Cryptography Policy
| Classification | PUBLIC |
|---|---|
| Owner and approver | Paul Gardner |
| Standard | ISO/IEC 27001:2022, Annex A control 8.24 |
Purpose
This policy sets out how we use encryption to protect information when it is stored and when it travels, and how we look after the keys, passwords and certificates that make it work.
Scope
This policy applies to all information medDigital holds, and to the systems, services and devices that store or send it.
Information in transit
- Our applications accept connections only over TLS 1.2 or 1.3, with strong ciphers. Unencrypted connections are redirected to encrypted ones.
- Staff reach M:\ and our internal systems only over an encrypted connection.
- Email from our domains is signed, and our domains tell receiving servers to reject email that fails the checks, to protect against impersonation.
Information at rest
The following are encrypted using AES with a 256-bit key, or an equivalent standard:
- Our production databases and production servers
- Files stored by our applications
- Client materials
- Backups of our production systems
- Company laptops, phones and tablets
- Removable media, as set out in the Asset Management and Information Handling Policy
Passwords
Passwords stored by our applications are protected with a strong one-way hash (bcrypt). They are never stored in a form that can be read or reversed.
Keys and secrets
- Encryption keys are held in secure key management services.
- Other keys and secrets, such as application keys and service credentials, are kept only where they are needed, with access restricted to IT.
- A key or secret is replaced when it may have been exposed, or when someone who had access to it leaves.
Certificates
Certificates come from trusted certificate authorities and are renewed automatically before they expire.
Keeping current
We use current, widely trusted algorithms and protocols, and retire them when they are no longer considered secure.
How we check
The yearly internal audit checks the encryption settings of our services, storage and devices, and that certificates are renewing.
Exceptions, breaches and review follow the Information Security Policy.
History
| Date | Change |
|---|---|
| 29th October 2026 | Rewritten for ISO/IEC 27001:2022 and moved to www.meddigital.com |
| 10th June 2025 | Periodic review |
| 19th June 2023 | Periodic review |
| 6th June 2022 | Periodic review |
| 16th February 2021 | Periodic review |
| 12th February 2020 | Periodic review |
| 15th May 2018 | Updated for the move to the M: drive |
| 2nd February 2017 | Amazon Web Services approved as a certificate provider |
| 14th November 2016 | Moved to the web |
| 31st May 2016 | Retention of the shared drive stated |
| 17th May 2016 | Change of location. Removable media given its own section |
| 29th July 2015 | Periodic review |
| 8th September 2014 | Rebranding |
| 1st July 2014 | Initial version |