Incident Management Policy
| Classification | PUBLIC |
|---|---|
| Owner and approver | Paul Gardner |
| Standard | ISO/IEC 27001:2022, Annex A controls 5.24 to 5.28 and 6.8 |
Purpose
This policy sets out how we recognise, report, handle and learn from information security incidents, so that their harm is kept as small as possible and the people affected are told promptly.
Scope
This policy applies to everyone who works for medDigital, as an employee or a contractor, to our suppliers, and to every system and service that holds medDigital information.
What is an incident
An information security incident is anything that harms, or could harm, the confidentiality, integrity or availability of information. For example:
- Information lost, stolen, or sent to the wrong person
- Unauthorised access to a system or account
- A password or other credential disclosed
- Malware on a company device
- A lost or stolen laptop or phone
- A service unavailable because of an attack or failure
- Misuse of systems or information
A suspected incident, or a weakness that could lead to one, is reported in the same way.
Reporting
Report every incident, suspected incident or weakness to security@meddigital.com as soon as you notice it. Do not try to investigate or fix it yourself, and do not delete anything. The mailbox is reviewed every morning.
Anyone outside medDigital who finds a security issue in our services can report it to the same address.
Assessment
The incident manager assesses every report, decides whether it is an incident, and gives it a severity:
| Severity | Meaning | Response begins |
|---|---|---|
| Critical | Personal or client data exposed, or a service down for clients | As soon as it is known |
| High | A system or account compromised, with no data known to be exposed | Within 4 hours |
| Medium | A contained event, such as malware blocked or a device lost while encrypted | Within 1 working day |
| Low | A weakness or near miss with no harm | Within 5 working days |
Every incident is recorded internally from the moment it is reported until it is closed.
Response
- Contain the incident and limit the harm.
- Find the cause and remove it.
- Restore affected services, as set out in the Business Continuity Policy.
- Bring in suppliers where they are involved.
- Keep the record up to date throughout, and keep the incident confidential.
Telling people
The directors decide together who must be told, and the incident manager makes sure they are told in time:
- The Information Commission (ICO), within 72 hours of our becoming aware of a personal data breach that must be reported
- The people affected, without undue delay, when a breach is likely to put them at high risk
- Our clients, as their contracts require
- For US users of medCrowd, the people affected and the authorities, within the time limits HIPAA sets
- The police or the National Cyber Security Centre, where a crime or a significant cyber incident is involved
The contacts are listed in the Organisation, Roles and Risk Policy.
Evidence
Evidence is collected before systems are changed or restarted, wherever that is safe, because a restart can destroy it. Logs, copies and notes are kept with the incident record, protected from change, so they can be relied on later, including in legal proceedings.
Child sexual abuse material
If you come across material that may show the sexual abuse or exploitation of a child, in any of our services or anywhere in your work:
- Do not download, copy, forward, screenshot or show it to anyone. Doing so can be a criminal offence, even when you mean to help.
- If a child is in immediate danger, call 999 first.
- Report it at once to security@meddigital.com, saying where you saw it.
The incident manager removes the material from our service, reports it to the National Crime Agency within the time limits the law sets, and keeps the records the law requires, securely and only for as long as it requires.
Learning
Before an incident is closed, we record what happened, why, and what we will change so it does not happen again. Those changes are tracked until they are done. Only the incident manager closes an incident record, once all of this is complete.
Practice
Once a year we rehearse our response to a realistic incident and record what we learn.
Breaches of policy
A supplier or contractor whose failure to follow our policies causes or risks an incident loses access to our systems at once. Breaches by employees are dealt with under the disciplinary process.
How we check
Incident records and the yearly exercise are reviewed at the management review. The yearly internal audit checks that every incident was recorded, assessed, notified where required and closed with its lessons.
Exceptions and review follow the Information Security Policy.
History
| Date | Change |
|---|---|
| 29th October 2026 | Rewritten for ISO/IEC 27001:2022 as Incident Management, replacing the Information Security Incident Management Policy, and moved to www.meddigital.com. Severity levels, evidence handling, a yearly exercise and the procedure for child sexual abuse material added |
| 10th June 2025 | Periodic review |
| 19th June 2023 | Periodic review |
| 6th June 2022 | Periodic review |
| 16th February 2021 | Periodic review |
| 12th February 2020 | Periodic review |
| 25th May 2018 | The ICO is notified within 72 hours of a personal data breach |
| 15th May 2018 | Periodic review |
| 15th November 2016 | Moved to the web. HIPAA added |
| 17th May 2016 | Change of location. When an incident record may be closed |
| 30th July 2015 | Periodic review |
| 8th September 2014 | Rebranding |
| 2nd July 2014 | Initial version |