Endpoint and Mobile Devices Policy
| Classification | PUBLIC |
|---|---|
| Owner and approver | Paul Gardner |
| Standard | ISO/IEC 27001:2022, Annex A controls 8.1, 8.7 and 8.23 |
Purpose
This policy sets out how the laptops, phones and tablets our people use are protected, so that client materials and company information stay secure wherever they are used.
Scope
This policy applies to every company-owned laptop, desktop, phone and tablet, and to everyone who uses one. Company information is never used on personal devices.
Laptops and desktops
Every one of our laptops and desktops is centrally managed and receives a standard security configuration automatically:
- Its disk is encrypted.
- The screen locks after 10 minutes without use.
- Its firewall is always on and blocks unsolicited incoming connections.
- Protection against malware runs at all times, updates itself automatically and reports threats centrally.
- Security updates are installed automatically every day.
- Users do not have administrator rights. Each computer's local administrator password is unique and managed automatically.
- Web browsing is protected against known malicious sites and downloads.
- It can write only to removable media that is encrypted, as set out in the Asset Management and Information Handling Policy.
- It reaches M:\ and our internal systems only over an encrypted connection.
Phones and tablets
Every company phone and tablet is enrolled in our device management service before it is used for work:
- It is encrypted, with a passcode of at least six characters.
- It runs a supported version of its operating system that has not been tampered with.
- It can be locked or erased remotely.
Looking after devices
- Lock your device whenever you leave it, and keep it with you or locked away when travelling.
- Report a lost or stolen device to security@meddigital.com at once, so that it can be locked or erased.
- Do not try to change or remove the security configuration.
How we check
IT reviews the health and security alerts of every managed device. The yearly internal audit checks that every device in use is managed, encrypted and up to date.
Exceptions, breaches and review follow the Information Security Policy.
History
| Date | Change |
|---|---|
| 29th October 2026 | Rewritten for ISO/IEC 27001:2022 as Endpoint and Mobile Devices, taking the device parts of the Mobile Device and Teleworking, Physical Security and Cryptography policies, and moved to www.meddigital.com |
| 10th June 2025 | Periodic review |
| 19th June 2023 | Periodic review |
| 6th June 2022 | Intune replaces Okta for device management. Periodic review |
| 16th February 2021 | Periodic review |
| 12th February 2020 | Periodic review |
| 2nd May 2018 | Responsibilities expanded. Periodic review |
| 13th December 2016 | Type of VPN stated |
| 2nd December 2016 | Initial version |