Operations Security Policy
| Classification | PUBLIC |
|---|---|
| Owner and approver | Paul Gardner |
| Standard | ISO/IEC 27001:2022, Annex A controls 5.7, 8.6, 8.8, 8.9, 8.15 to 8.17, 8.19 to 8.22 and 8.34 |
Purpose
This policy sets out how we run the systems that host our services securely: how they are configured, updated, monitored and protected on the network.
Scope
This policy applies to every server, network and hosted service that hosts or supports medDigital's applications and information.
Configuration
- Servers are built and changed by automation from configuration kept under version control. Every change is previewed before it is applied, and nothing is changed on a production server by hand.
- Our laptops and desktops receive a standard security configuration automatically from our device management service.
- Software is installed on production systems only through these routes.
Keeping systems up to date
- Servers install security updates automatically every day.
- The software our applications depend on is audited for known vulnerabilities every day.
- Critical vulnerabilities in our applications and the packages they use are fixed within 2 working days, and high ones within 14 days.
- Our laptops and desktops install security updates automatically every day.
- Systems are upgraded or retired before their operating system stops receiving security updates. Any exception is time-limited and recorded in the risk register.
- We follow security advisories for the products we use, as described in the Organisation, Roles and Risk Policy.
Finding weaknesses
- Our public addresses are scanned from outside every day for open ports, by an independent service.
- Our public websites are scanned regularly for web vulnerabilities.
- Scans and audits never change production systems or data.
Logging
- Our applications record sign-ins, failed sign-ins and other security events.
- Servers send their security logs to a central system, so a record survives even if a server is compromised.
- Logs are protected against unauthorised access and change.
Monitoring
- Every server is checked continuously for availability, load, memory and disk space, so problems are seen before they affect our services.
- Servers have integrity monitoring, which raises an alert when important system files or settings change.
- Application errors are reported to the development team as they happen.
- Every alert goes to a security mailbox, which is reviewed every morning. A daily summary is reviewed at the same time.
Network security
- Our production systems run in a private network in UK data centres, divided so that each tier can reach only what it needs.
- Public traffic reaches our applications only through a load balancer, over encrypted connections using TLS 1.2 or later.
- Databases accept connections only from our application servers and one administrative server.
- Administrative access to servers must be limited to named addresses and use individual keys or certificates that can be revoked.
- Firewalls refuse any traffic that is not explicitly allowed.
Where a system does not yet meet these rules, the exception is recorded in the risk register with a date to fix it. Detailed network diagrams and rules are kept internally.
Time
All servers and computers keep their clocks synchronised with a reliable time source, so that logs from different systems can be compared.
How we check
Monitoring and scan results, update records and alerts are kept, and the security mailbox shows each one was reviewed. The yearly internal audit samples them and checks that no unsupported system is in use without a recorded exception.
Exceptions, breaches and review follow the Information Security Policy.
History
| Date | Change |
|---|---|
| 29th October 2026 | Rewritten for ISO/IEC 27001:2022, combining the Operations Security and Network Security policies, and moved to www.meddigital.com |
| 10th June 2025 | Periodic review |
| 19th June 2023 | Periodic review |
| 6th June 2022 | Periodic review |
| 16th February 2021 | Periodic review |
| 12th February 2020 | Periodic review |
| 20th November 2019 | Web application firewall required. Network traffic logged |
| 21st June 2018 | Location of vulnerability scans and penetration tests updated |
| 15th May 2018 | Periodic review |
| 16th February 2017 | Hosting moved from Dublin to London |
| 5th December 2016 | Time synchronisation requirement documented. Network Security Policy created |
| 15th November 2016 | Moved to the web |
| 31st May 2016 | Database backups expanded |
| 17th May 2016 | Change of location. Change approval, anti-virus, port scanning and application security testing added |
| 29th July 2015 | Periodic review |
| 8th September 2014 | Rebranding |
| 2nd July 2014 | Initial version |