Gap analysis between iso/iec 27001:2022 and the turkishpublic information and communication security guide

Increasing digitalization on a global scale has transformed information security from a mere technical requirement for public institutions into a strategic management area. With this transformation, the integration of international standards in a manner compatible with institutional structures has become critical for the protection of information assets. In this thesis, the structural compatibility, discrepancies, and application differences between the ISO/IEC 27001:2022 Information Security Management System standard and the Public Information and Communication Security Guide published by the Presidency of the Republic of Turkey's Digital Transformation Office have been examined using a holistic approach. Through a gap analysis conducted as part of the research, the security controls of both structures were compared in detail, and the relationship between the standard's systematic, risk-based approach and the guide's normative regulations specific to the public sector was evaluated. The findings provide a roadmap for public institutions to establish a sustainable information security infrastructure that is compliant with national legislation and open to international audits. The study aims to contribute to the literature and corporate governance not only through theoretical comparisons but also through practical strategic conclusions.