People Security Policy
| Classification | PUBLIC |
|---|---|
| Owner and approver | Paul Gardner |
| Standard | ISO/IEC 27001:2022, Annex A controls 5.4 and 6.1 to 6.7 |
Purpose
This policy sets out how we make sure the people who work for us are suitable for their roles, understand their responsibilities for information security, and keep to them from the day they join until after they leave.
Scope
This policy applies to everyone who works for medDigital, as an employee or a contractor, and to the line managers responsible for them.
Before someone joins
- Every offer of employment depends on satisfactory references and proof of the right to work in the UK.
- Right-to-work documents are checked and recorded before someone starts, and their expiry dates are tracked.
- A new employee's identity is checked in person before they receive their first password.
Terms and confidentiality
- Employment contracts require compliance with our information security policies and include a duty of confidentiality.
- Contractor agreements require the same compliance and confidentiality. Contractors must also hold professional indemnity insurance at the level our clients require.
- The duty of confidentiality continues after someone leaves.
Training
Everyone completes information security training when they join and every January. It covers our policies, how to handle client materials, recognising phishing and other attempts to deceive, and how to report an incident. Some clients have training of their own, which everyone working on their projects must also complete. Completed training is recorded.
Responsibilities
- Line managers make sure the people they manage complete their training, follow our policies and have only the access they need.
- Everyone follows the policies and reports security events and weaknesses as set out in the Incident Management Policy.
Disciplinary process
A breach of our information security policies by an employee is dealt with under the disciplinary process. A breach by a contractor is dealt with under their agreement.
Leaving or changing role
- When someone's employment ends, the HR system raises the removal of their access automatically, and IT removes it within one business day.
- Their line manager makes sure all company equipment is returned.
- When someone changes role, access they no longer need is removed.
Remote working
- Staff may work remotely in Great Britain, on company-owned devices only.
- Taking company equipment outside Great Britain needs approval from security@meddigital.com, requested at least five working days before travel.
- When working remotely, follow the clear desk and clear screen rules.
How we check
Training records are reviewed at the yearly management review. The yearly internal audit checks a sample of joiners for screening and training, and of leavers for removed access and returned equipment.
Exceptions and review follow the Information Security Policy.
History
| Date | Change |
|---|---|
| 29th October 2026 | Rewritten for ISO/IEC 27001:2022 as People Security, combining the Human Resource Security and Training policies and the remote working part of the Mobile Device and Teleworking Policy, and moved to www.meddigital.com |
| 10th June 2025 | Periodic review |
| 5th September 2023 | The training log's "New Starters" tab renamed "Annual Training" |
| 19th June 2023 | Periodic review |
| 6th June 2022 | Periodic review |
| 16th February 2021 | Periodic review |
| 12th February 2020 | Periodic review |
| 15th May 2018 | Training materials moved to the M: drive |
| 2nd May 2018 | Periodic review |
| 14th November 2016 | Moved to the web. Refresher training moved to January |
| 5th December 2016 | Human Resource Security Policy created |
| 9th November 2015 | Standard operating procedure for adverse event monitoring added to training |
| 29th July 2015 | Periodic review |
| 8th September 2014 | Rebranding |
| 30th June 2014 | Initial version |