
Information Security Policy
This policy defines the corporate framework for ensuring information security, maintaining business continuity, and ensuring compliance with legal obligations in the oil, gas, petrochemical, hydrogen, and energy sectors where Mega Industry operates.
1) Purpose
To ensure information security, maintain business continuity, and guarantee compliance with legal obligations in the oil, gas, petrochemical, hydrogen, and energy sectors where Mega Industry operates.
2) Scope
This policy covers all locations, information systems, employees, contracted parties, and all external parties with access to information of Mega Industry.
3) Policy Statement
We consider information security as a critical element for business sustainability, employee safety, and regulatory compliance.
We commit to establishing, implementing, and continuously improving an Information Security Management System (ISMS) in accordance with ISO/IEC 27001:2022 standard.
We take special protective measures against information security threats in our sector-specific high-risk activities.
We ensure full compliance with national and international legislation, contractual obligations, and energy and environmental regulations.
We develop active measures against threats specific to our sector such as cyber threats, espionage, sabotage, and industrial data theft.
We provide regular training to increase information security awareness of all our employees and relevant parties.
We encourage reporting of information security breaches and immediately initiate necessary corrective actions.
4) Objectives
To ensure uninterrupted operation of critical infrastructure and production systems,
To prevent leakage of industrial secrets,
To establish and monitor measurable information security objectives within the scope of ISMS to protect information assets against unauthorized access.
5) Roles and Responsibilities
Top Management: Guarantees policy implementation and resource provision.
ISMS Team: Responsible for establishing, maintaining, and improving systems.
All Employees: Obliged to comply with this policy and report suspicious incidents.
Suppliers and Contractors: Must comply with information security requirements.
6) Review and Publication
This policy is reviewed at least once a year or after significant changes.
The policy is shared with internal and external stakeholders through Mega Industry corporate channels.
Document Code: PLT.02 | Revision: 03 | Date: 29.09.2025
Approved by: Derya TOPRAK - GENERAL MANAGER
