Cameras, access gates and security officers do not, by themselves, demonstrate that a facility meets defence industry security requirements. Nor does every factory, power plant or data centre necessarily require a Facility Security Certificate. The starting question is what project the site supports and what classified information or material it will handle.
This guide helps businesses preparing for defence work distinguish document names from the activities they authorise. A company's participation in an MSB- or NATO-related project does not automatically give every security supplier it appoints the same status.
Establish requirements from the project scope
Türkiye's defence industry security framework under Law No. 5202 concerns the protection of classified information, documents, projects and material. Determine the relevant certificate and its scope from official requirements, the contract and the competent authority's direction. An online checklist cannot replace the official assessment for a particular project.
Obtain written requirements, the relevant facility address, activity boundaries and any classification conditions from the project owner. Tender eligibility, contract performance conditions and permission to access particular information may be different matters. Verify when each approval is needed instead of assuming one document covers every stage.
Facility, personnel and guarding authorisations are different
A Tesis Güvenlik Belgesi, or Facility Security Certificate, relates to the facility. A Kişi Güvenlik Belgesi, or Personnel Security Certificate, relates to the individual. Private security permissions and officer identification under Law No. 5188 do not replace these documents. Holding an appropriate personnel certificate does not create unrestricted access to every area or item of information.
Define necessary access by project, role, location and time. Review permissions when personnel change or the project ends. When checking a supplier's claimed credentials, go beyond a logo or vague reference to certification: establish the holder, scope, validity and connection to the relevant facility.
Prepare a site-specific plan rather than a shopping list
The MSB framework's facility security handbook and certification processes make documented arrangements important. This does not establish one universal requirement for a particular biometric reader, barrier type or video retention period at every site. Link each control to the applicable requirement and the facility's risk assessment.
Allocate responsibility for boundaries, visitors, keys and access cards, controlled material movements, alarm reporting and access records. Plan for maintenance, faults and shift handovers as well as normal operation. Evidence that a control works comes from suitable tests, records and resolved deficiencies, rather than simply an equipment invoice.
Keep personnel checks within authorised processes
Do not describe a private company's own enquiries as equivalent to official security investigations or certification. Processes conducted by competent public authorities differ from an employer's lawful recruitment checks. Excessive files about political views or private life cannot be justified merely by labelling them security requirements.
Assess the purpose, legal basis, access permissions and retention arrangements for personal data separately. Where biometric identification is proposed, convenience alone is insufficient: consider necessity, proportionality and less intrusive alternatives.
Ask the supplier for concrete evidence
Require the proposal to identify the work included and the official processes outside its scope. Specify officer competence, handovers, confidentiality obligations, incident reporting and records available for inspection. The competent authorities make the final certification decisions; a commercial offer should not be read as a guarantee of approval. The practical aim is to maintain appropriate access throughout everyday operations, rather than produce an impressive appearance on inspection day.
