ERDEM-NEWSLETTER-2018-metin

217 CAPITAL MARKETS LAW It is stated under Article 26 ( Sustainability of the Information Systems ) of the Management Communiqué that the institutions, es- tablishments and associations are obliged to keep the primary and secondary systems within the Republic of Turkey. As in practice, so many publicly held companies are currently keeping their iCloud sys- tems abroad; such a newly introduced provision created discussions as to whether those companies will be required to transfer their systems into the Republic of Turkey. However, the CMB announced a public disclosure in the CMB Bulletin dated 8 March 2018 and numbered 2018/10 in order to clarify such discussions. The CMB stated that the information systems of the publicly held companies, which are not subject to independent audit, are not required to keep their primary systems within the Republic of Turkey. The CMB further stipulates that the scope of the publicly held companies, which are subject to in- dependent audit, is planned to be gradually extended. For those com- panies that will be subject to independent audit, they will be obliged to keep the primary systems from the period, under which they are obliged, within the Republic of Turkey. Management of the Information Systems The Management Communiqué is entered into force in order to ensure the formation and management of the information systems in a secure, efficient, sustainable manner, and to determine the procedures and principles applicable thereto. For this purpose, pursuant to the Management Communiqué, the policies for the establishment of the information systems, operation, management and usage thereof, as well as all sorts of information security related policies, such as confidentiality, integrity and, if and when needed, availability of the information, should be prepared by the top management and approved by the board of directors. Follow- ing its approval, the policies should be announced to the employees. The top management is responsible for the monitoring of the ap- plication of the policies; however, the responsibility for organizing effective and sufficient controls is delegated by the board of directors. The Management Communiqué further sets forth that the top manage- ment is responsible to create a certain mechanism for review of the