Public bodies process data of millions of citizens. We explain national security guide expectations, DLP in air-gapped networks and how to choose an on-premises solution.
Key Takeaways
Data security in a public body starts with three conditions: data and logs must not leave the organization, the solution must run in air-gapped networks, and it must produce audit-ready evidence. DLP and data discovery must meet all three together.
- Public bodies are data controllers under data protection laws.
- National security guides (such as the Turkish Information and Communication Security Guide) define technical and administrative measures for critical data.
- Cloud-dependent security products may not work in air-gapped networks.
- Find sensitive data first, then control exit channels.
Why is public sector data security different?
Public bodies process large data sets such as identity, address, health, tax and social benefits. A bulk leak affects millions of people. Some public networks are also closed to the internet, which can make security products tied to a cloud console unusable.
What do national security guides expect?
The Information and Communication Security Guide published by the Turkish Presidency Digital Transformation Office defines security measures for public bodies and critical infrastructure by asset group. Data classification, access control, removable media control, log management and data leak prevention are among them. Other countries have similar frameworks. Decide with your compliance team which level applies to you.
| Measure area | Expectation | How DLP and data discovery help |
|---|---|---|
| Data classification | Defining the confidentiality level of data | Automatic discovery and labeling |
| Removable media | Control of USB and external disk use | Device allowlists, read-only mode, logging |
| Log management | Events are traceable and retained | Central, tamper-proof incident logs |
| Data leak prevention | Blocking unauthorized data exit | Policies on email, web, cloud and printer channels |
This table is not legal advice. Use the current version of the guide that applies to you.
DLP in air-gapped networks
- The management server must run on-premises with no internet access.
- Policy and classification updates must be loadable offline.
- Incident logs must be stored on-premises and be exportable.
- Agent updates must work through the organization’s own deployment system.
Selection criteria for public bodies
- On-premises and air-gapped deployment support
- Local language interface, support and engineering
- Built-in detection for local data types such as national IDs
- Ready audit report templates
- Ability to run on the same agent as endpoint management
90-day plan
- Days 0–30: Discovery. Find where citizen data is on file servers and endpoints.
- Days 31–60: Monitoring. Turn on log mode for USB, email and web channels.
- Days 61–90: Control. Enable blocking policies for your level and report evidence.
How does Moftgate work in the public sector?
Moftgate can run fully on-premises and in networks closed to the internet. Data and logs do not leave the organization. The same agent provides endpoint management, DSPM and DLP together.
Strategic Takeaway
In the public sector, the right DLP is not the one with the most features but the one that really runs in your network design and produces evidence.
Product architects and field engineers who build the Moftgate DLP, device management and data security modules and run customer deployments.
Expert Answers to Core Practitioner Questions
Are public bodies subject to data protection law?
Yes. When they process personal data, public bodies are data controllers and have a data security duty.
Does the Information and Communication Security Guide require DLP?
The guide defines measures to prevent data leaks by asset group and level. Check which items apply to your organization in the current guide.
Can the public sector use cloud-based DLP?
It depends on network design and data class. For air-gapped networks and critical data, on-premises solutions are usually preferred.
Where should a DLP project start?
Start with data discovery. Without knowing which citizen data is where, policies stay incomplete.
Authoritative Sources & Regulatory Standards
- •Cumhurbaşkanlığı Dijital Dönüşüm Ofisi: Bilgi ve İletişim Güvenliği Rehberi ↗(Turkish public sector information security guide and asset groups.)
- •USOM: Ulusal Siber Olaylara Müdahale Merkezi ↗(Turkish national CERT alerts and incident reporting.)
- •6698 sayılı Kişisel Verilerin Korunması Kanunu ↗(Public bodies are also data controllers under Turkish law.)
- •NIST SP 800-53 Rev. 5: Security and Privacy Controls ↗(Reference catalog for access and data flow controls.)