Regulation On The Amendment Of The Regulation On Cybersecurity Competency Model In The Energy Sector Published

As published¹ in the Official Gazette dated 25 November 2025 and numbered 33088, the Energy Market Regulatory Authority has introduced amendments to the Regulation on Cybersecurity Competency Model in the Energy Sector ("Regulation"). With these amendments, important rules have been set regarding the qualifications of auditors and audit firms within the scope of sectoral cybersecurity audits, and alignment with international standards is aimed for. In this respect, certain qualifications now expressly refer to the Certified Information Systems Auditor ("CISA") Certificate and the International Accreditation Forum ("IAF").

Under the amendment, auditors and lead auditors who are part of the audit team will now be required to (i) hold a bachelor's degree from at least a four-year undergraduate program, (ii) hold either an ISO/IEC 27001 Information Security Management Standard ("ISO 27001") Lead Auditor Certificate or a CISA Certificate, and (iii) have at least seven