What Does SOME Mean?
SOME, an abbreviation for the Computer Security Incident Response Team, was published in Turkey in the Official Gazette on October 20, 2012, by a Decree of the Council of Ministers. There are two different types of this response team. These are:
1) Sectoral SOME: Established within institutions responsible for regulating and supervising critical sectors. These institutions can be listed as EPDK, RTÜK, SPK.
2) Institutional SOME: Established within public institutions or critical infrastructure operators. All public institutions and organizations with an IT department are obliged to establish a SOME.
Stages of Establishing a SOME
Plan for its Place and Capacity within the Institution: The SOME systems within the institution where it will be established should be planned independently of the institution's information technology systems, and the capacity of this system should be adjusted considering domestic and international stakeholders.
Working with Internal Stakeholders: Systems commonly used with the SOME system within the institution should be identified. Relationships with personnel should also be determined.
Working with External Stakeholders: Determinations should be made for carrying out SOME processes with stakeholders located outside the institution from which the institution receives support for cybersecurity or networks, and the relationships between them should be defined.
Training: Necessary training should be provided for the competencies of personnel who will take görev in SOME.
Documentation: In this process, recording all processes related to the organization, clearly defining the duties and responsibilities of the personnel, and preparing inspections and forms for the compliance of the work with standards are carried out.
Use of Forms: The correct, effective, and timely use of the forms used should be ensured.
Reporting: Necessary controls should be provided and submitted for the preparation of reports in the period and content determined by the law.
Testing and Auditing: Internal audits should be conducted, corrective preparations should be made for deficiencies, and necessary tests should be performed for information assets. You can review the relevant online addresses on internet pages to learn about these tests.
