Access Control and Identity Policy
| Classification | PUBLIC |
|---|---|
| Owner and approver | Paul Gardner |
| Standard | ISO/IEC 27001:2022, Annex A controls 5.15 to 5.18, 8.2, 8.3, 8.5 and 8.18 |
Purpose
This policy sets out who can reach medDigital's systems and information, how they prove who they are, and how that access is granted, reviewed and removed.
Scope
This policy applies to everyone who works for medDigital, as an employee or a contractor, and to every system and service that holds or processes medDigital information.
Principles
- Everyone has their own account. Accounts and passwords are never shared.
- People get only the access their role needs, for as long as they need it.
- Access to restricted or personal information is approved by the owner of that system.
One identity
Each person has one company identity, which they use to sign in to their computer and to our services. A shared account is allowed only where a third-party service does not support individual accounts. IT manages it and controls who can use it.
Signing in
- Signing in to our services requires multi-factor authentication for every member of staff.
- Sign-in is allowed only from company-owned devices.
- Passwords are at least 12 characters and must meet complexity rules, including not containing the person's name. They do not expire, so people can choose a strong password and keep it.
- An account is locked after repeated failed sign-in attempts, until IT unlocks it.
- Passwords must never be written down or given to anyone else, including IT.
Joining, moving and leaving
- Line managers request access for the people they manage through our user management system, with a reason for each request. The owner of the system approves or refuses it before IT acts.
- New employees receive their first password only after their line manager has checked their identity in person.
- When someone changes role, access they no longer need is removed.
- When someone leaves, the HR system raises the removal of their access automatically, and IT removes it within one business day.
Reviewing access
Every quarter, line managers review the access of the people they manage and remove anything no longer needed. The user management system prompts them and records the review.
Administrative access
- Administrative access to systems and networks is limited to IT, and requires multi-factor authentication or an individual cryptographic key.
- Staff do not have administrator rights on their computers. Local administrator passwords are unique to each computer and managed automatically.
- Programs that need administrator rights to run may only be used by IT.
Access within our applications
Our applications decide what each user can see and do according to their role, and refuse everything else. Client-facing applications provide their own sign-in protection, including multi-factor authentication and single sign-on with clients' own identity providers where offered.
How we check
The user management system keeps a record of every request, approval and removal, and of each quarterly review. The yearly internal audit samples these records and checks that leavers' access was removed on time.
Exceptions, breaches and review follow the Information Security Policy.
History
| Date | Change |
|---|---|
| 29th October 2026 | Rewritten for ISO/IEC 27001:2022 as Access Control and Identity, replacing the Information Access Policy, and moved to www.meddigital.com. Passwords now at least 12 characters with no forced expiry |
| 10th June 2025 | Periodic review |
| 19th June 2023 | Periodic review |
| 6th June 2022 | Periodic review |
| 16th February 2021 | Periodic review |
| 12th February 2020 | Periodic review |
| 20th November 2019 | Repeated failures to authenticate result in account suspension |
| 2nd May 2018 | Periodic review |
| 5th December 2016 | Restrictions on access to source code. Privileged utility programs |
| 14th November 2016 | Moved to the web |
| 31st May 2016 | Password complexity requirements stated |
| 17th May 2016 | Change of location. Shared accounts permitted where managed by IT. Accounts removed within one business day |
| 29th July 2015 | Periodic review |
| 8th September 2014 | Rebranding |
| 30th June 2014 | Initial version |