March 18, 2026, 2:35 p.m.

Cybersecurity in the Defense Industry is Now a Necessity

Turkey's defense industry ecosystem is growing every year. Alongside main contractors, thousands of SMEs have become an integral part of this critical supply chain. However, this growth brings with it a serious responsibility: Cybersecurity.

Cyber attackers are now targeting the weakest link in the chain rather than directly attacking large companies: supplier SMEs. A cyber threat infiltrating an SME's system can compromise the entire defense industry supply chain.

Based on this reality, the Presidency of Defense Industries (SSB) has launched the Cyber Hygiene-SME Certification Program to protect SMEs in the supply chain.

What is Cyber Hygiene?

Cyber hygiene is the set of basic security habits and practices that individuals and organizations must regularly implement to keep their digital systems healthy and secure. Just as personal hygiene habits protect against physical diseases, cyber hygiene protects your organization against threats in the digital environment.

The 6 fundamental habits of corporate cyber hygiene

What is the SSB Cyber Hygiene-SME Certification Program?

This program launched by SSB is designed to measure and document the basic cybersecurity level of SMEs in the defense industry supply chain. Within the scope of the program, your organization is evaluated by independent auditors in 13 main security categories. If it is determined that you meet the minimum requirements as a result of the audit, a Cyber Hygiene-SME Certificate is issued.

13 Audit Categories: What Does SSB Audit?

SSB's audit criteria table consists of 13 main categories evaluated at three levels: Beginner, Intermediate, and Advanced.

13 security categories evaluated in SSB audit

1. Asset Management

Covers inventory management of IT assets (computers, laptops, servers, storage media), current monitoring of hardware and software inventory, and task-based personnel authorization processes. Basic principle: An unknown system cannot be protected.

2. Network and System Security

Mandatory VPN use on untrusted networks, up-to-date operating systems, strong password policies (minimum 8 characters, uppercase/lowercase, numbers, special characters), Wi-Fi password management, and modern encryption protocols such as WPA2/WPA3/AES.

3. Endpoint (Client) Security

Keeping anti-virus and firewall software active on all systems, separating business and personal accounts, and disabling default "Administrator" accounts.

4. Email Security

Email is the most common entry point for cyber attacks. Corporate email use, preference for domestic service providers, password policy compliance, and mandatory 2-factor authentication (2FA) constitute the basic requirements of this category.

5. Physical and Environmental Security

Security cameras and detection systems, restricted access to critical rooms, and biometric/card-based password access systems.

6. Data Security

Ensuring only authorized persons can access confidential data, establishing data security policies, restricting USB use, and secure export processes for confidential data.

7. Backup

Regular backup of critical and operating systems to external media and periodic testing of backups is mandatory.

8. Awareness

Technical measures alone are not sufficient. Employees must complete basic cybersecurity training and the organization's security policy must cover all personnel.

9. Update Management

Keeping all operating systems, servers, and third-party software up to date, regular application of security patches, and use of licensed software.

10. Incident Breach Management

Immediate notification to relevant authorities (SSB, main contractor) is mandatory in case of classified data being removed from the premises.

11. Cloud Security

Authorization verification in cloud services and documentation that data is not shared with third parties is required.

12. Data Destruction Management

Secure destruction of decommissioned devices and data; deletion of personal data within the scope of KVKK (GDPR) using appropriate methods is mandatory.

13. Human Resources Security

All personnel must undergo resume verification before starting work and be subject to regular security activities.

Your Commitments in the Certification Process

Under the Commitment Letter signed when applying to the SSB Cyber Hygiene-SME Certification Program:

• Accuracy of information and documents: You declare that all information and documents you provide are accurate and complete.
• Physical audit: TRTEST independent auditors may visit your organization on-site for auditing.
• Deficiency notification: If a deficiency is detected, the audit may be postponed with at least 2 business days' notice.
• Certificate revocation right: The certificate is revoked and SSB is notified if misleading information is detected.
• Technical issues: An opportunity for correction is given within 30 days; otherwise, the process may be concluded negatively.

SSB Cyber Hygiene-SME Certificate: Proof of reliable partnership in the supply chain

Why Should You Manage This Process with Nordis Global?

The SSB Cyber Hygiene-SME Certification process is a multi-step process requiring technical knowledge and experience. As Nordis Global, we offer the following in this process:

• ✅ Pre-Assessment (Gap Analysis): We compare your current security status with audit criteria.
• ✅ Technical Implementation Support: Expert support in network security, endpoint protection, backup, and update processes.
• ✅ Policy and Documentation: Data security policies, incident response plans, and HR procedures.
• ✅ Audit Preparation: Pre-audit simulation and preparation processes.
• ✅ Continuous Compliance: Regular monitoring and consulting to maintain validity even after obtaining the certificate.

Conclusion: Take Action for a Secure Supply Chain

The SSB Cyber Hygiene-SME Certificate is becoming an increasingly critical requirement for SMEs wishing to participate in the defense industry supply chain. Cyber hygiene is not a cost, but an investment. It is always wiser to take action before experiencing a data breach or ransomware attack.