping | strong mapping | supporting mapping | strong mapping |
| CMB | supporting mapping | — | — | supporting mapping | strong mapping | strong mapping | supporting mapping | — | supporting mapping | strong mapping | supporting mapping | supporting mapping |
| EMRA | strong mapping | strong mapping | — | strong mapping | strong mapping | supporting mapping | — | — | — | strong mapping | supporting mapping | supporting mapping |
| 5651 | supporting mapping | — | strong mapping | — | supporting mapping | supporting mapping | supporting mapping | — | — | — | — | — |
| ICS Guide | strong mapping | supporting mapping | — | supporting mapping | strong mapping | strong mapping | supporting mapping | — | supporting mapping | strong mapping | strong mapping | strong mapping |
| NIS2 | strong mapping | supporting mapping | supporting mapping | supporting mapping | strong mapping | strong mapping | supporting mapping | supporting mapping | supporting mapping | strong mapping | strong mapping | strong mapping |
| DORA | supporting mapping | — | — | supporting mapping | strong mapping | strong mapping | supporting mapping | supporting mapping | strong mapping | strong mapping | supporting mapping | supporting mapping |
| GDPR | supporting mapping | — | strong mapping | — | strong mapping | strong mapping | strong mapping | supporting mapping | supporting mapping | strong mapping | supporting mapping | supporting mapping |
| AI Act | — | — | — | — | supporting mapping | supporting mapping | strong mapping | strong mapping | — | — | — | — |
| CRA | — | — | — | — | — | supporting mapping | — | supporting mapping | strong mapping | strong mapping | — | supporting mapping |
| ISO 27001 | strong mapping | supporting mapping | supporting mapping | supporting mapping | strong mapping | strong mapping | strong mapping | supporting mapping | strong mapping | strong mapping | strong mapping | strong mapping |
| ISO 27017 | supporting mapping | — | — | supporting mapping | supporting mapping | supporting mapping | strong mapping | — | strong mapping | supporting mapping | — | supporting mapping |
| IEC 62443 | strong mapping | strong mapping | — | supporting mapping | strong mapping | supporting mapping | — | — | supporting mapping | supporting mapping | — | supporting mapping |
| PCI DSS | strong mapping | supporting mapping | supporting mapping | supporting mapping | strong mapping | strong mapping | supporting mapping | — | supporting mapping | strong mapping | strong mapping | strong mapping |
Next step
Detailed PDF report
Obligations per regulation, the layer table and a prioritised roadmap.
Talk to an expert
Our solution architect reviews the result with you. Reply within 24 hours.
Talk to an expert (in Turkish)Measure your posture score Coming soon
Measures your domain’s externally visible security posture with passive checks.
This result is a preliminary assessment based on your answers, not legal advice. Regulatory interpretations and mappings are reviewed regularly.
Method
How the Compass works
Rules
Your sector and six profile answers run through an “applies” or “possible” scope rule for each of 16 regulations.
Matrix
Each regulation maps to the 12 security layers as strong (●) or supporting (○). Mappings rest on vendor statements and NSS assessment.
Priority
A strongly mapped layer that is not in place is a critical gap. The three heaviest gaps come first, with recommended solutions.
Frequently asked questions
Are my answers sent anywhere?
No. The calculation runs entirely in your browser. Your answers are sent only if you fill in and submit the form for the detailed PDF report.
What do “applies” and “possible” mean?
“Applies” means a regulation appears to apply, based on your sector and answers. “Possible” means it may apply depending on your structure, your markets, or a “Not sure” answer.
Is the result legal advice?
No. The Compass is a preliminary assessment based on your answers. To confirm your scope, talk to your legal counsel and our solution architect.
How do I share the result with my team?
The “Copy link” button on the result screen puts your answers into the page link. Anyone who opens it sees the same result; nothing is stored on a server.