Occupational Ethics Rules

Honesty Truthfulness and honesty are our priority values in all business processes and relationships. We act with integrity and honesty in our relationships with employees and all our stakeholders.

Privacy Confidential and private information includes information that could create a competitive disadvantage for ISC Security Consultancy, trade secrets, undisclosed financial and other information, employee personal information, and information covered by "confidentiality agreements" with third parties.

As employees of ISC Security Consultancy, we take care to protect the privacy and confidential information of our clients, employees, and other relevant individuals and organizations we work with. We safeguard confidential information related to our clients' activities, use this information only for the purposes of the provided service, and share it only with authorized individuals within the defined permissions.

For us, any attempt to obtain commercial benefits through the leakage of any kind of confidential information from ISC Security Consultancy (insider trading) is strictly unacceptable. When leaving the company, we do not disclose confidential information and documents, as well as projects, regulations, etc., related to our duties.

Conflict of Interest As employees of ISC Security Consultancy, we aim to avoid conflicts of interest. We do not seek personal gain through the use of our current position, directly or indirectly, by ourselves, our families, or through individuals and organizations with whom we have business relationships. We do not engage in any additional financial activities outside ISC Security Consultancy. We refrain from using the name and power of ISC for personal gain.

In case of a potential conflict of interest, we apply methods that we believe will safely protect the interests of the parties involved through legal and ethical means.

Our Responsibilities In addition to our legal responsibilities, we strive to fulfill the following responsibilities to our clients, employees, suppliers, business partners, competitors, society, humanity, and on behalf of ISC.

Legal Responsibilities We conduct all our activities and transactions, both domestically and internationally, in accordance with the laws of the Republic of Turkey and international law. We provide accurate and understandable information to regulatory authorities in a timely manner.

While conducting all our activities, we maintain an equal distance from all public institutions, administrative formations, non-governmental organizations, and political parties, without expecting any benefit and fulfill our obligations with this sense of responsibility.

Responsibilities to Our Clients We work with a proactive approach focused on customer satisfaction, responding to the needs and requests of our clients in the shortest time and in the most accurate way possible. We provide our services on time and under the promised conditions, approaching our clients with respect, honor, justice, equality, and courtesy.

Responsibilities to Employees We ensure that employees' personnel rights are used in a complete and accurate manner. We treat employees honestly and fairly, commit to a non-discriminatory, safe, and healthy working environment. We make efforts for the individual development of our employees, support them in participating voluntarily in suitable social and community activities, and consider the balance between work and private life.

Responsibilities to Our Partners Prioritizing the continuity of ISC Security Consultancy and creating value for our partners, we avoid taking unnecessary or unmanageable risks and aim for sustainable profitability. We act within the framework of financial discipline and accountability, managing our company's resources and assets with a consciousness of efficiency and thrift. We strive to increase our competitiveness and invest in areas that will provide the highest return on the committed resources.

Responsibilities to Suppliers/Business Partners We treat individuals and organizations with whom we do business fairly and respectfully, and take the necessary care to fulfill our obligations on time. We carefully protect the confidential information of the individuals and organizations we do business with.

Responsibilities to Competitors We compete effectively only in legal and ethical areas, avoiding unfair competition.

We support efforts to achieve the targeted competitive structure within the society.

Responsibilities to Society and Humanity Democracy, human rights, and environmental protection are of great importance to us. We act as pioneers in social issues with a sensitive approach. We behave with sensitivity to the traditions and cultures of Turkey and the countries where we carry out international projects. We do not work with those who damage societal morality, the environment, and public health.

Responsibilities on Behalf of "ISC" Our business partners, customers, and other stakeholders trust us because of our professional competence and honesty. We strive to maintain this reputation at the highest level.

We provide our services within the framework of company policies, professional standards, commitments we make, and ethical rules. We make efforts to provide services in areas where we believe we are and will be professionally competent and aim to work with customers, business partners, and employees who comply with the criteria of accuracy and legitimacy. In public and in areas where listeners think we represent the company, we express not our own opinions but only the views of our company.

When faced with complex situations that could put ISC Security Consultancy at risk, we first consult with appropriate personnel, following appropriate technical and administrative consultation procedures.

POLICIES SUPPORTING BUSINESS ETHICS Conflict of Interest Policy It is essential for ISC Security Consultancy employees to stay away from situations that may create a conflict of interest. The non-use of company resources, name, identity, and power for personal gain, and the avoidance of situations that may adversely affect the institution's name and image are among the most important responsibilities of all employees. The following implementation principles determine the conflict of interest situations that company employees may encounter during the performance of their duties or due to their business relationships and the principles to be applied in these situations.

 

Principles of Implementation

Activities That May Create a Conflict of Interest All company employees must fully comply with the situations listed below as activities that may create a conflict of interest and the principles stated. The company conducts necessary efforts to encourage its employees to adhere to these principles.

Engaging in Activities That May Create a Conflict of Interest Employees must not engage in any business relationship, whether reciprocal or non-reciprocal, with family members, friends, or other third parties that results in mutual or unilateral benefits. For example, an employee with purchasing authority should avoid doing business with a supplier employing a family member. Similarly, ISC Security Consultancy employees should be cautious about potential conflicts of interest arising from family members working for competing companies.

Employees cannot gain any commercial benefit or facilitate others in gaining benefits by leaking any information belonging to ISC Security Consultancy.

ISC Security Consultancy employees should not engage in activities that would require them to be directly or indirectly classified as "merchants" or "tradesmen," regardless of the name under which it is carried out, during or outside working hours, for another individual and/or institution for a fee or similar benefit. However, employees working for another individual (family member, friend, other third parties) and/or institution for a fee or similar benefit outside working hours is possible under the following conditions:

• It does not create a conflict of interest with the duties and company practices at ISC.
• It does not conflict with other business ethics rules and policies supporting these rules.
• It does not negatively impact their duties at the company.
• It is done with written approval from management.

ISC Security Consultancy employees cannot serve as members of the board of directors or auditors for another company without approval. They cannot take on roles in competing companies or those in a business relationship with the company. Non-profit organizations and universities may be exceptions, and employees can participate in social responsibility and charitable activities with the written approval of management, provided it does not adversely affect their duties within the company.

In cases of hiring decisions, managers with decision-making authority cannot hire their spouses, close relatives, or the relatives of these individuals.

Employees can speak on topics unrelated to the company and its activities and that do not violate its policies. Approval from management is required to use the company name in these activities.

ISC Security Consultancy employees can engage in political activities individually and voluntarily. Managers cannot ask employees to engage in political activities or become a member of a political party. Employees can engage in political activities under the following conditions:

• It does not create a conflict of interest with the duties, practices, and approaches at the company.
• Employees cannot engage in any political activities during working hours and cannot take the time of their colleagues.
• They cannot use the company name, position, title, and resources during political activities.
• Employees can make personal and voluntary financial or moral contributions or donations to third parties outside the company, participate in charity organizations, with management's approval.

Abuse of Authority It is unacceptable for employees to cause harm to the company by using their powers for personal gain, contrary to the expected care.

Employees cannot directly or indirectly benefit personally from all purchasing and selling activities, transactions, and contracts of the company. Employees cannot engage in actions and behaviors contrary to ethics, law, and company discipline.

Use of Resources In the use of resources on behalf of the company, the interests of the company are taken into account. Company assets, facilities, and personnel cannot be used outside the company without any benefit to the company, regardless of the name or for the benefit of anyone. The "savings in everything" principle is applied by all staff.

The proper use of resources for the benefit of the company also requires the proper use of time. During working hours, company employees use their time wisely and do not allocate time to personal matters during working hours. Managers cannot assign employees for personal tasks.

It is essential not to accept private visitors during working hours. Employees must complete meetings for compulsory visitors related to the visit in a reasonable time that does not impede workflow.

Relationships with Other Individuals and/or Organizations with Whom the Company is Commercially Involved Private business relationships cannot be established with customers, subcontractors, or suppliers of the company, or other individuals and/or organizations with whom the company is commercially involved. Personal loans and/or goods/services cannot be obtained for personal purposes, and loans and/or goods/services cannot be lent to individuals and/or organizations with whom the company is commercially involved.

Considerations are taken into account in relationships with customers; no transactions can be made without customer knowledge, even if it benefits the customer, and customer vulnerabilities cannot be exploited for the benefit of the company.

Company personnel cannot request gifts from third parties with whom the company is in a business relationship; they cannot make insinuations. Employees cannot accept any gifts, money, checks, property, free vacations, special discounts, etc., from any person or organization in a business relationship with the company. No personal aid or donation can be accepted from any person or organization in a business relationship with the company.

Media Relations Caution is exercised in relations with the media. Giving statements to any media organization, conducting interviews, participating as a speaker in seminars-conferences, etc., are subject to the approval of the company's management. No personal gain can be obtained from these activities in any way.

Representation of the Company All kinds of fees that may arise due to the duties performed for any association, employer's union, and similar non-governmental organizations, as a result of the duty performed, are donated to the relevant institution or the channels indicated by the relevant institution.

Payments made to the company employee as a speaker fee or similar service by third parties during seminars are similarly donated to the relevant institution or the channels directed by the institution. These individuals can accept awards, plaques, etc., given as a memory of the day, which have symbolic value, except for money.

Gift Acceptance and Giving Policy ISC Security Consultancy and its employees must not accept gifts or benefits that may influence their impartiality, decisions, and behaviors, and must not attempt to provide such gifts and benefits to third parties that may create such influences. The implementation principles described below regulate gift exchanges that may occur between company employees and third parties and determine the principles to be applied in this regard.
 

Principles of Implementation

Conflict of Interest Generating Activities All company employees must fully adhere to the situations listed below as activities that may create a conflict of interest and the principles specified when engaging in activities that may create a conflict of interest. The company conducts the necessary activities to encourage its employees to comply with these principles.

Engaging in Activities that May Create a Conflict of Interest Employees should not engage in any form of business relationship that provides mutual or unilateral benefits with family members, friends, or other third parties in any way. For example, an employee with purchasing authority should avoid doing business with a supplier where a family member works. Similarly, company employees should be cautious about potential conflicts of interest arising from the employment of close family members in rival companies.

Employees cannot gain any commercial benefit by leaking any company information from within and cannot facilitate others in gaining benefits.

ISC Security Consulting employees should not engage directly or indirectly in activities that would require them to be considered as "trader" or "merchant"; work for another person and/or institution for remuneration or similar benefits under any name during or outside working hours. However, employees may work for another person (family member, friend, other third parties) and/or institution for remuneration or similar benefits outside working hours under the following conditions:

• It does not create a conflict of interest with the duties and company practices in the company.
• It does not conflict with other business ethics rules and policies supporting these rules.
• It does not negatively affect the performance of their duties in the company.
• Written approval from the management.

ISC Security Consulting employees cannot serve as a member of the board of directors or auditor of another company without approval; they cannot take on roles in rival companies due to the employment of close family members. However, employees may engage in social responsibility and assistance tasks with the written approval of the management outside working hours if the following conditions are met:

• It does not create a conflict of interest with the duties and company practices in the company.
• It does not conflict with other business ethics rules and policies supporting these rules.
• It does not negatively affect the performance of their duties in the company.
• Written approval from the management.

Managers involved in hiring decisions cannot hire their spouses, close relatives, or the relatives of these individuals.

Employees can make speeches and write professional articles on topics unrelated to the company and its activities, as long as they do not violate policies, with the approval of the management for the use of the company name.

Abuse of Position It is unacceptable for employees to cause harm to the company by using their powers beyond what is expected and benefiting themselves and/or their relatives.

Employees cannot personally benefit from all company purchasing and sales activities and transactions, directly or indirectly.

Employees cannot engage in acts and behaviors contrary to ethics, law, and company discipline.

Use of Resources

In company resource uses made on behalf of the company, company interests are taken into account. Company assets, facilities, and personnel cannot be used outside the company, under any name or for anyone's benefit, without company interests. The "Savings in Everything" principle is applied by all staff.

The correct use of resources for the benefit of the company also requires the proper use of time. During working hours, company employees use their time wisely and do not allocate time for personal matters during working hours. Managers cannot assign employees for their personal tasks.

It is essential not to accept private visitors during working hours. Employees must complete meetings for mandatory visitors related to the visit in a reasonable time that does not obstruct the workflow.

Relationships with Other Individuals and/or Organizations in Commercial Relations with the Company

In relationships with the company's customers, contractors, or suppliers, and other individuals and/or organizations in commercial relations with the company, private business relationships cannot be established, and personal loans and/or goods/services cannot be obtained. Company personnel consider the following issues in customer relationships: no transactions can be made without the knowledge of the customer, even if it is in favor of the customer, customer vulnerabilities cannot be exploited for the benefit of the company, and misinformation or incomplete information cannot be given to the customer for profit.

Company personnel cannot request gifts from customers, individuals, or organizations with which the company has business relationships, and cannot make insinuations. Company personnel cannot accept any gifts, money, checks, property, free vacations, special discounts, etc., from any person or organization with which the company has a business relationship.

Media Relations

Careful action is taken in relations with the media. Giving statements to any broadcasting organization, conducting interviews, participating as speakers in seminars-conferences, etc., is subject to the approval of the company management. No personal gain can be obtained from these activities in any way.

Representation of the Company

In all kinds of associations, employers' unions, and similar non-governmental organizations representing the company, any fees that will arise due to the duty performed will be donated to the relevant institution or channels directed by the relevant institution.

Payments made to employees by third parties, such as speaker fees or similar services, are similarly donated to the relevant institution or channels directed by the institution. These individuals can receive symbolic awards, plaques, etc., as a memory of the day, excluding money.

Gift Acceptance and Giving Policy It is forbidden for ISC Security Consulting and its employees to accept gifts or benefits of any kind, whether they have economic value or not, that may affect their impartiality, performance, and decision-making while on duty. Company employees may accept and/or give gifts, or agree to be subject to a special practice under the framework drawn in item 3, provided that the following conditions are met:

• Compliance with company business objectives,
• Compliance with current legislation,
• The gift does not put the company in a difficult situation if learned by the public.

In compliance with the conditions stated in item 2, company employees can provide and receive acceptable standards of entertainment, hospitality, and meals in the business world. Gifts with symbolic value, such as awards, plaques, etc., may be received at seminars and similar events attended on behalf of the company. The total value of gifts received per calendar year and the giver, separately from each giver, under the conditions listed in item 2, does not exceed TRY 250.

Implicit or explicitly linked gifts or benefits are prohibited. Receiving, giving, or offering bribery and/or commission is unacceptable under any circumstances. Employees of the company cannot accept gratuitous or borrowed money, travel expenses, event expenses, and similar payments from subcontractors, suppliers, competitors, or customers.

Gifts and promotional materials to be given to customers and other third parties in business relations with the company are approved by the company management. For approved gifts and promotional materials, no additional permission is required for distribution.

In compliance with the conditions specified in item 2, the company can accept appropriate products and services as gifts, and with the knowledge and approval of the company management, products or services suitable for the recipient's culture and ethical values can be given as gifts.

Exceptional cases where local cultural values ​​require the exchange of gifts beyond the values ​​determined in the company policy must be approved by the company management. In any case, gift exchange should be done in accordance with local culture.

Protection of Confidential Information Policy Information is one of the most important assets that ISC Security Consulting will use on the path to realizing its vision. In this respect, the effective use of information, sharing it correctly, and ensuring the confidentiality, integrity, and accessibility of information during this process are the common responsibility of our company and employees. It is important that the management systems established for information management and confidentiality within our company and the applied processes are in harmony with each other to achieve the maximum benefit for our company. The following implementation principles define the basic principles to be followed by the company and its employees regarding the management and confidentiality of information.

Implementation Principles

Confidential information includes, but is not limited to, intellectual property rights owned by the company such as trademarks, any kind of innovation, including but not limited to databases, printed communication materials, processes, advertising, plans (marketing, product, technical), business strategies, information about strategic partnerships and partners, financial information, personnel information, customer lists, know-how, specifications, identities of potential and real customers, information about suppliers, etc., in any form that can be read in writing, graphics, or machine.

The principles to be followed for confidential information are listed below:

These pieces of information cannot be disclosed to third parties unless required by official authorities and legislation. These pieces of information are immutable, uncopyable, and indestructible. Necessary precautions are taken to keep the information careful, stored, and not revealed. Changes to the information are recorded with its history. Confidential files cannot be taken out of the institution. For confidential information that needs to be taken out of the institution, the person responsible for the information or the approval of the management must be obtained. Passwords, user codes, and similar identifying information used to access company information are kept confidential and not disclosed to anyone other than authorized users. Company confidential information is not discussed in public places such as dining halls, cafeterias, elevators, service vehicles, etc. Confidential information is classified according to confidentiality levels, and this information is explicitly stated in the content. Company personnel know the confidentiality levels of the information they obtain in the course of their duties and act accordingly. In case of doubt about the confidentiality level, it is treated according to a higher confidentiality class, and the opinion of the relevant manager is taken when necessary. If it is necessary to share information with third parties and/or organizations for the benefit of the company, a confidentiality agreement is signed or a written commitment to confidentiality is obtained from the other party before sharing the information to ensure an understanding of the responsibilities of these persons and organizations regarding the security and protection of shared information. False statements and/or gossip about individuals or institutions cannot be made. Salary, benefits, and other similar personal information specific to employees, reflecting the company's policies and belonging to individuals, are confidential and cannot be disclosed to anyone other than authorized personnel. Information about employees is sent to the individuals concerned personally. It is strictly forbidden for employees to disclose this information to others or to pressure other employees to disclose this information. Creating and Maintaining a Fair Working Environment Policy ISC Security Consulting considers creating and maintaining a fair working environment for employees as one of its top priorities. The aim is to establish and maintain a fair, respectful, healthy, and safe working environment in compliance with all relevant laws and regulations, with the goal of increasing employee success, development, and loyalty. The following implementation principles define the basic principles for creating and maintaining a fair working environment at the company.

Implementation Principles

Company practices comply with all relevant laws and regulations related to employment and working life. Company employees also comply with all legal requirements within the scope of their activities and behave in accordance with legal regulations. ISC Security Consulting human resources policies and practices ensure that all practices related to employment, such as recruitment, promotion-transfer-rotation, compensation, rewards, social benefits, etc., are fair. Discrimination based on language, race, color, gender, political thought, belief, religion, sect, age, physical disability, etc., among employees in the company is unacceptable. A collaborative, positive, and harmonious working environment that supports cooperation is created within the company. Conflict environments are prevented, and different individuals with different beliefs, thoughts, and opinions are ensured to work harmoniously. Respect is shown for the private life and personal space of employees. Communications between individuals cannot be violated by non-involved persons, even if they are legally recorded. Even if recorded in accordance with the law, personal data cannot be given/shared/accessed unlawfully to third parties. Employee privacy and family life are respected. In addition to any physical immunity, physical, sexual, and emotional immunities of employees are also taken into account. Violation of the physical, sexual, and/or emotional immunity of an employee by any means at the workplace or any place where the employee is present for work purposes is illegal and against ethical rules, and the company does not tolerate such actions in any way. The aim of this practice is to ensure that employees work in an environment where their physical, sexual, and emotional immunities are protected. The violation of a person's bodily immunity by sexual behaviors and/or the harassment of a person for sexual purposes without physical contact is defined as sexual harassment. Accordingly, any behavior that can be evaluated within this definition is prohibited. In addition, the same intolerance is shown to individuals who exhibit negative attitudes and behaviors towards those who complain about and report harassment or assist in the investigation. No employee can request privileged treatment, show favoritism to anyone, or be subject to special treatment based on different gender, religion, language, race, etc. It is unacceptable to exploit differences such as gender, religion, language, race to obtain or give concessions. The physical working environment and conditions are ensured to be healthy and safe for all employees.
 

III. LEGISLATION TO BE APPLIED

Due to ISC Security Consulting's international operations, the company's operations may be subject to different country laws and regulations in international markets. When there are questions regarding the ethics of doing business in different countries, the regulations in the country where the business is conducted should be followed first. If monitoring the regulations in the country and/or countries where the business will be conducted may result in problematic consequences in terms of the ethical values adopted by ISC Security Consulting in international operations, in such cases, solutions should be sought within the ethical rules and procedures we have.

EMPLOYEE RESPONSIBILITIES The policies and procedures detail the ethical rules on how we should behave and conduct our work. Compliance with these rules is the primary responsibility of all employees. In this regard, all ISC Security Consulting employees must:

• Always act in compliance with laws and regulations,
• Read, understand, internalize, and adhere to the ISC Code of Business Ethics, including its rules, principles, and values,
• Learn the general and specific policies and procedures applicable to the company and its operations,
• Consult with their manager and human resources regarding potential violations related to themselves or others,
• Promptly report any actual or potential violations, whether named or anonymous, to their manager and human resources,
• Collaborate with ISC management in ethical investigations and keep information related to investigations confidential.

Guidelines and Methods for Ethical Decision-Making When making a decision regarding an action plan, you should follow the steps below as a guide and ask yourself these questions:

Identify the Incident, Decision, or Problem

• Are you asked to do something you believe may be wrong?
• Are you aware of a situation in the company or with your business partners that may potentially be illegal or unethical?
• Are you trying to make a decision and have doubts about how to act in accordance with business ethics?

Think Before Making a Decision

• Try to clearly identify and summarize the problem or issue.
• Ask yourself why there is a dilemma.
• Consider options and consequences.
• Think about who might be affected.
• Consult with others.

Make a Decision on an Action Plan

• Define your responsibilities.
• Review all relevant facts and information.
• Refer to appropriate company policies, procedures, and professional standards.
• Assess risks and think about how to mitigate them.
• Attempt to create the best action plan.
• Consult with others.

Test Your Decision

• Review questions that need to be asked ethically.
• Review your decisions in the framework of the company's core values.
• Ensure that you consider company policies, laws, and professional standards.
• Consult with others and evaluate their opinions within your planned action plan.

Proceed with Determination

• Share your decision with relevant individuals along with your justifications.
• Share what you have learned.
• Share your success story with others.

4 Fundamental Questions to Consider

• Is this activity/behavior in compliance with laws, rules, and traditions? (Standards)
• Is it in accordance with professional standards?
• Does it comply with the law?
• Is this activity/behavior balanced and fair? Would we be uncomfortable if a competitor (someone else) did it? (Sense of justice)
• Is it right for you?
• Would our company and stakeholders be uncomfortable if all the details of this activity were made public? (Feelings and ethical values)
• Would you be in a difficult situation or embarrassed if others knew that you engaged in this behavior?
• Could there be negative consequences for you or your company?
• Who else could be affected (other employees within the company, yourself, etc.)?
• To what extent does the "perceived reality" align with the "objective reality"?
• How would it be portrayed in the newspapers?
• What would a reasonable person think in the same circumstances?
   

RESPONSIBILITIES OF MANAGERS

ISC Security Consulting managers have additional responsibilities beyond those defined for employees within the framework of business ethics rules. Accordingly, managers are responsible for:

• Creating and maintaining a corporate culture and work environment that supports ethical rules,
• Setting an example with their behavior in the application of ethical rules, educating their employees on ethical rules,
• Supporting their employees in transmitting questions, complaints, and reports related to ethical rules,
• Guiding their employees on what to do when consulted, considering all reports received,
• Structuring the business processes under their responsibility in a way that minimizes ethical risks and implementing the necessary methods and approaches to ensure compliance with ethical rules.

OTHER RESPONSIBILITIES

The company management is responsible for the effective implementation of the Code of Business Ethics and the creation of a culture that supports it.

Human Resources of the company are responsible for:

• Informing employees about Ethical Rules, providing training at specific intervals to ensure the understanding of policies and rules, and maintaining continuous communication with employees on this subject,
• Ensuring that new hires read and are informed about ethical rules and sign relevant notifications,
• Ensuring that all employees read and reaffirm the Code of Business Ethics at the beginning of each year.

The company management is responsible for:

• Ensuring the confidentiality of complaints and reports made within the framework of ethical rules and protecting individuals after the reports,
• Ensuring the job security of employees reporting violations,
• Ensuring that complaints and reports are investigated in a timely, fair, consistent, and sensitive manner, and taking necessary actions with determination in case of violations.