ISO 27001 and the digital archive: how is document security ensured?

ISO 27001 is an international standard that aims to establish an Information Security Management System (ISMS) protecting the confidentiality, integrity and availability of an organisation’s information assets. For a digital archive, this means that documents are not seen or altered by unauthorised people and are always accessible when needed.

What are the three basic principles of information security?

• Confidentiality: Only authorised people can reach the document.
• Integrity: The document is not altered without permission; it is tracked which change was made by whom.
• Availability: The document is available when it is needed.

How does authorisation work in a digital archive?

Each user sees and requests on loan only the documents within their authorisation. Who holds a document is tracked through the system; reports answer the question “who accessed which document, and when”. This approach makes both internal audit and accountability easier.

What does Dijital Yazılım’s information security policy cover?

The policy is managed according to the TS EN ISO/IEC 27001:2022 standard and was published as document PLT.32 on 26.10.2023. The scope of the system includes document, digital archive, electronic document, media and social media archive management systems; asset management and RFID solutions; custom software and information systems; scanner and hardware sales and service; archive and library organisation and digitisation; cataloguing; and historical document digitisation, transcription, conservation and restoration activities. For the full text, see our information security policy.

What commitments does the policy include?

1. Managing the Information Security Management System according to ISO 27001:2022
2. Controlling the storage, transmission, modification and processing of assets
3. Protecting the availability, integrity and confidentiality of information
4. Applying physical security controls for assets kept in secure areas
5. Assessing and managing risks to information assets
6. Establishing the administrative structure for reporting breaches and taking quick action
7. Reducing the impact of threats on business continuity and continuously improving the awareness of all stakeholders

This list consists of the prominent ones among 14 commitments; all of them appear in the policy text.

Is an extra layer of security needed for identity verification?

For operations that require high security, multi-factor authentication can be applied. biOnay is the first approved, 100% domestic mobile card access device that combines an ID card, PIN, fingerprint and digital photo verification. For the general flow of setting up a digital archive, see our digital archive guide.

Frequently asked questions

Which version of ISO 27001 is used as the basis?

Dijital Yazılım’s Information Security Management System is managed according to the TS EN ISO/IEC 27001:2022 standard.

What is done in the event of a breach?

The policy commits to establishing the administrative structure, resources and infrastructure for reporting breaches and taking quick action, and to applying the necessary sanctions.

Where should you start with your archive?

If you are not sure which step to begin with, we start the first meeting with a feasibility study and an inventory. The digital archive assessment and the initial meeting are free of charge; you can fill in the form on the contact page or call +90 (212) 588 51 44.