What a security certificate cannot tell you

Executive summary

Match the certified entity, service and period against the contracting party and purchased product. Ask about excluded components and controls that the customer must configure.

A certificate is one input into a broader security assessment. Consider practical assurance rights: current reports, follow-up of significant findings and additional information after defined events. Record which service was assessed, unresolved questions and their owner.

Sources

KVKK · Veri güvenliğine ilişkin yükümlülükler

https://www.kvkk.gov.tr/Icerik/2040/Veri-Guvenligine-Iliskin-Yukumlulukler