Training & Competency Development

Employees who click simulated phishing links are automatically enrolled in targeted remediation micro-modules immediately after the click event, while the organization is not yet aware. Repeat offenders are flagged in the behavioral analytics dashboard and can be automatically escalated to manager notification or mandatory in-person training based on configurable policy rules. This approach is designed to be corrective rather than punitive.

The curriculum is reviewed and updated quarterly against new KVKK Board decisions, EDPB guidelines, and significant regulatory enforcement decisions from EU data protection authorities. Material changes to legal requirements trigger an immediate curriculum update and a mandatory re-training notification for affected roles. Clients receive an update notification with a summary of legal changes and corresponding curriculum revisions.

Yes. CQI IRCA is the globally recognized scheme for ISO lead auditor qualifications and is accepted by all IAF-accredited certification bodies operating in Turkey and internationally, including TURKAK-accredited bodies. Lead auditor certificates issued under the IRCA scheme are valid for international use and support cross-border audit assignments.

Prior to curriculum development, a platform and tool inventory is conducted to identify all data and analytics tools in production use. Workshop content is then built using screen recordings, exercises, and case studies drawn directly from the client's environment. Where data confidentiality prevents use of real data, representative synthetic datasets are generated that mirror the structure and complexity of actual business data.

Advanced threat simulations are included in the program from campaign level 3 onward. These include highly personalized spear phishing emails referencing real organizational context, WhatsApp and SMS-based smishing simulations, voice phishing script awareness modules, and deepfake video awareness content covering executive impersonation scenarios. Advanced modules are deployed after baseline awareness is established, typically from month 4 onward.

The training program directly addresses the organizational and technical measures requirement under KVKK Article 12. Completion records, assessment results, and curriculum documentation are structured to serve as evidence of organizational measures in KVKK Board audits. However, training alone does not satisfy the full Article 12 requirement; it is most effective when implemented alongside a documented personal data inventory, a privacy policy framework, and data processing agreement management.

The lead auditor examination consists of a written case study exercise and a closed-book written examination covering standard requirements, audit principles, and audit process application. The examination is conducted on the final day of the course and assessed by CQI IRCA examiners. Pass requirements and re-sit procedures follow the current CQI IRCA scheme rules. Participants who do not pass on the first attempt are entitled to one re-sit within the agreed response window.

The AI literacy module covers three dimensions: conceptual understanding of how AI and machine learning models generate outputs, practical skills for interacting with AI tools such as prompt engineering and output validation, and responsible AI principles covering bias recognition, appropriate reliance, and escalation criteria when AI outputs should not be trusted without human review. The module is aligned to the EU AI Act literacy obligation under Article 4 and references sector-relevant AI application examples.