Anyone audited under the Law must keep the relevant devices, systems, software and hardware open for audit within the periods given, and take the measures needed to supply the infrastructure the audit requires and keep it working. Auditors (Presidency staff and authorised, accredited independent auditors and audit firms; in public institutions and critical infrastructures, Presidency staff or auditors accompanied by them) may examine electronic data, documents, infrastructure, devices, systems, software and hardware, take copies, digital images or samples, ask for written or oral explanations, draw up minutes and inspect facilities and their operation (Article 8(1) and (4)). Failure carries an administrative fine of 100,000 to 1 million Turkish lira, or for commercial companies not less than 100,000 lira and up to 5% of gross sales in the independently audited annual financial statements (Article 16(11)).
This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.