Physical Security Policy
| Classification | PUBLIC |
|---|---|
| Owner and approver | Paul Gardner |
| Standard | ISO/IEC 27001:2022, Annex A controls 7.1 to 7.6, 7.8, 7.9 and 7.11 to 7.14 |
Purpose
This policy sets out how we protect the places and equipment that hold medDigital information against unauthorised access, damage and loss.
Scope
This policy applies to the data centres that host our services, wherever our people work, and all company equipment.
Data centres
Our services, their data and client materials are hosted in professionally run data centres in the UK, which are certified to ISO/IEC 27001. The data centre operator is responsible for their physical security, including controlled entry, monitoring, power, cooling, cabling and the maintenance and secure destruction of their equipment.
Working securely
- Wherever you work, make sure nobody can see or overhear client materials, and follow the clear desk and clear screen rules.
- At home, keep company equipment out of sight when not in use, and do not let anyone else use it.
- Company equipment that is not in use is stored securely, with access restricted to IT.
Laptops and phones
Laptops and phones are encrypted and protected as set out in the Endpoint and Mobile Devices Policy. Taking them outside Great Britain needs approval, as set out in the People Security Policy.
Maintenance and disposal
- Equipment is repaired only by its manufacturer or an approved repairer. Its encryption protects the information on it while it is away, and the repair is recorded.
- Equipment that is no longer needed is erased securely or destroyed, as set out in the Asset Management and Information Handling Policy.
How we check
The data centre operator's certification is checked every year as part of the supplier review. The yearly internal audit checks that equipment is stored securely and that repairs and disposals were recorded.
Exceptions, breaches and review follow the Information Security Policy.
History
| Date | Change |
|---|---|
| 29th October 2026 | Rewritten for ISO/IEC 27001:2022 and moved to www.meddigital.com |
| 10th June 2025 | Periodic review |
| 19th June 2023 | Periodic review |
| 6th June 2022 | Periodic review |
| 16th February 2021 | Periodic review |
| 12th February 2020 | Periodic review |
| 15th May 2018 | Periodic review |
| 15th November 2016 | Moved to the web |
| 17th May 2016 | Removable media permitted with enforced encryption |
| 29th July 2015 | Periodic review |
| 22nd September 2014 | Updated for new offices and building security |
| 8th September 2014 | Rebranding |
| 1st July 2014 | Initial version |